.NET 5 Web API startup for sample implementation of access token and refresh token

Startup.cs

public class Startup
{
  public Startup(IConfiguration configuration)
  {
      Configuration = configuration;
  }

  public IConfiguration Configuration { get; }

  // This method gets called by the runtime. Use this method to add services to the container.
  public void ConfigureServices(IServiceCollection services)
  {
      services.AddCors();
      services.AddControllers();

      services.AddDbContext<ApplicationDbContext>(options =>
          options.UseSqlServer(Configuration.GetConnectionString("SqlConnection")));

      services.AddIdentity<ApplicationUser, IdentityRole>(options => options.SignIn.RequireConfirmedAccount = true)
          .AddEntityFrameworkStores<ApplicationDbContext>();

      // configure strongly typed settings objects
      var jwtSection = Configuration.GetSection("JwtBearerTokenSettings");
      services.Configure<JwtBearerTokenSettings>(jwtSection);
      var jwtBearerTokenSettings = jwtSection.Get<JwtBearerTokenSettings>();
      var key = Encoding.ASCII.GetBytes(jwtBearerTokenSettings.SecretKey);

      services.AddAuthentication(options =>
      {
          options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
          options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
      })
      .AddJwtBearer(options =>
      {
          options.RequireHttpsMetadata = false;
          options.SaveToken = true;
          options.TokenValidationParameters = new TokenValidationParameters()
          {
              ValidateIssuer = true,
              ValidIssuer = jwtBearerTokenSettings.Issuer,
              ValidateAudience = true,
              ValidAudience = jwtBearerTokenSettings.Audience,
              ValidateIssuerSigningKey = true,
              IssuerSigningKey = new SymmetricSecurityKey(key),
              ValidateLifetime = true,
              ClockSkew = TimeSpan.Zero // To immediately reject the access token
          };
      });
  }

  // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
  public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
  {
      app.UseCors(x => x
         .AllowAnyOrigin()
         .AllowAnyMethod()
         .AllowAnyHeader());

      if (env.IsDevelopment())
      {
          app.UseDeveloperExceptionPage();
      }

      app.UseHttpsRedirection();
      app.UseRouting();
      app.UseAuthentication();
      app.UseAuthorization();

      app.UseEndpoints(endpoints =>
      {
          endpoints.MapControllers();
      });
  }
}