ASP.NET Core Authentication with JWT (JSON Web Token)

[@this-is-bioman]

That's how a tutorial should look like! Straight to point with a working example. Love it! 😎🤩

[@DotNetCoreCentral]

Thanks!

[@drakZes]

Easy and great setup of how to add authorization to a web application. Well done!

[@DotNetCoreCentral]

@Francois Smit, thanks for watching!

[@naveen.bhardwaj]

Awsm Explanation, Easy to understand

[@darizardTheDargon]

Add my voice to the chorus. Insanely helpful and well-done video, thank you.

[@DotNetCoreCentral]

Thanks!

[@ch1995]

May I know the use of having the AuthenticationManager interface instead of just having a solid Class? thanks

[@amjster]

Excellent video, I have shared with my whole team to watch. Thank you. One question, at 15:56 you add the JwtTokenAuthenticationManager to services with the key, but what if you wanted to pass in the DbContext and also maybe the ILogger so the JwtTokenAuthenticationManager can confirm the credentials against the Db. How do you configure the services for the JwtTokenAuthenticationManager in startup to inject those into the class?

[@avtarsashia4897]

Awsome way of teaching. And working with real scenario.

[@DotNetCoreCentral]

@Avtar Sashia, thanks for watching!

[@hhcruz1999]

I am able to generate the token. I am also getting the data without authorisation. But when I give the Authorize for the get method I get unauthorised. Could you please help me solve this issue.

[@junaidm1038]

This is the most simple way of doing JWT , thanks so much

[@DotNetCoreCentral]

@junaid m, thanks for watching!

[@R2d2ums]

Dude!! Thx for the video! It really helped me out. Right know I'm just reading your blog to understand better the whole code.

[@DotNetCoreCentral]

@Carlos Daza, thanks!

[@vigneashselvaraj3592]

In this JWT is authorized when sent as header in the request. May I know how can the access token be validate as part of query string ?

[@DotNetCoreCentral]

its a good practice to send token as part of header, but nothing stops you from sending token in query string, there are use cases like websocket where you might need to pass it in query string

[@usmansiddiqui1854]

Guys I am confused here that the implementation of JWT here is working on O Auth 2.0 mechanism or not?

[@vigneashselvaraj3592]

Excellent content.. very straight forward

[@DotNetCoreCentral]

Thanks!

[@Ram-yk7yl]

This worked like a charm. Exactly what I was looking for..., Confused with various online material, but this was most clear of all of them...

[@DotNetCoreCentral]

@Ra m, thanks for watching the video, and glad this video helped you!

[@BhautikDalicha]

How we can achieve same thing in MVC and pass token after authentication?

[@davidemmanuel3001]

God bless you my friend for this video

[@DotNetCoreCentral]

@DAVID EMMANUEL, thanks for watching!

[@nirbhaysinghverynice5880]

really nice explanation to the point and explained every point thanks alot

[@RahulKumar-tf3cx]

Thank you Nirjhar. Great explanation.I have implemented with your example

[@DotNetCoreCentral]

@Rahul Sharma, thanks for watching!

[@shubhamshaw2360]

Hi, why did you uncheck the "Configure for HTTPS" and check "Docker enabled" option while creating the project? It'll be really helpful info if you tell us.

[@DotNetCoreCentral]

@Shubham Shaw, there is no particular reason. You can keep both enabled.

[@johnnybravo8932]

If you configure https you will need SSL certificate. While running in localhost you can do with http.

[@tertulianeo]

My Authorization header is missing IDK why but I don't have problems with other headers, is there a way to change the header name?

[@DotNetCoreCentral]

@tertulianeo, how are you passing the header? can you share the code?

[@tertulianeo]

@@DotNetCoreCentral ty, it was a problem with my cloud front

[@DotNetCoreCentral]

@@tertulianeo great to hear your issue is resolved!

[@DevKumar-nh6vk]

Love the video. I urge you to create video on OAuth with JWT implementation. Complete details on OAuth.

