Secure Your .NET API in 15 Minutes: JWT Authentication Tutorial

[@MilanJovanovicTech]

Do you want to simplify your development process? Grab my free Clean Architecture template here: bit.ly/3Andaly

[@BeijoVegan]

Can I make a suggestion? Please, use some kind of editing software that zoom in where you click with the mouse. It's very hard to follow your coding on mobile phones.

[@19balazs86]

JWT is a nice topic, and I can not wait for the continuation of Keycloak.

[@MilanJovanovicTech]

It's scheduled for next Friday :)

[@dobjek]

Thanks!

[@MilanJovanovicTech]

Much appreciated!

[@pratikpandya2306]

You sound calm now. It’s great content, Keep it up.

[@MilanJovanovicTech]

It varies based on how many coffees I had prior ☕☕

[@shanabunny]

I was just about to implement it. Perfect timing thank you.

[@MilanJovanovicTech]

Perfect! 😁

[@Credi6464]

Pure gold content! Thanks for that!

[@MilanJovanovicTech]

Glad it was helpful!

[@EzequielRegaldo]

Awesome, your tutorials are the best !

[@MilanJovanovicTech]

Thanks a lot!

[@vbachris]

2 added bonus material? 1) token refresh 2) in conjunction with EntraID

[@MilanJovanovicTech]

Good suggestions for future videos

[@iq4u213]

Awesome video ! next video should be about Refresh Token

[@MilanJovanovicTech]

Good idea, actually!

[@ukgames304d]

please Milan make a video about implementing refresh token :)

[@MilanJovanovicTech]

All right, all right

[@dobjek]

Thanks Milan, excellent tutorial as always! Works as a charm out of box. How about next video of token expriration scenario as well as basic roles support? Coffee tips will be provided ;)

[@MilanJovanovicTech]

I'm releasing a video about refresh tokens very soon! And then extending this with some baked in AuthZ support won't be too difficult.

[@MarvinKleinMusic]

I really wish you would have showed the concept of refresh tokens here as well

[@MilanJovanovicTech]

Have a video coming up on that!

[@enricoroselino7557]

great video as always, do you have any tips on implementing role based access control using jwt ? or i shouldnt implement it inside jwt in the first place ?

[@MilanJovanovicTech]

You can add the roles as claims on the JWT, it's pretty simple. You then use these claims to implement an authorization policy.

[@davidespada01]

thank you can you show us how to consume the JWT token with validating

[@MilanJovanovicTech]

What do you mean by this?

[@EzequielRegaldo]

When you use Auth required in some route its automatically validated. Library does it for you

[@EzequielRegaldo]

@@MilanJovanovicTech maybe caducation or refreshing

[@davidespada01]

@@MilanJovanovicTech sorry i was not clear, i meant if i have an api application that will get jwt from other application and use it for further api calls what if i need to validate that jwt 1st in case it was encrypted Thank you ,, your amazing

[@isahirzm]

Great tutorial, when it comes to consume the API, what would be the best practices to do on the consumer(front-end)

[@MilanJovanovicTech]

As in where to store the JWT?

[@isahirzm]

@@MilanJovanovicTech yes

[@ALOKSHARMAMD]

do you have any videos explaining tools like open telemetry, application insights, grafana etc with dotnet. i have been going through different tools to implement in-app profiler for potential memory leaks handling and its very confusing on what to choose to identify & record basic memory/cpu usage for leaks and exceptions etc. As application insight is Azure specific, and other tools are not so easy to add by top attribute. any suggestions which doesn't rely on cloud deployments?

[@MilanJovanovicTech]

Check out the OpenTelemetry video here: kzbin.info/www/bejne/fqO1o31rrLmnms0 You should be able to use the metrics in Aspire to gain some insights

[@s.a.h.i1261]

Would love to see a video on how to protect this system additionally from CSRF attacks

[@MilanJovanovicTech]

Good suggestion

[@abdullahm.3363]

Great video, how to create a refresh token, so the user don't have to login again and again.

