JWT Refresh Token in ASP.Net Core (a deep dive)

The volume of the video is a little low, I apologize in advance. Please increase the volume of the device you are listening in. I will fix the issue before the next video recording.

Today in the video I am going to go through what is JWT Refresh Token and how to create them in detail.

JWT Refresh token is used for getting a new JWT token after the first token is expired. Instead of sending the user id and password every time when we renew a JWT token, we can use the refresh token for that purpose.

[ksdvishnukumar]

It really helped me a lot to understand the JWT concepts and to implement the same... Hats off to you to make such a valuable video for better understanding...

[DevKumar-nhvk]

For Refresh API, "do we need to pass anything in Header". For me evetime refresh API giving 401. Not able to get what is Wrong. As in Body already passing RefreshCred(jwt token & refreshToken).

[rpiisenh]

Excellent tutorial boss. Please make a discussion on how to optimize dbcontext and configure connection pooling for entityframework core.

[eliassal]

Again, 2 fantastic, helpful and well explained videos (in spite of the fact that I got lost a little bit between the different objects :-) as this is very new to me ). Just to validate my understanding, so once we call the refresh api, to reauthenticate, 1 hour later, we should use the RefreshToken for reauthentificiation, am I correct or it is the original Jwtoken that will be extended by another hour?

[birendrasahu]

Awesome . Cleared my doubts. Thank you bro 🙏

[anshulasati]

Hi, why does this code not refresh the expired JWT token.?

[alihaydar]

Great job 👍 again)) but I think the expired of refresh token needs to be more than 1 hour this exactly the duty of refresh token but you copy paste the same time if jwt token

[manasmalik]

After the expiry of the access token, a new access token is not generated even with the Refresh Token. public AuthResponse Refresh(RefreshCredential refreshCredential)
{
SecurityToken validatedToken;
var tokenHandler = new JwtSecurityTokenHandler();
var principal = tokenHandler.ValidateToken(refreshCredential.AccessToken, new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey = new SymmetricSecurityKey(key),
ValidateIssuer = false,
ValidateAudience = false
}, out validatedToken);

[Stuntman]

im just kinda confused.
why does a jwt token expire that quickly when i could regenerate a new one with the refreshkey anyways?
if someone steals my cookies im fucked anyways

[koushikdas]

'Action (Auth.Demo)' has more than one parameter that was specified or inferred as bound from request body. Only one parameter per action may be bound from body. Inspect the following

[MarvLthe]

Why should I use refresh token instead of increasing the timeout of my original JWT token ?

[boredo]

Do you have Git repo for this? it was a nice video thanks!

[carecovered]

In a realistic world, Will user be sending us both JWTToken and Refresh token and on API we need to first check if JWTToken is valid(not expired too) if expired then to use RefreshToken to validate?

[anushreedesai]

Can you tell how can we generate JWT token using azure active directory (using client, tenant id etc) ?

[ashokkumarnaralasetti]

I think without refresh key also we can regenerate token right

[nirajdahal]

Hello sir!! How do we add external login providers like facebook, google, linkedin etc in .net core web api.. for example: How do i add extra login providera like google facebook in this project that you have taught us?

[ayan-qnor]

If you please post a tutorial video on integration testing using key token, when token is generated in different api would be very helpful. Thanks.

[arslansaleem]

please shear the link of other videos you have mention at the start of this video

[AzZaph]

after receiving the refresh token after jwt expires. Which one should be use in the Authorization?

[shuhaib]

Very nice video. Thanks 🙏
Can you please try to do a video about Open ID connect using identity server 4?