[@DotNetCoreCentral]

Thanks, will do!

[@varmasanjaym]

Hi, I see that the AuthenticationHandler class comes under two namespaces. - Microsoft.AspNetCore.Authentication - Microsoft.Owin.Security.Infrastructure could you please explain what factors decide the namespace I need to use.

[@DotNetCoreCentral]

@sanjay varma, Microsoft.Owin.Security.Infrastructure is the legacy namespace. If you are using ASP.Net Core 3.1 you should be using Microsoft.AspNetCore.Authentication .

[@nileshmore1820]

Very good explanation. thank you .

[@ravindranaths513]

Hi, at timeline of 11:26 in this video, you added 1 hour as expiration. I tried with 1 min. But, after 2 min also, I could able to use same token and get the data. Means: token is not expired. Could you please help me on this.

[@DotNetCoreCentral]

@Ravindranath S, I will try it out and let you know.

[@umairghouri1718]

@@DotNetCoreCentral we have to use UseExpirationValidation in AddJwtBearer configuation

[@DotNetCoreCentral]

@@umairghouri1718 thanks for the suggestion!

[@ProperComment]

Why wasn't I able to find this channel earlier 😭 🤣🤣 I've shared your content with all my colleagues 🙏

[@DotNetCoreCentral]

@The Red Baron, thanks for watching. I hope everyone you have shared with will find it useful.

[@chandusubhakarareddysatti3569]

Hi Thaks for the video, I have a couple of questions . can you please clarify this? 1. I got a token from the server. I just passed it to someone to use this token. he could able to access the API with the token until it expires. How can we restrict this? 2. I got a token from the server with an expiry time of 15 min. before 15 min I hit token controller and got another token with an expiry time of 15 min. Now I have two tokens with valid time. will the two tokens work? or only the latest one? if so how can we validate?

[@DotNetCoreCentral]

@Chandu Subhakara Reddy Satti 1. If you pass the token to someone else purposefully, there is nothing that can be done here right. Until the token expires that person will have access to your API unless you keep all tokens in storage and check against that, in which case you can flag the token. 2. It depends if you are keeping the tokens in storage, in that case, you can have an implementation of invalidating older tokens when you send out new tokens. Otherwise, both will be valid.

[@deepjyotyroy6676]

Thanks for the Awesome Video. But I have a question. If I need to create a Custom Unathorized return message from any POST or GET api, what should I do ?

[@DotNetCoreCentral]

@Deepjyoty Roy, thanks for watching! In your scenario, you can remove the Authorize attribute and inside of each method check for User.Identity.IsAuthenticated, and based on that throw Unauthorised with you custom messages per method.

[@CAPS_AMERICA]

your tutorial is amazing, the IT community needs more people like you! however, MICROSOFT SUCKS for implementing a million different classes and ways to implement authentication /authorization classes then those classes get deprecated and then the developer will be scrambling for answers to solutions that new core version/framework is trying to introduce! For MS, there is no one universal, non-complex, non-confusing way to create a simple web API with basic authentication, it's like each authentication scheme is created by one developer that is trying to out-do the other developer within their team that has implemented a recent class/code! I hope, I really, really hope, that MS should one day be overtaken by another company or that incoming new developers will instead switch to open source and other tech stacks for web api-related stuff! I will be the first to rejoice if MS will file for bankrupcy one day, or get bought by Apple!

[@pankitpatel1987]

good help full, if you want to add more things then add authorization with multiple roles, multi-tenant application authentication.

[@DotNetCoreCentral]

Thanks for the suggestion!

[@xinyuhou6535]

Hi thank you for posting this video. I find it very helpful. I have one question regarding the authentication step though. After receiving the token with a valid username + password combination and entering it as Authorization : Bearer[whitespace]token, the Get step still throws a 401 error. Any idea of what may cause this? Thanks!

