How to Add JWT Authentication to SignalR Hubs in ASP.NET Core

Real-time communication in .NET applications becomes effortless with SignalR. However, by default, SignalR hubs are open to all clients, lacking user identification, access restrictions, and audit trails. To address these security concerns, JWT authentication emerges as the go-to solution for securing SignalR hubs. Unlike cookies, JWT tokens are more suitable for cross-platform authentication in mobile, desktop, or single-page applications. They also facilitate stateless authentication across microservices.

In a SignalR connection, JWT tokens are typically passed as a query string parameter (?access_token=token) rather than an HTTP header, as browsers do not support custom headers for WebSockets or Server-Sent Events. Consequently, extra server-side configuration is required to extract the token from the query string. The article walks through the process of setting up JWT authentication for SignalR, including the inclusion of JWT bearer authentication in the service configuration and the implementation of an OnMessageReceived event handler to extract the token from the query string.

This event is triggered before the JWT middleware validates the token, ensuring that only queries starting with /hubs are scanned for tokens. The JavaScript client sends the token via the query string, while a .NET client connects directly to the SignalR hub. Throughout the process, best practices for security in SignalR are emphasized to maintain the integrity and protection of real-time data streams.