How to Use Multiple Authentication Schemes in ASP.NET Core Web API

►► Master Web API development Best Practices: bit.ly/3TnqoFQ
►► Build great web apps in Blazor WebAssembly: bit.ly/437g87T
►► Support us on Patreon and get the source code: / codemaze
In this video, I will show you how to use multiple authentication schemes in .NET.
I will combine two JWT or (JsonWebToken) schemes and one cookie scheme to show you how multiple authentication schemes can be implemented inside the Web API project. To demonstrate how multiple schemes can work together, I will implement an API that uses a cookie-based authentication with the default scheme and two JWT bearer authentications with two different schemes.
LINKS MENTIONED IN THE VIDEO
►► JWT Authentication - • ASP.NET Core Authentic...
FOLLOW US ON SOCIAL MEDIA!
►► / marinko-spasojevic
►► / codemazeblog
►► / codemazeblog

[@CodeMaze]

Thank you all for watching and for your support. ►► If you want to master Web API development using best practices, check out our Web API book: bit.ly/3x75ZMM ►► Also, to build great full-stack apps with Blazor, check out our course: bit.ly/3Pw3Y33

[@Mr.Pavel85]

Awesome! Very useful video, thank you!👏

[@CodeMaze]

Glad you enjoyed it! Thank you too for watching and for the support.

[@10Totti]

Best Tutorial! Thanks!

[@CodeMaze]

You're welcome! Thank you too for all the support. It really means a lot to me.

[@user-ls1ge5jd9g]

Very useful , thank you!

[@CodeMaze]

Glad it was helpful! Thank you too for watching.

[@bobliu-bt1uw]

GREAT!!!

[@CodeMaze]

Thanks for watching.

[@Tamer_Ali]

@CodeMaze you awesome 👍 when using cookie authentication over JWT authentication is recommended?

[@CodeMaze]

This really depends. Usually when you have apps like MVC or Razor or Blazor Server, you use cookies because your UI is connected directly to your server part of the app. When you have separate server and client apps, than JWT is usually used. Of course this doesn't have to be the rule, but it is mostly the case. Also, it depends on how you want to handle your tokens. You can have a separate Web API project, and still using the HttpOnly Cookie to transfer that token (I have a video about that as well).

[@ugochukwuumerie6378]

Very useful tutorial, how would you build a policy for API key authz?

[@CodeMaze]

Hi. This is where you see that: kzbin.info/www/bejne/Zp7FXqqhoLuAmMk

[@Robd515]

Hey CodeMaze! Your videos are great, I actually own both your dotnet ultimate bundles for web apis ( version one and two) Is it possible you could make a video on how to implement third party auth such as Facebook and Google? Thanks a lot

[@CodeMaze]

Hi Rob. Thank you for the kind words and the support. Regarding your question, well it is possible, but to be honest if I make that kind of video, I will probably do only the Web API part. Including any client framework to work with that can simply invalidate the video pretty soon as those third party client libraries get replaced or obsolete pretty fast. I wrote one article for the Google Auth with Angular and .NET Web API, and never changed anything for the Web API part, but for the Aungular parth, the library was modified several times making the article invalid.

[@sergiomatiasurquin1148]

is it possible to make this with azure ad and custom authentication?

[@CodeMaze]

I guess it can be done, just I can't since I didn't work with Azure that much.

[@user-gl7vl2kw8g]

how do you set HTTP cookies, I used the HTTP cookies but I'm getting false in the context.User.Identity?.IsAuthenticated

[@CodeMaze]

Hi. I am not sure I understand. Is your question related to this video? Because, as you can see, the cookie is set automatically in the Postman. It is sent with the SignInAsync method from the controller.

[@user-gl7vl2kw8g]

@@CodeMaze Sorry I forgot to mention, It's not related to this video, Actually, I am using HTTP cookie-based authentication but I'm getting false in the context.User.Identity?.IsAuthenticated. .AddJwtBearer(cfg => { cfg.SaveToken = true; cfg.TokenValidationParameters = new TokenValidationParameters() { IssuerSigningKey = "", ValidateAudience = true, ValidateIssuer = true, ValidateLifetime = true, ValidateIssuerSigningKey = true }; cfg.Events = new JwtBearerEvents { OnMessageReceived = context => { string action = Convert.ToString(context.Request.RouteValues["action"]) ?? ""; if (action.Equals("RefreshToken", StringComparison.Ordinal) && context.Request.Cookies.ContainsKey("X-Refresh-Token")) { context.Token = context.Request.Cookies["X-Refresh-Token"]; } else if (context.Request.Cookies.ContainsKey("X-Access-Token")) { context.Token = context.Request.Cookies["X-Access-Token"]; } return Task.CompletedTask; } }; }); How do you set the HTTP cookie that I want to know?

[@CodeMaze]

I didn't do that for a long time and don't have any source code. What I think is that you are using JWT authentication not a cookie authentication, but want to return the token to the client as HttpOnly cookie. There are some examples on Google (I just searched) but again, didn't use it for a while, and really I am currently not sure how it exactly works. But I am definitely sure it was similar to your configuration.

[@user-gl7vl2kw8g]

@@CodeMaze Let me explore more.