[@denespapp1963]

you can raise the logging level in the config and you can see the exact issue resulting in 401

[@girijesh-mca]

Very nice explanation !!! Just one query I have in simple asp.net api we used Owin and OAuth to generate and validate token but I dint see OAuth implementation in Core is there any reason ?

[@DotNetCoreCentral]

OAuth can be implemented by a middleware. I do not see any reason why it cannot be. I will give it a try. I did not have the need yet, hence I did not try it yet. I will post my video after I try it out. Thanks for the question.

[@girijesh-mca]

@@DotNetCoreCentral Thank you so much.

[@funnytoddler375]

Nice explanation 👌

[@DotNetCoreCentral]

@Funny Toddler, thanks!

[@Imran-mr6fv]

Excellent... keep up the good work

[@DotNetCoreCentral]

@Abc Xyz, thanks for watching!

[@vivekgowda1576]

Hi , Have you used ever redis cache in identity server 4 to improve the preformation

[@DotNetCoreCentral]

@vivek Gowda, no, I have never used it. But it's a good idea I would guess. I might give it a try.

[@vivekgowda1576]

@@DotNetCoreCentral thank you 😀

[@kiranbs5057]

Nice video , But I feel it would have been been great for beginners like me , if you had spent some time explaining the usage of each line while configuring authentication in startup and controller class files .

[@DotNetCoreCentral]

@Kiran BS, thanks for watching, and thanks for your valuable feedback, I will surely keep this in mind.

[@ajithjacob2054]

Please help me ,i am getting error from postman when i tried to access get after applying [authorize] error : similar to 403 forbidden, but specifically for use when authentication is possible but has falied or not yet provided.The response must inculde a www -authenticate header field conataining a challenge applicable to the requested resource

[@DotNetCoreCentral]

@Ajith Jacob, I am not sure I completely understand the question, I will definitely look into it tomorrow, and if I have any doubt about your issue I will get back to you. Thanks!

[@ajithjacob2054]

@@DotNetCoreCentral thanks for your reply. Let me explain the error.i have implemented the jwt token functionality and set attribute as allowanomus . So from postman i am able to generate the token . Then I decorated the get action method with authorize attribute and tried to access it from postman using the jwt token generated, that time I am getting the above error from postman

[@DotNetCoreCentral]

@@ajithjacob2054 I tried to reproduce your issue, but since I am not able to see your code its hard to reproduce. This is the location of the demo code, where I am not able to reproduce the issue. Maybe if you compare your code with mine, you will be able to get some clue what is going on. github.com/choudhurynirjhar/auth-demo

[@evaapperson1760]

Very quality content. It very helped me to understand this important theme !:)

[@DotNetCoreCentral]

@Eva Apperson, thanks for watching!

[@vinayakkatti4028]

Very useful information. Thank you sir...

[@DotNetCoreCentral]

@Vinayak Katti, thanks for watching!

[@ponvels]

username and password passed as json to get Token via authenticate may capture in fiddler and other tools. How the security of data is ensured if web api need serve in internet ?

[@DotNetCoreCentral]

@Ponvel Shanmuganathan, the API should be running on HTTPS to avoid this.

[@ponvels]

@@DotNetCoreCentral Thanks for quick reply. I have deployed the sample code in my UAT server that get exposed on the internet via the public IP over https. I am still able to capture the Authorization : Bearer xxxxx data via fiddler. Let me clear my expectation. All the web api call after getting JWT token should not get exposed in any form. Even if we have 1 or 2 min expiration, until that time attacker can use the the captured token to reuse unauthorized.

[@DotNetCoreCentral]

@@ponvels from local PC where the browser is running, the traffic can always be captured, the SSL is for stopping hackers from accessing data in the way. If your scenario when the user is logging in someone else is running Fiddler in the same machine at the time, I am not sure how practical this use case is. And if your concern is that the user leaves the website open on a public computer and someone comes in and tries to open the already open session in the web application, in that case, they already have the UI open, so the token is immaterial at this point. They can anyway access anything through UI. I am personally not aware of any mechanism to achieve what you want. If your use case is later, meaning the user leaves the UI in a public computer, the best solution is to add a log out strategy in the web application based on timeout.

