HttpContext.GetTokenAsync fails after Upgrade to 2.1.0

[TimHess]

Hello,
I have some code that's calling await HttpContext.GetTokenAsync("access_token"). When using Microsoft.AspNetCore.Authentication.JwtBearer version 2.0.4 it works, but upgrading to 2.1.0-preview1-final or newer results in null being returned.

I believe this is because on line 73 in Microsoft.AspNetCore.Authentication.Core/AuthenticationService.cs
return AuthenticateResult.Success(new AuthenticationTicket(transformed, result.Properties, result.Ticket.AuthenticationScheme)); result.Properties is null.

When using JwtBearer auth, result.Properties is never set - however, the properties that are expected to be there are present on result.Ticket. Changing line 73 to return AuthenticateResult.Success(new AuthenticationTicket(transformed, result.Ticket.Properties, result.Ticket.AuthenticationScheme)); appears to fix the issue for me, is there any reason not to do so?
Thanks

[Tratcher]

JwtBearer Succeeds:

Security/src/Microsoft.AspNetCore.Authentication.JwtBearer/JwtBearerHandler.cs

Lines 152 to 153 in e031eff

	tokenValidatedContext.Success();
	return tokenValidatedContext.Result;

Creates a ticket and HandleRequestResult:

Security/src/Microsoft.AspNetCore.Authentication/Events/ResultContext.cs

Line 46 in e031eff

public void Success() => Result = HandleRequestResult.Success(new AuthenticationTicket(Principal, Properties, Scheme.Name));

Stores the ticket:

Security/src/Microsoft.AspNetCore.Authentication/HandleRequestResult.cs

Line 36 in e031eff

return new HandleRequestResult() { Ticket = ticket };

Which doesn't set Properties like the base class does:
https://github.com/aspnet/HttpAbstractions/blob/bcb7bcbb7a6461204f4cefd9848e2a782ebb0a6b/src/Microsoft.AspNetCore.Authentication.Abstractions/AuthenticateResult.cs#L57

[HaoK]

Yeah looks like a bug

[TimHess]

@Tratcher Thanks for accepting the PR - is it possible to have this included in 2.1.0-RTM?

[Tratcher]

Sorry, no. 2.1 is already completed.

[davidfowl]

Is this a patch candidate? /cc @muratg @ajcvickers

[ajcvickers]

@Tratcher @HaoK Is there a workaround?

[HaoK]

The information is still there via result.Ticket.Properties, so the workaround would be to use the underlying apis instead of the top level sugar...

instead of context.GetToken("access_token") something like:

 context.AuthenticateAsync(JwtBearer.Defaults).Ticket.Properties.GetToken("access_token");

[ajcvickers]

Thanks @HaoK. So the workaround is easy. How common do we think it will be for people to hit this?

[Tratcher]

That workaround doesn't work, all of the Properties collections are empty. You'd have to go a step further and hook into an event and store the token yourself in HttpContext.Items.