Asp Net Core - Rest API Authorization with JWT (Roles Vs Claims Vs Policy) - Step by Step

[@marceloleoncaceres6826]

I know this video is 2 years old, but it is OUTSTANDING, Thank you very much for this tutorial.

[@MohamadLawand]

Glad it was helpful!

[@JulianRiverplate14]

I was trying to implement the same functionality by own so I found your video to find and get a different approach, and i got very surprised about how clean and scalable your implementation was. Thanks for this useful resource Mohamad! I hope you can make new series about Dotnet!

[@robydj5289]

Great, right now I am struggling to learn this topic, your tutorial comes at the right time! Thank you!

[@laleshyagysaini4304]

Thank you so much Mohamad Lawand i am so much happy to learn from you

[@Varinator]

Just found you on youtube as I'm building a boilerplate API for Xamarin/MAUI and refreshing my knowledge - great resources man.

[@feelingeverfine]

You’re the man Mohamad. Thanks for making these videos

[@mbkfu1]

Great tutorial! Finally, I was able to understand this topic. Thank you, Mohammed! ❤

[@anazz2960]

Mohamed you are such a hero, I'm a top fan of you and your work, keep it up man ❤

[@talkathiriify]

Thank you so much Mohamad for your time and effort, it is really appreciated Wish you all the best.

[@imranyaseen7880]

Ma'Shaa'Allah. Keep up the good work.❤

[@olufemioyedepo2791]

Nice video Mohamad! Great work!

[@sibazazo9208]

Great video. Thank you for the detailed explanation.

[@vaddiprudhvi9292]

Thank you so much.. your videos are clear and understandable... this is the right place I have to learn more things...

[@faicalammisaid3705]

thanks my brother very well done so organized and pro written program thank u soo much this work inspired me ! god bless u

[@ivanzinov6875]

Good explination!!!. You have a typo in your slides Authorisation => Authorization

[@techramedia]

awsome tutorial man...had lots of problem implementing jwt but after watching this..i was able without struggling..Thanks a lot for this tutorial

[@dkako1129]

Very good tutorial, you explained it clearly! I would appreciate a deeper dive into policies if its possible. Thanks in advance!

[@bmassioui]

Good explanation, thanks a lot 💪

[@marimello9889]

Very nice. Thank you very much for the videos :)

[@fa35ife]

Great Mohammed, thank u

[@expertreviews1112]

You don’t talk about authentication schemes and challenges… This is really critical aspect many people get confused with

[@yosofjoo]

Jazak Allah Khairan

[@anthonytan2282]

keep it up ur the best😁

[@adebanjooluwasola4709]

Great video Brother

[@bankhoagiauten]

thank you so much!

[@abdulmuminrashed3853]

Great job bro, keep it up. I was wondering if you could share the source code with us.

[@talkathiriify]

Yes, could you please make more policy like the one in the slides at the beginning of this EP. For example there is a product and assign permissions like view edit create delete the normal CRUD and assign these permissions to the role, That will be highly appreciated. Thank you very much.

[@bruno8ribeiro]

Awesome video.

[@Moath268]

جزاك الله خير شرح جميل

[@mihailomarcetic2516]

Great video !!!

[@zhamed9587]

Thank you so much, great content! One question: can one use the same approach (e.g. `[Authorize]` attribute) on GRPC endpoints instead of REST endpoints?

[@sergioontiveros4209]

Hi there, thanks for the video, it was an amazing explanation, but it seems the project is no longer in your repo. Where can I find it?

[@nothingisreal6345]

Right: grants access to a feature e.g. edit invoice; Role: defined group of rights, a user can be assigne to 0..N roles. Rights resolve from role membership, e.g. roles are Administrator, Normal User, Backup Operator, note: very similar to user groups, roles are typically manually assigned by an Administrator / claims: defined properties like First Name, Department, Country, rights are derived by user depending on values of claim, e.g. user with cost center = 4711 are allowed to accept bills for that cost center. if the users claim changes the access right change automatically. If you do a step by step vidoe you can't leave out the stepp of adding authorization. there are also several errors in logging.

[@itwind9912]

Sir please make video on claims in detail and also add functionality of add rang claims

[@ОтгрузкаЕвросвит]

Brilliant!

[@muhammadtaimur448]

Salam Muhammad, Thanks much for the videos about Authentication using JWTs and Refresh Token mechanism. Videos are very explatory, it helps a lot. I am trying to see your repo for this project in github but I cannot see it, did you delete it? or make it private?, Is there any way I can fork it?

