.NET 6 WebAPI JWT Authentication With MongoDB and Microsoft Identity

Hello Guys,
In this tutorial, we created a .NET 6 WebAPI secured with Microsoft Identity and JWT Bearer token authentication using MongoDB as database.

Apologies for the poor audio quality. I'll do better in coming videos.

Like, share, comment and subscribe to the channel for more videos like this.

[Holiday]

In the LoginAsync method you forgot to include a password validity check so anyone can login as anyone as long as they know the email.

var passwordValid = await _userManager.CheckPasswordAsync(user, request.Password);
if (!passwordValid)
{
return new LoginResponse { Message = "Invalid email or password", Success = false };
}

Great tutorial other than that :)

[callmeverity]

Hey there, I've noticed that during the login process, it appears that the system doesn't verify if the password matches. I might not be an expert in Identity, but I'm quite sure that the system doesn't actually confirm the accuracy of users' passwords before granting access tokens and other user details.

[codeme]

Great video. A lot of good techniques also.

[fryser]

You sir are a gentlement and a scholar. Thgank you so much! It's missing the password validation but I guess I can figure it out with some Googleling

[mustafakkurudag]

thank you so much for this great tutorial

[goktugfevziozcelik]

Thank You so much you are my hero !!!! :)) <3

[AmitSaini-mnls]

thanx a lot for the video buddy, this is the only video for .net 6 core identity with jwt....great work, but in payload you can see user email and password, there it is not encrypted,

[fryser]

May I suggest an add-on video to implement Refresh tokens :D

[PhantasyAI]

please make updated for .net 8 using Authentication With MongoDB

[pyrenos]

Yes, the tutorial would be okay if it actually served its purpose. The password is not checked at any point. You only log in with the email. Also, the role section is not very meaningful if you don't show what it's good for.



var passwordMatch = await _userManager.CheckPasswordAsync(user, request.Password);
if (!passwordMatch)
{
return new LoginResponse
{
Success = false,
Message = "Wrong password"
};
}