Namespaces for .NET JWT token validation: System vs. Microsoft

I am trying to use JWT to authenticate a Node application to an ASP.NET Web API.

In ASP.NET, I am using .NET 4.5.1 and nuget package System.IdentityModel.Tokens.Jwt 5.0.0

What I don’t understand is, why the namespaces are mixed between Microsoft and System.

For example:

var tokenReader = new JwtSecurityTokenHandler();

tokenReader.ValidateToken(token, 
                new TokenValidationParameters()
            {
                ValidateAudience = false
            },
                out validatedToken);

The main JwtSecurityTokenHandler is in the System.IdentityModel.Tokens.Jwt namespace, but the TokenValidationParameters class and its dependencies are in the Microsoft.IdentityModel.Tokens namespace, and possibly collide with similar classes in the System.IdentityModel.Tokens namespace.

Is this by design or is this a possible sign of a version mismatch somewhere else?

Answers:

Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.

Method 1

If you take a look at the dependency for

nuget System.IdentityModel.Tokens.Jwt 4.0.2

vs

nuget System.IdentityModel.Tokens.Jwt 5.0

you’ll see that 5.0 has a dependency on

Dependencies

.NETFramework 4.5.1

Microsoft.IdentityModel.Tokens (>=5.0.0)

that 4.0 didn’t have. In fact, no previous version did.

Microsoft is re-architect-ing their frameworks to be more light weight. In a framework the size of ASP.NET, you will have many functional redundancies.

To make WIF lighter, while remaining backwards compatible, the decision was made to remove the redundant functionality from libraries like System.IdentityModel.Tokens.Jwt no longer depend on System.IdentityModel.Tokens, but instead on Microsoft.IdentityModel.Tokens. One of the unfortunate results is that both layers expose the same methods.

Method 2

In these cases, when you instance you must provide the entire namespace to inform the compiler which Class and namespace you’re referencing. So, you will avoid conflicts.

Microsoft.Identity is deprecated in NET 4.5. And you can see more here: https://social.msdn.microsoft.com/Forums/vstudio/en-US/256c6bcd-6752-4487-b2e8-6c63f4efb9e9/difference-between-microsoftidentitymodel-and-systemidentitymodel?forum=Geneva


All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0

0 0 votes
Article Rating
Subscribe
Notify of
guest

0 Comments
Inline Feedbacks
View all comments
0
Would love your thoughts, please comment.x
()
x