AddIdentityServerJwt might accidentally use the wrong issuer URL.

Describe the bug

When using AddIdentityServerJwt the IssuerURL seems to be derived from the actual request. The option management hooks into the events and enriches the options with the host name from the request:

https://github.com/dotnet/aspnetcore/blob/b795ac3546eb3e2f47a01a64feb3020794ca33bb/src/Identity/ApiAuthorization.IdentityServer/src/Authentication/IdentityServerJwtBearerOptionsConfiguration.cs#L63

When the first request that comes in is not the public host name, the options is enriched with the wrong host and all subsequent calls to authorize fail because the issuer URL does not match.

Consider a scenario where you have a health check running. The health service uses the internal IP (e.g. in kubernetes) to call the health endpoint and the issuer URL is configured with the IP address.

To Reproduce

1. Create a new SPA sample (dotnet new react -au Individual)
2. Login
3. Restart the server
4. Go to https://127.0.0.1:5001 before you go to any other URL
5. Go to https://localhost:5001 and press fetch data

The result in Chrome:

Bearer error="invalid_token", error_description="The issuer 'https://localhost:5001' is invalid"

Further technical details

• ASP.NET Core version 5

[mkArtakMSFT]

Thanks for contacting us, @SebastianStehle. Due to the holiday season please expect some delays in our responses. @HaoK can you please investigate this when you’re back? Thanks!

[HaoK]

Doc/release note issue filed to track this for 6.0 https://github.com/dotnet/aspnetcore/issues/36676