Response.Redirect with Headers in .Net Core

Hi All,

Trying to bring this authorization workflow together.

Essentially I have a protected service that requires a JWT bearer token.
I have an authorization service that generates a JWT bearer token.

In My Startup for the protect service:

        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
         app.UseStatusCodePages(async context =>
            {
                var request = context.HttpContext.Request;
                var response = context.HttpContext.Response;
                var path = request.Path.Value ?? "";

                if ( 
                        (response.StatusCode == (int)HttpStatusCode.Unauthorized || response.StatusCode == (int)HttpStatusCode.Forbidden)
                    && !request.Headers.ContainsKey("Authorization")
                   )
                {
                    var redirect = context.HttpContext.AbsoluteURL();
                    response.Redirect(config["JWT:AuthorizationServiceRedirect"] + config["AppID"] + "?redirectTo=" + redirect);
                }
            });
}

Select allOpen in new window

Essentially what this does it redirects to the Authorization service if the response fails.  No issues no problems there.

My authorization service also generates the JWT token. Part of that controller's code is:

            string redirect = HttpContext.Request.Query["redirectTo"].ToString();

            if (!String.IsNullOrEmpty(redirect))
            {
                Response.Headers.Add("Authorization", "Bearer " + dto.user.token);
                Response.Redirect(redirect);
            }

Which brings it back to my protected service.  In theory this Response should now contain the bearer token, however the protected service not letting it thru.  Upon inspecting the headers I don't see anything there.  From my research the headers aren't passed along on the redirect, so what's best practice on getting this to work and are there any security issues with the above?