[@ponvels]

@@DotNetCoreCentral Hi - I am facing one more problem. after deploying this code in IIS. i am able to hit and get the result from the name controller via browser. Could you I tried adding another controller having same issue. please comment whether I am missing any thing.

[@DotNetCoreCentral]

@@ponvels I am not sure I understood your problem. What happens when you add a new controller? What is the problem you are facing?

[@rivaldovola9896]

how to send the authentication header with each call. like what you did in postman?

[@DotNetCoreCentral]

you set it in the header section of the Postman with Authorization header

[@rivaldovola9896]

@@DotNetCoreCentral sorry not what i meant to ask. How do I send the header with each call in my api. After i get my token out of my api login. How to I send that token with another call to get authorized?

[@DotNetCoreCentral]

@@rivaldovola9896 Postman has concept of environment variable which you can use to save the token and pass it along to rest of the calls

[@ghkpr]

Great tutorial, easy to follow and understand. Thanks a lot!

[@DotNetCoreCentral]

@gh057k33p3r, thanks for watching the video!

[@shashivishw803]

im getting 404 not found in get when im trying to get values1 and values 2

[@DotNetCoreCentral]

@shashi vishw, if you can share your code in GitHub I can take a look, thanks.

[@Ramesh_Kumar_TG]

how to validate bearer token - if you put post man bearer token its allow to hit the method i want to how to validate bearer token and the method

[@DotNetCoreCentral]

@Ramesh Kumar, in the controller you will need to do this: if (!User.Identity.IsAuthenticated) return Unauthorized(); Rest will be taken care of by the middleware.

[@Thegeektoendallgeeks]

why is making the IJwtAuthenticationManager necessary?

[@DotNetCoreCentral]

@Thegeektoendallgeeks, thanks for watching! The JWTAuthenticationManager class is responsible for validating credentials and generate tokens. In a real-world scenario, this class might be just a proxy to an external authentication service for credentials validation, or it might interact with a data store for credentials. I hope this answers your question.

[@Thegeektoendallgeeks]

@@DotNetCoreCentral that helps thank you, on a separate note. I have a asp.net core web app (MVC) with authentication individual user accounts project I want to add JWT authentication similar to this, but I can't seem to figure out where to start regarding getting the user credentials to apply all of this to.

[@DotNetCoreCentral]

@@Thegeektoendallgeeks it should be the same as this demo since ASP.NET MVC also shares the same middleware pipeline as Web API. If you are facing any specific issue, and if you can share the code in GitHub, I can definitely take a look.

[@mmsky]

Thank you so much for taking the time to make this video and share your knowledge! Excellent. Subscribed :)

[@DotNetCoreCentral]

@Monica S, thanks for watching!

[@ToTo-vx2ix]

can this jwt auth method used to verify access on controller page not controller api?

[@DotNetCoreCentral]

@ToTo, yes it can be used anywhere since it is implemented in middleware.

[@ToTo-vx2ix]

@@DotNetCoreCentral is it possible to give an example on how to access authorize controller page? im not sure on how to put the token to access it

[@ToTo-vx2ix]

@@DotNetCoreCentral i already try to access api controller with token using postman and its work fine

[@Uzair_Anwar2299]

Hi. Good video. But what is the purpose of audience nd issuerence?

[@pritamdeokule]

Thanks You. Great... very neat and clean explanation given by you.

[@DotNetCoreCentral]

@Pritam Deokule, thanks for watching!

