Upgrading to .NET Core: Adding JWT Authentication to Our API - A TimCo Retail Manager video

[@pigeonfigther]

52:27 I still think you're superman

[@IAmTimCorey]

lol thank you. I appreciate it!

[@copperntz5907]

No lie Tim. This authentication step nearly broke me. Fantastic video! Also thank you, comment section. Y'all saved me a couple times lol.

[@IAmTimCorey]

I am glad you are pushing through.

[@copperntz5907]

@@IAmTimCorey This course is my first intro into real world programming sometimes it makes my head spin. 🤣

[@dmytrohryshyn]

Hello Tim. It is me again. I have struggled to finish this lesson more then 3 days in row, JWT authentication did not work as it should. I started debugging session, and surprise it took me 3 days to make things working as you have in your lesson. I still don't know were my mistake was, but revert 2 last commits, started from scratch, and finally it works. It was not an easy experience, but it is a part of software development. I wish everyone do not have so long debugging session. )) I can continue follow you and hopefully I will catch you up in phase 3. Thank you.

[@IAmTimCorey]

Debugging takes time. The good news is that it is not lost time. That time debugging will teach you things. You will be better for it.

[@matterece3164]

Been waiting for JWT for almost a year! I know a lot of tutorials showing different ways of how to implement this, but I've been waiting on Tim's version since he explains why we should do it that way and how we can use it in our own projects.

[@IAmTimCorey]

I hope it was clear.

[@lageekattitude]

@@IAmTimCorey Absolutely

[@DukaSoft]

13:50 Ohh my god! soo simple to find the users roles! Thank you soo much, i've been looking for that for ages!

[@IAmTimCorey]

I am glad it was so helpful.

[@kennymar89]

@@IAmTimCorey I'm wondering why you didn't use this method to get the roles: await userManager.GetRolesAsync(user);

[@amit21thakur]

Some checkpoints below Setting up JWT at 21:47 Setting up the Authentication in Startup.cs 49:10 Swagger Implementation at 1:00:45

[@IAmTimCorey]

Thank you. I added them to the video description as chapters for the video.

[@amit21thakur]

@@IAmTimCorey Thanks Tim. I really appreciate your work.

[@w123au]

This is great. JWT is explained in the best one could explain and understand. "Simply Perfect"

[@IAmTimCorey]

Glad it was helpful!

[@lebeluet]

Great Tutorial Tim. I’m following the Timco retail course. This video helps me to understand the benefit of using dependency injection in that course. Thanks a lot.

[@IAmTimCorey]

Excellent!

[@nelsonrivers8546]

Good work. I have found several of your videos very helpful. Thank you.

[@IAmTimCorey]

You are welcome.

[@reagang8038]

Thank you so much for this Tim. Great work!!! I can't wait for the addition of refresh tokens

[@IAmTimCorey]

You are welcome.

[@quentincouissinier8533]

For some reason the "var result = await response.Content.ReadAsAsync();" from the DesktopUI.Library.API.APIHelper could not quite fill the field "Access_Token" of AuthentificatedUser. Each of my attempt kept filling it with "null". After poking aroud for a bit, found out that the "ReadAsStringAsync" , on the other hand, would get me the desired token. Hmm, strange. Poked a bit more and ... Fixed my issue. It seems like the "_" of "Access_Token" was the source of the problem. Changed it to "Token" and everything went fine. Made me debug for few hours and dive into the code a bit more, had a blast! Once again, thank you very much for all this golden content, you ROCK !

[@IAmTimCorey]

The code will be practically the same for both.

[@erikvolger5631]

I also had an issue with processing the json response string. The names in the anonymous object that is returned by the API and the AuthenticatedUser are both Pascal Case. But in the returned json object they are camelCase. I changed the case in AuthenticatedUser to camelCase, violating my naming rule, but then it works. Does anybody know what is changing the fieldnames in the json string and how I can prevent it??? (API =.net3 and UI.Library = .net std, could that be an issue?)

[@carlosalmeida2847]

Is just something in the way Tim explains things!

[@IAmTimCorey]

I'm glad it is helpful.

[@timw1971]

Excellent video. Covers all the key topics.

[@IAmTimCorey]

Thanks!

[@aminebenhebba1891]

Thats a lot of documentation to read yamy!..... Thanks Tim. :)

[@IAmTimCorey]

Hope you enjoyed it!

[@borisgeorgiev2770]

If somebody gets " 'AuthenticationBuilder' does not contain a definition for 'AddJwtBearer' and no accessible extension method 'AddJwtBearer' accepting a first argument of type 'AuthenticationBuilder' could be found (are you missing a using directive or an assembly reference?)", include package Microsoft.AspNetCore.Authentication.JwtBearer, but use Version 3.0.0.

