Unauthorized 401 when upgrading System.IdentityModel.Tokens.Jwt from 6.30.0 to 6.30.1

[GonzaloLebron]

Sorry if this is a repeated issue, in a project (NET6) I was using System.IdentityModel.Tokens.Jwt package reference version "6.30.*"
It was working fine until rebuilded and redeployed, then Unauthorized 401 started appearing in all endpoints requiring authorization (using bearer token), JWT Issuer, Audience and SecretKey did not change, bearer token was correct. Noticed that System.IdentityModel.Tokens.Jwt package was different (was using 6.30.0 and auto updated to 6.30.1).
Downgraded to 6.30.0 and is working fine again.
Upgraded to specific version 6.30.1 and Unauthorized 401 happening again.

[brentschmaltz]

@GonzaloLebron sorry to hear this.
Can you describe your environment (asp.net, etc) and versions.
Are there any exceptions?

[brentschmaltz]

@GonzaloLebron i think this is related to #2059, will close this issue.

You can track 2059.

[GonzaloLebron]

The problem is still happening to me, upgrading from
Microsoft.IdentityModel.Tokens 6.27.0 to the latest version.
The error I get (when debugging the library) is:
IDX10720: Unable to create KeyedHashAlgorithm for algorithm 'HS256', the key size must be greater than: '256' bits, key has '192' bits. (Parameter 'keyBytes')'
In Microsoft.IdentityModel.Tokens
Class: CryptoProviderFactory
Method ValidateKeySize(byte[] keyBytes, string algorithm, int expectedNumberOfBytes)

Clearly 24 characters and not 32 SecretKey is my issue
"JwtIssuerOptions": {
"SecretKey": "XXXXXXXXXXXXXXXXXXXXXXXX"
},

Even if
var signinKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtIssuerOptions.SecretKey));
var signInCredentials = new SigningCredentials(signinKey, SecurityAlgorithms.HmacSha256);

My question is, why this is not a breaking change ?

The issue is at:
namespace Microsoft.IdentityModel.Tokens
Class: public class SymmetricSignatureProvider : SignatureProvider
Method: public override bool Verify(byte[] input, byte[] signature)
Line calling ->LogHelper.LogInformation(LogMessages.IDX10643, input);

[penfold]

Just been hit with the same issue. :-(

[GonzaloLebron]

Just been hit with the same issue. :-(

Yeah... and I don't know how to reopen this issue... since it is not related to #2059