[@iamsidthebest007]

Thanks for the video. I followed exactly like you said. The token expiry I set as : Expires = DateTime.UtcNow.AddMinutes(Convert.ToDouble("20")); So, as you see I have set 20 minutes. I submit Authenticate request -> I get access_token, thats great! Now, I submit other API request with this access_token as bearer, I get the response as expected. Now, after 20 minutes, I try hitting the same endpoint, I still get response, even though 20 minutes have passed already. What am I missing? Please help.

[@DotNetCoreCentral]

@Sid N, thanks for watching. I will take a look and let you know.

[@furkand275]

why do we need to "var tokenKey = Encoding.ASCII.GetBytes(key); "

[@DotNetCoreCentral]

@Furkan D, thanks for watching! We need to pass byte array for the key, hence we need to get bytes from the string.

[@jspalding70]

Thank you for the knowledge you shared. What are the headers that I should be using with Postman?

[@DotNetCoreCentral]

In header you have to put “bearer token”

[@PraveenKumar-ft2kr]

Excellent video brother.. I have been looking for this.. Thank you so much 🙏🙌👏👏

[@DotNetCoreCentral]

@Praveen Kumar, thanks for watching!

[@furkand275]

"The name 'Encoding' does not exist in the current context" how to deal with it?

[@DotNetCoreCentral]

@Furkan D, are you using the code as is? or you made some modifications? If you did, can you share your code in GitHub so I can take a look?

[@furkand275]

@@DotNetCoreCentral i solved it thx anyway

[@DotNetCoreCentral]

@@furkand275 glad it worked out!

[@ashutoshmishra2170]

i am big fan of your videos .

[@DotNetCoreCentral]

@Ashutosh Mishra, thanks for watching!

[@SohailKhan1981]

Very well explained. Thanks for your effort.

[@DotNetCoreCentral]

@Sohail Sarwar, thanks for watching!

[@jashsudip]

really helpful to understand the jwt authentication. please make a video on refresh token also

[@DotNetCoreCentral]

@Sudip Jash, thanks for watching. I already have a video on refresh token on my channel.

[@nrldcm1133]

How about updating the token expiration when user tends to log out?. can you help me with that code?

[@DotNetCoreCentral]

@Norell Mantilla, I have a video on refresh token, you can refer to that and let me know if that works for you.

[@pedromoura8731]

Hi, thanks for the tutorial! You keep the content simple and easy wich is great, but for future improvement you could add a real front end, just a login page, 1 or 2 authorized pages and a logout. this way we could see the complete workflow of the jwt and how is stored in page transitions.

[@DotNetCoreCentral]

Pedro Moura thanks for the suggestions. I’ll definitely work on that. Thanks again for watching the video.

[@marrelicious6731]

@@DotNetCoreCentral Did you ever make this video?

[@lengoctuan5217]

@@DotNetCoreCentral Did you ever make this video?

[@DotNetCoreCentral]

@@lengoctuan5217 no, I never got to it.

[@lengoctuan5217]

​@@DotNetCoreCentral Thanks brother for the reply. Your video is very helpful.

[@ravindranaths513]

Hi, At timeline of 10:23 in this video, I have two questions here. 1) Why you used SecurityTokenDescriptor (from Microsoft.IdentityModel.Tokens); why not JwtSecurityToken (from System.IdentityModel.Tokens.Jwt)? 2) What is the difference between Microsoft.IdentityModel.Tokens.SecurityTokenDescriptor and System.IdentityModel.Tokens.Jwt.JwtSecurityToken classes? When to use which?.

[@DotNetCoreCentral]

@Ravindranath S, JwtSecurityTokenHandler expects SecurityTokenDescriptor from Microsoft.IdentityModel.Tokens, hence. You can use JwtSecurityToken to create token, in that case, you will need to call WriteToken, instead of CreateToken on the JwtSecurityTokenHandler instance.

[@sps014]

Great video, nicely explained

[@DotNetCoreCentral]

@Shivendra P. Singh, thanks for watching!

[@brettgregory3622]

Amazing video thank you! So clear and concise!

[@DotNetCoreCentral]

@Brett Gregory, thanks for watching!

