title: Stateless authentication with NancyFx, OWIN and JWT
body: <p>I have a OWIN self-hosted application which has a front-end where users can sign up. Nancyfx does the logic for routing and Models, and in the <a href="https://github.com/NancyFx/Nancy/wiki/Authentication-overview" rel="nofollow noreferrer">documentation</a> I saw that Nancyfx comes with 3 types of authentication.</p>
  
  <ul>
  <li>Forms (<code>Nancy.Authentication.Forms</code>)</li>
  <li>Basic (<code>Nancy.Authentication.Basic</code>)</li>
  <li>Stateless (<code>Nancy.Authentication.Stateless</code>)</li>
  </ul>
  
  <p>I've settled on the Stateless Authentication, and following <a href="https://github.com/NancyFx/Nancy/tree/master/samples/Nancy.Demo.Authentication.Stateless" rel="nofollow noreferrer">this example</a> I tried to set up a basic form of authentication.</p>
  
  <p>I wanted to expand further on this, using JWT to have some basic info handy and as a form of basic authentication (e.g. client has token so he's verified.), but this is where I run into a few problems.</p>
  
  <ol>
  <li>The way I authenticate <code>Home -&gt; login -&gt; redirect upon success</code> causes my Response.Header.Authorization to be cleared, not allowing me to catch the token in my custom Bootstrapper.</li>
  </ol>
  
  <p>Code:</p>
  
  <pre><code>protected override void RequestStartup(TinyIoCContainer requestContainer, IPipelines pipelines, NancyContext context)
  {
     AllowAccessToConsumingSite(pipelines);
     StatelessAuthentication.Enable(pipelines, requestContainer.Resolve&lt;IStatelessAuthConfigurationFactory&gt;().Config());
  }
  
  //Returns ClaimsPrincipal or Null;
  public StatelessAuthenticationConfiguration Config()
  {
      if(_stat == null)
      {
          _stat = new StatelessAuthenticationConfiguration(VerifyToken);
      }
      return _stat;
  }
  </code></pre>
  
  <ol start="2">
  <li><p>Since my authorization header disappears every request, I would need to persist the JWT. I figure it's possible using OWIN environment or Nancy context, but would this be advisable + what would the effect be for a multi-user environment regarding security.</p></li>
  <li><p>OWIN has it's own authentication Manager that I could use, I've experimented with it, but it tends to provide a cookie upon successful sign in, which it doesn't seem to revoke on Logout. I just ran into a few issues overall with it, so I settled on NancyFx authentication. (not really a problem as a more general remark I suppose)</p></li>
  </ol>
  
  <p>Thanks in advance for any help!</p>