How to Use HttpOnly Cookie to Secure JSON Web Tokens (JWT) in ASP.NET Core Web API

In this video, I will show you how to secure our JWTs or JSON Web Tokens, when implementing the authentication and refresh token actions in our .NET Core applications. An HttpOnly Cookie is a tag added to a browser cookie that prevents client-side scripts from accessing data. It provides a gate that prevents the specialized cookie from being accessed by anything other than the server. Using the HttpOnly tag when generating a cookie helps mitigate the risk of client-side scripts accessing the protected cookie, thus making these cookies more secure.

LINKS MENTIONED IN THE VIDEO

FOLLOW US ON SOCIAL MEDIA!

[CodeMaze]

Thank you all for watching and for your support.

[ckxthlk]

That's exactly what I needed. Thanks a lot for this video!

[ugochukwuumerie]

Thank you as usual for this content.
..How do you access the content say the nameidentity claim of the jwt token on a client web app, and the refresh token if jwt expires say an angular app?
.. I'm guessing you can use the withCredentials set to true along with a request

Thank you

[crashtagiyevpirt]

Thank you for the info.When client logout then weneed to just remove tokens from the cookies?

[mindsetark]

Thanks for code maze
This can helpful for me to store access token and refresh token in cookies. I have one issue it is
Access token is active in 5min
Refresh token is active 7days

If access token has expired and refresh token is active. How to make automatic Refreshing access token

[jonny.rubber]

Thanks for the video, but I have a little remark. You say in the beginning of your video that if you encrypt your token it is of no use for an attacker. That is however not completely correct as I understand it. It is true that an attacker can't read what's inside the token (like userId, e-mail, role, ...), but an attacker can still use the token to impersonate a real user.

[vitusschaber]

Great video, just one question:
Why are we even using the refresh endpoint? Couldn't we just check if the token is valid, and if not refresh it automatically, set the Set-Cookie headers and access the protected route?

[ugochukwuumerie]

I noticed that once you refresh the page after login, the cookie disappears, it doesn't persist, how do i persist the cookies for future request, am i missing something? Thanks

[shabanelmogy]

when cookies expire delete from cookies and if try to get value get error
what can i do ?

[GustavoAlves-nghs]

Hello, thanks for the video! Since I am not saving anything to my localStorage. How can I check if my user is logged in after refreshing the page?
One solution was to go to the login page every time, make a request to see if the token is still valid? Is there any easier way?

[andresbeltran]

Amazing video as usual. Is this technique new for .net 8 or is it something that already existed? From what you can see, it is no longer necessary to attach the token to the requests? Is that what you do with the cookie? If I later wanted to connect to the api through blazor for example, would I only need to log in and start consuming endpoints directly?