JWT authentication in ASP.NET Core WebAPI ~ Dotnet Guru ~

Using JWT (JSON Web Tokens) in a Web API is a common approach for handling authentication and authorization. Here's a concise guide on how to implement JWT in a Web API, typically using a framework like ASP.NET Core, but the principles apply to other frameworks as well.

Step 1: Install Necessary Packages

For ASP.NET Core, you'll need to install the following NuGet packages:

Microsoft.AspNetCore.Authentication.JwtBearer
System.IdentityModel.Tokens.Jwt

Step 2: Configure JWT in Startup

In your Startup.cs file, configure JWT authentication in the ConfigureServices method:

public void ConfigureServices(IServiceCollection services)
{
    // Other service configurations...

    var key = Encoding.ASCII.GetBytes("your_secret_key_here"); // Use a strong secret key
    services.AddAuthentication(x =>
    {
        x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
        x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    })
    .AddJwtBearer(x =>
    {
        x.RequireHttpsMetadata = false; // Set to true in production
        x.SaveToken = true;
        x.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(key),
            ValidateIssuer = false,
            ValidateAudience = false
        };
    });

    services.AddControllers();
}

Step 3: Create a JWT Token

You'll need a method to generate the JWT. This typically occurs during login:

  public string GenerateJwtToken(string username)
  {
      var claims = new[]
      {
          new Claim(JwtRegisteredClaimNames.Sub, username),
          new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
      };
  
      var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("your_secret_key_here"));
      var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
  
      var token = new JwtSecurityToken(
          issuer: null, // Set if needed
          audience: null, // Set if needed
          claims: claims,
          expires: DateTime.Now.AddMinutes(30),
          signingCredentials: creds);
  
      return new JwtSecurityTokenHandler().WriteToken(token);
  }

Step 4: Secure Your API Endpoints

Use the [Authorize] attribute to protect your API endpoints:

  [Authorize]
  [ApiController]
  [Route("[controller]")]
  public class WeatherForecastController : ControllerBase
  {
      [HttpGet]
      public IActionResult Get()
      {
          return Ok(new { Message = "This is a protected endpoint!" });
      }
  }

Step 5: Handling User Login

Create a login endpoint to authenticate users and return a JWT:

  [HttpPost("login")]
  public IActionResult Login([FromBody] LoginModel login)
  {
      // Validate user credentials (this is just an example)
      if (login.Username == "test" && login.Password == "password") // Replace with actual validation
      {
          var token = GenerateJwtToken(login.Username);
          return Ok(new { Token = token });
      }
  
      return Unauthorized();
  }

Step 6: Testing

Use a tool like Postman to test your endpoints:

Call the login endpoint with valid credentials to receive a JWT.
Use the received token in the Authorization header (Bearer <token>) when accessing protected endpoints.

Where jwt tokens are stored on on server

JWT (JSON Web Tokens) are typically not stored on the server in the same way as session data. Instead, they are often used in a stateless manner, meaning the server does not maintain a session for each user. Here’s how it generally works:

Client-Side Storage: After authentication, the server sends the JWT to the client, which usually stores it in local storage or cookies.
Stateless Authentication: Each time the client makes a request, it sends the JWT along (typically in the Authorization header). The server validates the token without needing to store any session data.
Optional Revocation: If you need to implement token revocation or blacklisting, you might maintain a list of revoked tokens on the server, but this is an additional layer of complexity that somewhat counters the stateless principle.
Expiry: JWTs usually have an expiration time, after which they are considered invalid. This reduces the need for server-side storage since expired tokens can be discarded.

In summary, JWTs are mainly stored client-side, while the server verifies them as needed.

How server verifies jwt token on server

To verify a JWT (JSON Web Token) on the server, the following steps are typically followed:

Extract the Token: The server retrieves the JWT from the request, usually from the Authorization header as a Bearer token.
Decode the Token: The server decodes the JWT to access its header and payload. This step does not require validation and can be done using a base64 decoding method.
Verify the Signature: The most critical part of the verification process is to check the signature of the token:
- The server uses the algorithm specified in the JWT header (e.g., HS256, RS256) and the secret key (for symmetric algorithms) or the public key (for asymmetric algorithms) that was used to sign the token.
- It re-generates the signature using the header and payload and compares it with the signature part of the received token.
Check Claims: The server validates the claims in the payload:
- Expiration: Check the exp claim to see if the token is still valid.
- Audience: Verify the aud claim to ensure the token was intended for your server.
- Issuer: Check the iss claim to confirm it was issued by a trusted source.
- Not Before: Optionally, check the nbf claim to see if the token is being used before its valid time.
Process the Request: If the token is valid and all claims check out, the server processes the request. If not, it responds with an appropriate error (e.g., 401 Unauthorized).

By following these steps, the server ensures that the JWT is valid, has not been tampered with, and is still active.

Reference: https://medium.com/, https://www.c-sharpcorner.com/, https://javascript.plainenglish.io/

Dotnet Guru ~

Sunday, 22 January 2023