{
  "id": 9733646,
  "title": "How to Add JWT Authentication to SignalR Hubs in ASP.NET Core",
  "url": "https://urgent.news/2026/09/25/how-to-add-jwt-authentication-to-signalr-hubs-in-asp-net-core",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-25T08:11:41.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/antonmartyniuk/how-to-add-jwt-authentication-to-signalr-hubs-in-aspnet-core-5d03"
  },
  "original_language": "en",
  "account": "Real-time communication in .NET applications becomes effortless with SignalR. However, by default, SignalR hubs are open to all clients, lacking user identification, access restrictions, and audit trails. To address these security concerns, JWT authentication emerges as the go-to solution for securing SignalR hubs. Unlike cookies, JWT tokens are more suitable for cross-platform authentication in mobile, desktop, or single-page applications. They also facilitate stateless authentication across microservices.\n\nIn a SignalR connection, JWT tokens are typically passed as a query string parameter (?access_token=token) rather than an HTTP header, as browsers do not support custom headers for WebSockets or Server-Sent Events. Consequently, extra server-side configuration is required to extract the token from the query string. The article walks through the process of setting up JWT authentication for SignalR, including the inclusion of JWT bearer authentication in the service configuration and the implementation of an OnMessageReceived event handler to extract the token from the query string. This event is triggered before the JWT middleware validates the token, ensuring that only queries starting with /hubs are scanned for tokens. The JavaScript client sends the token via the query string, while a .NET client connects directly to the SignalR hub. Throughout the process, best practices for security in SignalR are emphasized to maintain the integrity and protection of real-time data streams.",
  "summary": "SignalR makes real-time communication in .NET applications simple. You can send live data, notifications, and streaming updates to clients with minimal code. By default, SignalR hubs are accessible to all clients. Clients can connect, call hub methods, and receive messages without authentication. In production, you may need to know who is connecting to your hub, what they are allowed to do, and…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}