ASP.NET Core Web API Authentication and Authorization with JWT (Json Web Token)

In this tutorial we’ll setup a JWT (JSON Web Token) in an ASP.NET Core Web API, implementing Authentication and Authorization. We’ll talk about why it is important for your ASP.NET Core Web API to require authentication with JWT. From project setup to testing this entire process with Postman, by the end of this tutorial you will have a good idea of how to setup authentication and authorization in your .NET Core applications with JWT.
Authentication with JWT is one of the most secure and most performant ways to secure data transfers between client and server. We’ll not only set up authentication in our ASP.NET Core Web API but we’ll touch on authorization and how different user security roles can access specific resources.


0:00 – Intro
0:11 – Create a new ASP.NET Core Web Application
0:30 – Install Packages
7:30 – Add necessary models
9:32 – Add API Controllers
18:25 - Test Token Generation with Postman
20:54 - Add UserController
20:54 – Setup API to require Authentication
28:50 – Setup API to Authorize requests

If you enjoyed this tutorial, please like this video consider subscribing for more content like this!

Useful Links:
Packages:
- Microsoft.AspNetCore.Authentication.JwtBearer (3.1.20)
- Microsoft.IdentityModel.Tokens (6.14.0)
- System.IdentityModel.Tokens.Jwt (6.14.0)

Credits:

[justraccoon]

Omg Bro, you're incredible. I tried to add this functionality for a very long time and nothing ended with success. But your video solved my problem just in 30 minutes. And one more thing, your English is very understandable for non-native speakers. Thank you a lot!

[monaziralam]

Clear, crisp and quality teaching by saving the time too, great man!

[okeluelazarus]

Bro this tutorial just saved me today, thanks so much, your calmness and pace of everything in the way you teach is excellent please keep it up

[hello-matthew]

Thank you - this was perfect! I liked the fast pace and length of the tutorial. Your tutorial is uncluttered, clear, and to the point. Keep making more!

[bongoSLAP]

If you are using .NET 6, add this to your program.cs file

.AddJwtBearer(options =>
{
= new TokenValidationParameters
{
ValidateIssuer = true,
ValidateAudience = true,
ValidateLifetime = true,
ValidateIssuerSigningKey = true,
ValidIssuer = builder.Configuration["Jwt:Issuer"],
ValidAudience = builder.Configuration["Jwt:Audience"],
IssuerSigningKey = new SymmetricSecurityKey(

)
};
});

var app = builder.Build();

[rajkumararora]

Complex matters explained with simplicity. Thank you for sharing your great work!

[programmingcake]

This is the best tutorial on JWT Authentication and Authorization I've ever seen so far, Thank you so much for your efforts.

[zahiyoussef]

the best on youtube that explaine it, the exemples of success and failings, helps a lot, keep it up sir

[sinan-hoca]

I was looking for this for a long time. Watched tons of garbage. Finally I've found the exact video I was looking for. Every single thing I need is in the video. Thanks for sharing this useful tutorial.

[bloggrammer]

Great video, @Code with Julian. Well done.

In the Authenticate method in the LoginController class, there's no need to check for null. The Linq FirstOrDefault(...) will return null if the user with the conditions is not found, otherwise, it will return a user model.

Thank you for the video.

[mohammedbenlaiter]

you saved my graduate project
thank u

[JoeScottish]

I've now created my first Web API thanks to you

[JollyGiant]

This is very well done, thank you so much for making this!

[insanegaming]

Thank you for the simple and effective explanation. I was really stuck on how to decode jwt token to get user detials, and didnt got any perfect solution for this problem. But you did a great job at this.

[CAPS_AMERICA]

Your tutorial is amazing, very much what I was looking for to create a production-level API with authentication, you explained stuff clearly, very detailed and well-explained and code is easy to follow without complexity and unnecessary filler codes that can be used as a template in corporate APIs. I've had paid subscriptions on Pluralsight and LinkedIn Learning, but the way you teach and this example topples most of the ones I've seen in those paid online courses where all they've done is pad their tutorials with unnecessary junk of codes to make it longer but pretty difficult to implement! I've subscribed and will definitely watch all your videos, thanks and keep it up!

[owso_]

Hi Julian, nice one. Love this tutorial. But please you said at 15:06 that this isn't a proper authentication and we shouldn't do it in production, so what do you suggest or would say is a proper authentication. Would you mind doing a video on that? So we learn the proper way too. Or do you say so because you used Constants instead of an actual database? Thanks

[dotnetfullstack]

Best Video to learn about JWT TOken Authentication and Authorisation
1. Simple explanation
2. Clear command over topic
3. step by step by explanation
4. Working code link

[sebastiantenorio]

Great Tutorial, you should post one where you refresh the tokens.

[muhammadhydaque]

Just passed by that one and it was so straight-forward for me. Keep it up and thank you for such an awesome content

[anurag]

short, to the point, and a nice tutorial. Kudos to Jason and Elysse