ASP.NET Core JWT Authentication Tutorial (.NET 7 Minimal Apis C#)

[@gopichandarselvaraj5250]

After creating 10+ applciations in asp net core with JWT, now I understand how the jwt actually works 🙃

[@RawCoding]

Nice!

[@cocoscacao6102]

As always, great vid. I'd love to hear about C# streams (in depth). Have you ever planned to cover that topic?

[@RawCoding]

Not yet, I’ll keep it in mind.

[@narminalieva4694]

You are so great. Also you are reading my mind, whenever i need some topic next day it’s on your channel 💥

[@ricardothomas3779]

Great video Anton!

[@AliMustafa-xp8ih]

Great video. Thank you.

[@smokeraven]

It would be handy to have a slide or a quick minute that explains the dotnet new commands (or whatever) to setup the base projects shown. Love the vids and very helpful.

[@RawCoding]

thank you, if you're trying to learn jwt's I expect you are fully capable of figuring out how the dotnet command line tool works

[@smokeraven]

@@RawCoding in my case it's exactly that I haven't been using the code IDE but it turns out to be pretty simple 🤓

[@josepvg]

Amazing video, thanks :)

[@RawCoding]

Thank you for watching

[@omidkianifar5144]

Why using jwk instead of public key for validating jwt?

[@icemanja]

Great content Anton, Could this private/public key setup be used in a microservice architecture where the identity app generates the token with the private key and other services use the public key the authenticate the jwt token?

[@anurag3487]

use API gateway to handle all auth related stuffs in a microservices scenario

[@kleberperez2580]

Anton, Thanks for the video, How did you get the jwtString value?

[@RawCoding]

at what time?

[@sadafziya5636]

thanks for your video. if i want to implement microservice and have authentication too, can I use this method ? Assume I have two project one is Security other one is Parts ... before user can to use parts webservice , have to be authenticate.

[@sorinvasiliu]

baller! ty for this

[@RawCoding]

thank you for watching

[@piotrc966]

Very good content.

[@RawCoding]

Thank you

[@dannyjiang98]

很好的视频

[@RawCoding]

🙏

[@mohamedesmaeil2236]

excuse me , can I use JWT without identity because it doesn't cover my needs in authorization

[@RawCoding]

Of course

[@mohamedesmaeil2236]

@Raw Coding I will be appreciate if you send link about implement that

[@RawCoding]

Watch the identity management video in the playlist.

[@mohsenrafiei3432]

Do you have any program to teach Duende Identity Server in next videos?

[@RawCoding]

We will be covering openiddict

[@joshem32]

Which one do you recommend jwt or cookie authentication with spa?

[@RawCoding]

Cookie 🍪

[@MinhNguyen-zx8me]

@Raw Coding: may I know the reason why ? I heard so many people saying that cookie is not mobile friendly, and they suggest to use jwt token instead.

[@RawCoding]

@@MinhNguyen-zx8me cookies are automatically handled by browsers, not httpclients - your mobile app will programmed with an httpclient. For mobile it doesn't matter you'll have to do manual work for both cookies and tokens. For browsers cookies are handled securely automatically. So Cookies.

[@kaznnknzn875]

Great as always! But what about two factor authentification ? Maybe innthe future we will see vide about it?:) As example how setup Identity server with 2fa

[@RawCoding]

Maybe 2fa, but it has nothing to do with identity server, so you won’t see the 2 together

[@MrJonnis13]

Thank you for your great and in-depth video. A question on how the External validation of the Token using the public key 29:04: We sending to External the Token which consists of Plain Data (Header + Payload) plus the signature (encrypted Plain Data) generated on Auth Server side. On External side then, we load the Token, and *signature + Public key = hash1* . Then we get the *Plain Data + WHAT = hash2* . If *hash1 == hash2* , validation passes and we are Authenticated. So my question is: what is this *WHAT* on the above formula ? Is this the public key *OR* some hashing algorithm that was used also in Auth Server side before it encrypted it ?

[@RawCoding]

I didn't explain this point very well. Server digest/hash = sha256(data). signature = encrypt(hash, privateKey) token = data + signature External digest1/hash1 = sha256(data) digest2/hash2 = decrypt(signature, publicKey) valid = hash1 == hash2 Encryption - private decrypts, public encrypts Signing - private encrypts, public decrypts How this interchanges I have no clue.

[@MrJonnis13]

@@RawCoding Thank you for the reply and the clarification. So this "What" is actually the *sha256* algorithm.

[@mahmudx]

Please create videos on (Identity, JWT) with multi-tenancy.

[@RawCoding]

We'll see )

[@abdulnaveed4984]

how to use jwt with external authentication e.g: aws forgate

[@RawCoding]

Watch the OAuth videos

[@weamhaleemi4984]

Gg first half was understandable then you dived into the complex code and started doing random stuff and Im lost

[@abuzeromohammed3386]

I need funny request