[@MilanJovanovicTech]

You can use a similar approach to here. Just store the refresh token in the DB, and give it a longer lifetime. Then expose an endpoint to send the refresh token in exchange for a new access token.

[@Mo-ef9yt]

Thanks​@@MilanJovanovicTech

[@WangAndrew]

how do you validate the jwt token on the client side, if blazor wasm ?

[@MilanJovanovicTech]

I believe you'd need the key to verify the hash, which isn't ideal. But if you just want to parse the content, that's not as hard.

[@WangAndrew]

@@MilanJovanovicTech what if the server side use ‘asymmetric’ then the client side only need the public key not the private key

[@agusbudianto4473]

Hi Milan, how to integrate this JWT token with SignInManager in Identitiy Core

[@MilanJovanovicTech]

Use SignInManager to verify password, and then generate a JWT and return it

[@denisgudiel5574]

Is the Manger user secrets more secure than the appsettings?

[@MilanJovanovicTech]

I didn't quite understand you there

[@denisgudiel5574]

@@MilanJovanovicTech is that you use the "Manager user secrets" to save the jwt key

[@theeusftn]

can you teach how to make hmac authentication?

[@MilanJovanovicTech]

Sure

[@asesorwebvideos]

gracias saludos desde CHILE

[@MilanJovanovicTech]

Many thanks!

[@dhmilmile1]

How can we implement refresh token?

[@istovall2624]

Do the same thing bit set the refresh token lifespan to longer then send them both. when the jwt expires resubmit them both to reissue. Still validate the jwt but make sure the only part invalid is the expires. Validate the refresh token. If valid and not expired, reissue new jwt.

[@MilanJovanovicTech]

There you go 😁

[@ojhkhofdgfd]

@@MilanJovanovicTech That's a great video! I believe you mentioned it is possible to somehow use the refresh token generated by AddIdentityApiEndpoints Service login endpoint to refresh JWTs?

[@dhmilmile1]

@@istovall2624 got it thanks

[@Arshaad786000]

this is brilliant. can you show us how to implement something like this with microsoft identity and roles

[@MilanJovanovicTech]

Will do

[@VishalYadav-oq9if]

Awesome 👍

[@MilanJovanovicTech]

Thank you! Cheers!

[@omidkianifar5144]

Continue Keycloak series plz

[@MilanJovanovicTech]

Next week (schedueld for Friday)

[@omidkianifar5144]

@@MilanJovanovicTech 😍

[@АлексейАнтонов-ф5ш]

Do something about external signin, like facebook, google, etc.

[@MilanJovanovicTech]

Good suggestions

[@СтасСеверин-н9й]

Where can i download this code?

[@MilanJovanovicTech]

This code on www.patreon.com/milanjovanovic But also try this :) www.milanjovanovic.tech/templates/clean-architecture

[@esdegan7176]

how if it got stolen?

[@MilanJovanovicTech]

You change the signing secret

[@esdegan7176]

@@MilanJovanovicTech with that solution, so if one user got stolen, all user signed outed. which not expected by other user. right?

[@RicusNortje]

Now you don't even need to pass in the user ID on the get user endpoint as you can get it from the JWT subject

[@MilanJovanovicTech]

Yes!

[@MahmoudSaed98]

Milan please we want a video about Refresh Token

[@MilanJovanovicTech]

Recorded, releasing soon

[@MahmoudSaed98]

@@MilanJovanovicTech Thank you very much

[@tumers.1595]

Good tutorial. But it seems to write all the codes into memory. It seems unrealistic and insincere to me.

[@MilanJovanovicTech]

Which part?

[@jonchicoine]

This doesn't' work that well as a standalone tutorial. imo For anyone familiar with project solution its probably a 10/10.

[@MilanJovanovicTech]

That may be the case