Fluens.Web.Auth 0.8.2

Fluens.Web.Auth

JWT Bearer authentication and security headers middleware for Fluens web applications.

Installation

dotnet add package Fluens.Web.Auth

Usage

fluensBuilder.AddAuth();

app.UseSecurityHeaders();
app.UseAuthentication();
app.UseAuthorization();

AddAuth() accepts an optional Action<AuthOptions>? configure callback (after configureJwt); a callback-only call — with no matching Fluens:Auth configuration section present — is still honoured and validated.

Configuration section: Fluens:Auth:

{
  "Fluens": {
    "Auth": {
      "Enabled": true,
      "Issuer": "https://myapp.example.com",
      "Audience": "myapp-api",
      "SecretKey": "your-secret-key-at-least-32-characters-long!"
    }
  }
}

Claim mapping

AddAuth() sets JwtBearerOptions.MapInboundClaims = false before your configureJwt callback runs, so the token handler preserves the JWT's own claim names ("sub" stays "sub") instead of rewriting them to legacy WS-Federation claim-type URIs. This is what lets Fluens.Web.Contexts's ClaimsPrincipal.GetUserId() read the standard "sub" claim directly. If you need the legacy mapping behavior, opt back in explicitly:

fluensBuilder.AddAuth(configureJwt: jwt => jwt.MapInboundClaims = true);

TokenValidationParameters.NameClaimType and .RoleClaimType are pinned to the short OIDC-style "name" and "role" claim names, matching MapInboundClaims = false. A token carrying role: "admin" and name: "Alice" makes ClaimsPrincipal.IsInRole("admin") return true and Identity.Name return "Alice" without any extra setup:

app.MapGet("/admin", () => "ok").RequireAuthorization(new AuthorizationPolicyBuilder()
    .RequireRole("admin")
    .Build());

If your issuer emits a legacy WS-Federation claim-type URI for role or name claims instead (http://schemas.microsoft.com/ws/2008/06/identity/claims/role), override both in configureJwt - it runs after this library's defaults, so your values win:

fluensBuilder.AddAuth(configureJwt: jwt =>
{
    jwt.TokenValidationParameters.RoleClaimType = ClaimTypes.Role;
    jwt.TokenValidationParameters.NameClaimType = ClaimTypes.Name;
});

Overriding JwtBearerOptions

AddAuth() accepts an optional configureJwt callback to override JWT Bearer defaults:

fluensBuilder.AddAuth(configureJwt: jwt =>
{
    jwt.TokenValidationParameters.ClockSkew = TimeSpan.FromMinutes(1);
});

SecurityHeadersOptions

UseSecurityHeaders() adds all security headers by default. Accepts an optional Action<SecurityHeadersOptions>? configure callback to override individual headers:

app.UseSecurityHeaders(opts =>
{
    opts.FrameOptions = false; // disable X-Frame-Options
    opts.PermissionsPolicyValue = "camera=(), microphone=()"; // custom policy
});

All headers are enabled via SecurityHeadersOptions (all properties use set — not the usual init — because the callback above mutates the instance after construction — and default to true):

License

This project is licensed under the MIT License.