[@inmywaythings]

Simple and clear example, thank you 👍

[@DotNetCoreCentral]

Thanks for watching!

[@alibux]

Thank you for this very helpful video and sharing your knowledge! Subscribed!

[@DotNetCoreCentral]

@Rehan Alibux, thanks for watching the video and subscribing to my channel!

[@cheequsharma7391]

Thanks a lot for such content. I respect and really admire your huge efforts, for such incredible content. God bless mate.

[@DotNetCoreCentral]

Thanks a ton

[@jvvable]

Thanks for your video, a Very Good explanation. I have a suggestion. if you can list out all the dependencies that will be great.

[@DotNetCoreCentral]

@jvv (vvj), thanks for watching and the suggestion!

[@stephenviswaraj7463]

Excellent Show, thanks much.

[@DotNetCoreCentral]

@Stephen Viswaraj, thanks for watching!

[@knightmarerip711]

Excellent work explaining this!

[@DotNetCoreCentral]

@Knightmare RIP, thanks for watching!

[@rishukumar7586]

which the best place to store that private key?

[@DotNetCoreCentral]

Normally I use the AWS Secret server, most of the cloud providers will have something similar.

[@eryogeshtripathi8888]

Nice and simple video

[@DotNetCoreCentral]

@Yogesh Tripathi, thanks for watching!

[@gautamsaraswat1541]

Great video. Keep doing the good work

[@DotNetCoreCentral]

Gautam Saraswat thanks for watching!

[@hindachokri5463]

Thank you for this helpful video. Keep doing the good work.

[@DotNetCoreCentral]

@Hinda Chokri, thanks for watching and taking the time to provide a comment!

[@mrjamiebowman]

This is great and I was able to replicate this. However, I'm wondering.. where do refresh tokens come into play?

[@DotNetCoreCentral]

@Jamie Bowman, refresh token comes to play when as an app you want to extend the token lifetime of the user without asking the user to enter id/pwd again for a new token after the initial token expired. The classic example will be a mobile application.

[@kadavilk]

Great video brother. If you could explain why we are using each commend and its benefits would have been really helpful.

[@DotNetCoreCentral]

@Kishor Kadavil, thanks for watching and great feedback, I will work on this.

[@mahipala1952]

How to make jwt taken invalid on logout time??

[@DotNetCoreCentral]

@mahipal a, you can create a block list, and the tokens that are part of the block list will not be allowed.

[@nafeeskhan8249]

Can you please provide the second part of this tutorial. It is very nice video. Awesome.

[@DotNetCoreCentral]

@Nafees Khan, thanks for watching! What are you expecting in the second part?

[@sri3884]

Great content 👏👏 , Thank you

[@Whisper_Jonas]

Thank you for all of your tutorial

[@DotNetCoreCentral]

@Monsieur Bobel, thanks for watching!

[@priyanshu4016]

Great video, i request you to explain the token validation parameter , and token descriptor class properties significance and what situation what value we should set may help great if you do some short video on that portion

[@DotNetCoreCentral]

@Web Samurai, thanks for watching, I will try to do a video for that.

[@namburinaveen5492]

Hi bro can you make a video on how to renew the expired token when user is in actively using webapi and web application

[@DotNetCoreCentral]

@namburi naveen, thanks for watching. I can do that.

[@rakshitkumar4838]

How can i consume it in my mvc application??

[@DotNetCoreCentral]

@Rakshit Kumar, if you are using ASP.NET Core AMV it should be exactly the same as Web API

[@AjithChanaka]

Thank you for making it easy understanding.

[@DotNetCoreCentral]

@Ajith Chanaka, thanks for watching!

[@rdoskoch]

So satisfying keyboard typing.))))

[@DotNetCoreCentral]

@Roman Doskoch, thanks!

[@shsikzuhair4393]

Thanks....good explanation

[@DotNetCoreCentral]

@Shsik zuhair, thanks!

