Implementing JWT Authentication in ASP.NET Core

Hello, everybody. I'm Nick, and in this video, I will show you how you can add production-ready authentication and authorization in .NET and ASP.NET Core with JWT tokens using a real identity service.

Don't forget to comment, like and subscribe :)

Social Media:

#csharp #dotnet

[AJIexa]

Great video! I would suggest to people who are new to JWT first learn fundamentals about OpenID Connect and authorization methods like "Authorization Code Flow" or " Resource Owner Password Grant Flow". Once you understand the flow you will get that Cognito, IdentityServer4 or any other providers are just wrappers around this protocol

[mynameisshadywhat]

The first time in a long time I needed a refresher on this and this is the first recommended video, posted only 17 minutes ago. What sorcery is this, Nick?

[PhantomPhobos]

Wish to see more on this topic, I started off by rolling own ID server using OpenIddict, was quite a rough start first time learning in the whole OpenID process 😅. Video on rolling your own ID server would be nice, even better if it's using OpenIddict. Still waiting for more videos on event sourcing too, only see one in your channel, perhaps those are locked behind patreon?

[EduardLlull]

I think you should comment that once you start using AWS Incognito service, you don't need the "token generator API" anymore. In my experience, most developers brains shortcircuit when they try to understand oidc and some may think they still need the API even after they start using Incognito because they don't understand how it works.

[frossen]

2:30 "It's a piece of string!"😄love it

[conniedecinko]

We're using Keycloak for both Java and .NET apps

[andersborum]

It's good starting video on using an external Idp, but don't forget that what's shown here is the bare minimum. Also, notice that Nick is using a stand-alone UI (i.e. Postman or similar) to exchange the returned auth code for a set of tokens that's stored locally (Redis is a great option for these types of short lived data); you'll need to build the exchange mechanism yourself, which is a fun little task.

A word of caution: security is not something you should take lightly, especially in an public facing environment and you should never attemt to implement encryption algorithms, unless you're one of the very few experts in the industry, that works professionally on this topic.

[Octopie]

The modern way to create JWTs is using the new `JsonWebTokenHandler` class, not the older & slower `JwtSecurityTokenHandler` class.

[tomtoups]

Changing the first letter "e" is not a good test for if the JWT is working, because the "e" is the base64 character for the open brace "{" for the JSON. That's why all JWTs start with an "e". It could be failing because it's not a valid JSON fragment

[DasBloch]

It would be awesome if you could show how to support multiple authentication methods. Like an API key together with jwt tokens. How do we correctly authorize endpoints and setup the auth ?

[vintage]

Thanks, couple questions tho:
How should I sync the users to my db with external id providers?
Should I store roles, permission in my db or in the external provider?
and also shouldnt client secret be secret? I shouldnt use it in a spa, right?

[paulguk]

I much prefer jwt.ms over Auth0's decoder. Much simpler page and also decodes the iat and exp values etc.

[Paps]

Funny thing is that I made exact same implementation with keycloak yesterday for the first time

[festussila]

@nickchapsas Great refresher. I find it difficult to establish a resources that outlines at length the ins and outs of security(providers, users, flows, scopes, policies, federation). As part of the courses offered on Dometrain do you have a plan to do a comprehensive course on the subject.

[local]

This couldn't of come at a better time.

[justinassakalavicius]

Great video! I would like to hear more about the other option you mentioned in your video. Server-side applications with confidential clients

[MarvinKleinMusic]

It would be pretty intersting how you can secure a Blazor app with JWT.

[vasilyh]

What about roles check during API call?

[christianschieder]

I'd like to see something simular also showcasing the approach via azure (if possible not sure). And maybe also with something more restrictive configuration(if possible of course), like enabling google or facebook login, where you can customize which google emails can register but, restricted to a specific domain. Or for the facebook side enabling registration for specific users(ofcourse if possible).
Otherwise again a nice lecture, i enjoy your videos, keep it up👍

[hristoivanov]

Nice video! Could you show us S2S auth process?