Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

Microsoft.AspNetCore.Authentication.JwtBearer version 8.0.1

Invalid Issuer should response 500 instead of 401 as before. Invalid Issuer is server-side issue. Response 401 and add comments in header may confuse client-side user who request with valid token.

Expected Behavior

Invalid Issuer is service side issue so response 500 is expected. The server lost token validate function does not mean user credential is incorrect.

Steps To Reproduce

builder.Services.AddAuthentication("Bearer")
                .AddJwtBearer("Bearer", config =>
                {
                    config.Authority = "https://authority.host";
                    config.Audience = "audience-here";

                    config.SaveToken = true;
                });

set up Web API project and request with valid token. Disconnect all network connection to Authority.
I have test 3.1, 6, 7, 8 and only response code 401 received in dotnet 8.

Exceptions (if any)

No response

.NET Version

8.0.101

Anything else?

No response