[@aditisen20]

very well explained

[@DotNetCoreCentral]

Thanks!

[@codewithsakti8197]

Thanks . Perfect video

[@DotNetCoreCentral]

You're welcome!

[@SoftwareMahima2024]

Very good video

[@DotNetCoreCentral]

@Raj Raj, thanks for watching!

[@georgetuccio6053]

Very nicely done. Thank you.

[@akremhammami5328]

I still get 401 even I pass the token

[@rahulmathew8713]

Awesome keep up the good work

[@DotNetCoreCentral]

@Rahul Mathew, thanks for watching!

[@abdullahhafeez7798]

where is the code link??

[@DotNetCoreCentral]

github.com/choudhurynirjhar/auth-demo

[@majichayan]

Thank you for your well explained video. If possible, could you please make another video to show, secure an api with azure active directory and consume it from AAD secured react app.

[@DotNetCoreCentral]

majichayan I’ll definitely try. Thanks for the suggestion and thanks for watching.

[@jeffbreuninger7036]

Thank you! Very helpful tutorial.

[@DotNetCoreCentral]

@Jeff Breuninger thanks for watching!

[@nileshmonde4879]

Nice one ... can we apply same for MVC 5

[@DotNetCoreCentral]

@nilesh monde, yes, you can. Thanks!

[@gabriel99999-r]

Can you do a playlist of these series please ?

[@DotNetCoreCentral]

Gabriel Luca I will surely do. Thanks for watching.

[@gabriel99999-r]

@@DotNetCoreCentral great. Will you also add api versioning ?

[@DotNetCoreCentral]

Gabriel Luca I’m sorry for late response. For some reason I did not get any notification. I’ll definitely do a video on API versioning.

[@iyashasgowda]

A heartly thanks to you for teaching the tokenization in simple way.

[@DotNetCoreCentral]

@Yashas Gowda, thanks for watching!

[@sachindeshmukh5532]

Thank you so much for this video! it's really helpful..

[@DotNetCoreCentral]

@sachin deshmukh, thanks for watching!

[@alihaydar3021]

Good job 👍 .. what about refresh token?

[@DotNetCoreCentral]

@ Ali Haydar, thanks for watching! kzbin.info/www/bejne/bXuzaIlrbr1kqc0

[@bramburn]

Can you explain the claims please?

[@DotNetCoreCentral]

@Bhavesh Ramburn, claim is exactly what the name suggests. It's the claims asserted about the user. And if the user is authenticated the asserted claims are added to the ClaimsIdentity for the application to use.

[@ItianNerona]

Claims is just information about the client that is added to the token. It helps identify which user the token is for, among other things. In the RFC for JWT by IETF, they stated that "JWT parsers MUST either reject JWTs with duplicate Claim Names or use a JSON parser that returns only the lexically last duplicate member name" (tools.ietf.org/html/rfc7519#section-15.12).

[@marcotaliente4785]

Thank you man, that is what i sought for

[@DotNetCoreCentral]

@Marco Taliente, thanks for watching, and glad this video helped you!

[@SaravanaKumar-bt5xn]

Thanks for the tutorial. You are explaining the concepts very well. Could you please give some suggestions on this? What are the ways to store a JWT token securely on client side. We can use cookies or local storage. But, however someone/ anonymous will able to see the token by using some debugging tools and they can mock the same request and use it in outside of the application. How we can avoid it? Thanks.

[@DotNetCoreCentral]

Saravana Kumar I’m afraid there is not many choices for storing token securely on client side. Your best bet is local storage. But in terms of avoiding security threats keep your token expiry shorter. So that even if it’s stolen it cannot be used for a longer period.

[@SaravanaKumar-bt5xn]

@@DotNetCoreCentral Thank you so much for replying me. Will we use refresh token to overcome this issue?

[@DotNetCoreCentral]

@@SaravanaKumar-bt5xn yes, that's usually better.