ASP.NET Core验证Firebase OIDC令牌时遇IDX10500错误求助

我正尝试在后端验证来自Google Firebase的OpenId Connect令牌，代码如下：

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
       .AddJwtBearer(options =>
       {
           options.Audience = "<firebase project id>";
           options.MetadataAddress = "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com";
           options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
           {
               ValidateAudience = true,
               ValidateIssuer = true,
               ValidateLifetime = true,
               ValidateIssuerSigningKey = true,
               RequireAudience = true,
               RequireExpirationTime = true,
               RequireSignedTokens = true,
               ValidIssuer = $"https://securetoken.google.com/{options.Audience}"
           };
       });

但令牌因缺少安全密钥未被接受，错误信息如下：

info: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler[7]
      Bearer was not authenticated. Failure message: IDX10500: Signature validation failed. No security keys were provided to validate the signature.

我的令牌的kid与Google提供的密钥地址中的某一密钥ID匹配，因此我无法理解该错误。ASP.NET Core难道不应该通过MetadataAddress提供的地址自动下载密钥吗？我遗漏了什么？

问题原因与解决方案 #

问题出在你手动创建了TokenValidationParameters实例，覆盖了JwtBearer中间件默认的参数配置，导致内置的密钥获取逻辑被清除。

当你直接赋值新的TokenValidationParameters时，中间件原本负责从MetadataAddress下载公钥的IssuerSigningKeyResolver会被重置，无法自动获取验证令牌所需的安全密钥。

修改代码如下，直接修改默认的TokenValidationParameters而非重新创建实例：

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
       .AddJwtBearer(options =>
       {
           options.Audience = "<firebase project id>";
           options.MetadataAddress = "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com";
           
           // 直接修改中间件默认的TokenValidationParameters，保留内置逻辑
           options.TokenValidationParameters.ValidateAudience = true;
           options.TokenValidationParameters.ValidateIssuer = true;
           options.TokenValidationParameters.ValidateLifetime = true;
           options.TokenValidationParameters.ValidateIssuerSigningKey = true;
           options.TokenValidationParameters.RequireAudience = true;
           options.TokenValidationParameters.RequireExpirationTime = true;
           options.TokenValidationParameters.RequireSignedTokens = true;
           options.TokenValidationParameters.ValidIssuer = $"https://securetoken.google.com/{options.Audience}";
       });

额外验证点 #

• 确认Audience是正确的Firebase项目ID，无拼写错误
• 检查令牌的iss声明值与你设置的ValidIssuer完全一致

内容的提问来源于stack exchange，提问作者me.at.coding