[Authorize] Always Returns 401 Even With Valid-Looking JWT Token

I’m getting a 401 Unauthorized whenever I call my [Authorize] endpoint, even though I’m sending a JWT.
The token appears correct on the client side — JWT decoders show the expected claims (screenshot 1), and the signature verifies. The token is stored in Local Storage (screenshot 2), and the frontend sends the header:

Authorization: Bearer eyJhbGciOiJIUzI1...

Authorization: Bearer eyJhbGciOiJIUzI1...

. However, the only endpoint protected with [Authorize] always returns 401 Unauthorized.

C# backend exception:

IDX14102: Unable to decode the header 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9' as Base64Url encoded string.

IDX14102: Unable to decode the header 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9' as Base64Url encoded string.

.

Swagger response:

 content-length: 0 
 date: Thu,20 Nov 2025 19:41:17 GMT 
 server: Kestrel 
 www-authenticate: Bearer error="invalid_token"

 content-length: 0 
 date: Thu,20 Nov 2025 19:41:17 GMT 
 server: Kestrel 
 www-authenticate: Bearer error="invalid_token"

This is the endpoint I cannot reach (breakpoints never hit):

[Authorize]
[HttpGet("UserInfo")]
public async Task<ActionResult<LoggedUserModel>> GetUserInfo()
{
    // Code never executes — authorization fails before entering the controller
}

[Authorize]
[HttpGet("UserInfo")]
public async Task<ActionResult<LoggedUserModel>> GetUserInfo()
{
    // Code never executes — authorization fails before entering the controller
}

I’ve also attached the source code of the controller and my Program.cs setup. It might be an issue with my token generation or the way I configured authentication/authorization.
Does anyone know what could be causing this? This issue is part of my highschool graduation project, so any help would be greatly appreciated.

message.txt12.79KB

message.txt6.09KB

[Authorize] Always Returns 401 Even With Valid-Looking JWT Token

Authorization: Bearer eyJhbGciOiJIUzI1...

Authorization: Bearer eyJhbGciOiJIUzI1...

. However, the only endpoint protected with [Authorize] always returns 401 Unauthorized.

C# backend exception:

IDX14102: Unable to decode the header 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9' as Base64Url encoded string.

IDX14102: Unable to decode the header 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9' as Base64Url encoded string.

.

Swagger response:

 content-length: 0 
 date: Thu,20 Nov 2025 19:41:17 GMT 
 server: Kestrel 
 www-authenticate: Bearer error="invalid_token"

 content-length: 0 
 date: Thu,20 Nov 2025 19:41:17 GMT 
 server: Kestrel 
 www-authenticate: Bearer error="invalid_token"

This is the endpoint I cannot reach (breakpoints never hit):

[Authorize]
[HttpGet("UserInfo")]
public async Task<ActionResult<LoggedUserModel>> GetUserInfo()
{
    // Code never executes — authorization fails before entering the controller
}

[Authorize]
[HttpGet("UserInfo")]
public async Task<ActionResult<LoggedUserModel>> GetUserInfo()
{
    // Code never executes — authorization fails before entering the controller
}

message.txt12.79KB

message.txt6.09KB

[Authorize] Always Returns 401 Even With Valid-Looking JWT Token

[Authorize] Always Returns 401 Even With Valid-Looking JWT Token

Similar Threads

Similar Threads

Similar Threads