[@AlThePal78]

The claims sounds like models I am confused with that but I am at 11:49 I will keep watching this video lol

[@ucthinh4455]

thanks very much

[@amjed_mohammed]

Thank you so much

[@guedriabdelkalek3946]

thanks that was helpful

[@Nolli360Flip]

There is one thing that does not work for me. You set 30 seconds for the jwt token. If I use the GET request, the token does not expires after 30 seconds, I tried to wait f.e. 2 minutes and I could still use the same jwt token for the GET request. Only after 5 minutes the request got denied. Did I understood something wrong or why is the jwt token havior different?

[@Varinator]

One thing - in GenerateJwtToken you already have logic for RefreshTokens which come in Episode 4 of your tutorial? This may confuse some ppl as in Episode 2 it returns string, and here it's Task and the method is async. Because the method is not async in Episode 2, my IDE returned error when I wanted to await GetAllValidClaims, as the parent method is not yet async as per episode 2.

[@adim1212]

Can you please check the starting of the starting project. Currently it's not available.

[@hamidshah7072]

thanks to your great course ,how should we store jwt token in secure way ? i undrestand that local storage and cookies are unsafe to store tokens? so what is the best way?

[@rickyvu2388]

Aspnet store user in cookie too. I have a same question as you do.

[@hamidshah7072]

@@rickyvu2388I understand that we can use HTTP-only cookies and Samesite cookies to prevent access and XSS attack to the token

[@MortyMortyMorty]

Please can you provide us the source code?

[@zergzerg4844]

I didn't get how to set the policy. I did all as author showed on a video and authorization scheme by role works for me , but when I add policy authorization , then I added claims for user and an attempt to call a method witch protected by policy it returns 403 error forbidden. Also I checked my JWT token and it had necessary roles and policy. Has anyone had the same problem and how to solve it?

[@rickyvu2388]

If someone got my token and edit expireday then the back end will validate and know it is invalid token right? Another case is what if someone copy my token and use it?

[@sahild6584]

@ Mohamad Lawand :Awesome. Can we have more indepth on policies, also can the identity manager be provisioned using SCIM?

[@olufemioyedepo2791]

Hi Mohammad I can't seem to find the link to the tutorial for the starting project. I would like to see how you implemented the user management + db migrations etc. Thanks

[@MohamadLawand]

Starting Project: github.com/mohamadlawand087/v8-refreshtokenswithJWT

[@jayakumar2927]

@@MohamadLawand Page not found

[@Smcgettrick]

You mentioned a link to an initial starting project that would be in the video and comments, but I cannot find it in either.

[@MohamadLawand]

Starting Project: github.com/mohamadlawand087/v8-refreshtokenswithJWT

[@BiaoTV]

The github no longer contains the code examples?

[@andriesmathenjwa9536]

hi i can't find the v8 repository in your git hub

[@mmlnv2036]

What happens if the user edits the jwt token and adds a claim he needs for malicious activity ?

[@MohamadLawand]

The JWT signature will be invalidated and the API will not recognise it

[@mmlnv2036]

@@MohamadLawand Thanks Mohamad

[@mohammadakbari1944]

very good

[@muhammadsaad1520]

i don't find the github repo you mentioned

[@RishavKarna]

the git repo is not available!?

[@Gilgameshx]

Hi moha, nice work and great explained as usual, yet i have a question: How we could make a dynamic policy? i meant if the app super admin needs to create dynamic policies Thanks man

[@muntheralkhwaldeh728]

Thank You for your effort , in my mvc app alwayes give me Unauthorized 401 after Applying the roles and claims can anyone help me

[@nooral_huda7342]

Where have you been all this time 😞

[@JBRandria]

Hello, Github link is not found :(

[@tiktokfans9019]

I do not find this repository in your GitHub account

[@adnanyangilic6380]

Dear Mohamad, could you upload github the same this project also with sql server when you have time? Thank you..

[@imaneliyev6447]

Souce Code is not aviable in github(

[@Razboinikov80]

The code is no longer available in your Git

[@FabioGalanteMans]

Impossible see the video in cell phone

[@piotrus5457]

The final version of the code lacks the disabling of checking whether the token has expired when it is refreshed. If anyone has a problem with this, just change the line "var tokenInVerification = jwtTokenHandler.ValidateToken(tokenRequest.Token, _tokenValidationParams, out var validatedToken)" | | V at | | V "_tokenValidationParams.ValidateLifetime = false; var tokenInVerification = jwtTokenHandler.ValidateToken(tokenRequest.Token, _tokenValidationParams, out var validatedToken). _tokenValidationParams.ValidateLifetime = true; "

[@Tareknageh1999]

جزاك الله خيرا