services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
})
.AddCookie(options =>
{
    options.ExpireTimeSpan = TimeSpan.FromMinutes(1);
    options.Cookie.Name = "user-session";
    options.SlidingExpiration = true;
});

app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
  ......
});

[Authorize]
public class HomeController : Controller
{
    public IActionResult Index()
    {
        return View();
    }
}

public class AccountController : Controller
{
    [AllowAnonymous]
    public IActionResult Login()
    {
      return View();
    }
    ......
}

/// <summary>
/// 模擬登錄
/// </summary>
/// <returns></returns>
[HttpPost]
[AllowAnonymous]
public async Task<IActionResult> TestLogin()
{
    var claims = new Claim[]
    {
      new Claim(ClaimTypes.Name, "Jeffcky"),
    };
    var claimsIdentity = new ClaimsIdentity(claims, "Login");
    await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(claimsIdentity));
    return Ok();
}

options.Cookie.MaxAge = TimeSpan.FromMinutes(2);

options.Cookie.Expiration = TimeSpan.FromMinutes(3);

.AddJwtBearer(options =>
{
    options.TokenValidationParameters = new TokenValidationParameters
    {
      ValidateIssuerSigningKey = true,
      IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("1234567890123456")),
      ValidateIssuer = true,
      ValidIssuer = "http://localhost:5000",
      ValidateAudience = true,
      ValidAudience = "http://localhost:5001",
      ValidateLifetime = true,
      ClockSkew = TimeSpan.FromMinutes(5)
    };
});

private string GenerateToken(Claim[] claims)
{
    var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("1234567890123456"));
    var token = new JwtSecurityToken(
      issuer: "http://localhost:5000",
      audience: "http://localhost:5001",
      claims: claims,
      notBefore: DateTime.Now,
      expires: DateTime.Now.AddMinutes(5),
      signingCredentials: new SigningCredentials(key, SecurityAlgorithms.HmacSha256)
    );
    return new JwtSecurityTokenHandler().WriteToken(token);
}

/// <summary>
/// 模擬登錄
/// </summary>
/// <returns></returns>
[HttpPost]
[AllowAnonymous]
public async Task<IActionResult> TestLogin()
{
    var claims = new Claim[]
    {
      new Claim(ClaimTypes.Name, "Jeffcky"),
    };
    var claimsIdentity = new ClaimsIdentity(claims, "Login");
    Response.Cookies.Append("x-access-token", GenerateToken(claims),
      new CookieOptions()
      {
        Path = "/",
        HttpOnly = true
      });
    await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(claimsIdentity));
 return Ok();
}

options.Events = new JwtBearerEvents
{
    OnMessageReceived = context =>
    {
        var accessToken = context.Request.Cookies["x-access-token"];
        if (!string.IsNullOrEmpty(accessToken))
        {
            context.Token = accessToken;
        }
        return Task.CompletedTask;
    }
};

[Authorize("Bearer")]
[Route("api/[controller]/[action]")]
[ApiController]
public class JwtController : ControllerBase
{
    [HttpGet]
    public IActionResult Test()
    {
      return Ok("test jwt");
    }
}

[Authorize(AuthenticationSchemes = "Bearer,Cookies")]

public class CookieAuthenticationEventsExetensions : CookieAuthenticationEvents
{
    private const string TicketIssuedTicks = nameof(TicketIssuedTicks);
    public override async Task SigningIn(CookieSigningInContext context)
    {
        context.Properties.SetString(
          TicketIssuedTicks,
          DateTimeOffset.UtcNow.Ticks.ToString());
        await base.SigningIn(context);
    }
    public override async Task ValidatePrincipal(
      CookieValidatePrincipalContext context)
    {
        var ticketIssuedTicksValue = context
          .Properties.GetString(TicketIssuedTicks);
        if (ticketIssuedTicksValue is null ||
          !long.TryParse(ticketIssuedTicksValue, out var ticketIssuedTicks))
        {
          await RejectPrincipalAsync(context);
          return;
        }
        var ticketIssuedUtc =
          new DateTimeOffset(ticketIssuedTicks, TimeSpan.FromHours(0));
        if (DateTimeOffset.UtcNow - ticketIssuedUtc > TimeSpan.FromDays(3))
        {
          await RejectPrincipalAsync(context);
          return;
        }
        await base.ValidatePrincipal(context);
    }
    private static async Task RejectPrincipalAsync(
      CookieValidatePrincipalContext context)
    {
        context.RejectPrincipal();
        await context.HttpContext.SignOutAsync();
    }
}

options.EventsType = typeof(CookieAuthenticationEventsExetensions);