[@tomthelestaff-iamtimcorey7597]

Thanks for the tip

[@joshstenger7815]

Thanks! I was hoping someone would address this!

[@Mfolmer]

Hi Tim At ~ 04:35 when accessing '/api/product/' you are logged in with your credentials which is in the role 'Cashier' (which we added in the last video session), hence you are authorized. So to me it seems that we are doing authentication as we are supposed to. However, you state that we aren't - How come? If you at ~ 04:35 log out you will not be able to access '/api/product' which to me seems like the appropriate behavior. Am I missing something?

[@IAmTimCorey]

I'm not logged in at 4:35. I am calling the API directly via the browser without passing the authentication token. It should fail but it does not. We will see later that it does fail when we add in properly-configured authentication.

[@Mfolmer]

@@IAmTimCoreyArh I see. However, if I add role restriction to 'api/product' such that only 'Managers' are allowed and try to call the API directly from the browser I'm redirected to an access denied page as my user is only assigned to the 'Cashier' and 'Admin' roles. So again - and I'm sorry if I am totally misunderstanding something - it seems like authentication is doing its job? (or at least something is)

[@markdekuijer]

55:04 For everyone getting this failed msg (or something similar) "Exceptions caught: '[PII is hidden]'. token: '[PII is hidden]'." try increasing the lenght of your secret encryption password. In my case it needed to be atleast 1024 bytes so i just added some random words. Error is really unclear tho... but it did fix it

[@IAmTimCorey]

Thanks for sharing.

[@faridmohdismail31]

i like that ur making webservice secure via jwt, thats what im thinking of having for the soln im working on now. but there are many bits like refresh token that is needed to figureout., but i guess, your post confirm that jwt can also be used not just for sso/auth, but also for auth for web-api

[@IAmTimCorey]

Yep.

[@nikfadeev2058]

I didn't get one thing. What did you mean when you said "We are not doing authentication at all" at 5:10 ? When you went to the "api/product" route at 4:30, weren't you already authenticated? And in the previous video we registered ourselves in the HomeController (Privacy method) and added all the roles in a cycle, didn't we? i'm confused a little bit. By the way, thanks for such a great course. You're great instructor and speaker. Even though English is not my first language, but i understand everything you're saying.

[@IAmTimCorey]

I was not logged in when I went to that route.

[@nikfadeev2058]

@@IAmTimCorey but, it's saying "Hello [e-mail]!" at the right top.

[@karatekid559]

Hello Tim I skipped through a few videos after this one before I bothered you with this question, but it doesn't seem as though a possible bug was addressed. Logging in on the MVC page no longer works correctly after adding the JWT authentication codeblock in the StartUp file. After logging in it just loads up the home page with the options to register and login. You also can't use the controller routes since they require you to be authorized. What I find strange is if you comment out the JWT code block in StartUp and launch the API again you are already logged in as whichever user you tried to log in as when the JWT code block was active. Also just in case it matters you can log in to the WPF app just fine its only the MVC page that's giving the issue. I tried moving that particular codeblock higher on the order and I also downloaded your source code and created a user, but I still ran into the same bug. This is the first time I've dealt with Authentication and the first time I even heard of JWT, so while I've tried I have been unable to solve this.

[@IAmTimCorey]

That is on our list of things to look into. I did discover it later on. Weird, right? We will track it down.

[@villesipola]

@@IAmTimCorey I ran into this same bug and kept debugging. Bit hard to see what's happening in runtime since there seems to be only that "_LoginPartial.cshtm" file as you pointed out. That file only seems to be responsible of the top menu portion of the login / register experience. Eventually got that bug isolated to that Jwt authentication code block same as karate kid did. There seems to be solutions around where people have built their own login and register pages which seem to work but can't help to ponder there must be some way of configuring that .dll so the default login / register pages would work with Jwt auth. For the project at hand and since this is a real life application development simulation it probably would be more convenient to build the login / register experience from ground up since it'll be only a matter of time when one needs to add some content to one of those pages and that's not possible if its hidden in some dll.

[@TheSjoerd]

Ran into this problem aswell. The Log In part in ASP.NET Core (part of Identity) is integrated into in a seperate dll, you cannot edit and debug it anymore. Only way to do so is to scaffold it of the dll en into the project.

[@codecomposer88]

"Let's get our swagger on" - I see what you did there :-)

[@IAmTimCorey]

:-)

[@gert-janvanderkamp3508]

Lol happy to see it's not just me 😂 Here's an idea for a video: setting up a STS using IdentityServer

[@IAmTimCorey]

I will add it to the list. Thanks for the suggestion.

[@zoltantoth4717]

Hi Tim, I am wondering why the exception (at 55:24) does not pop up in the code as for you did. In my case "Internal Server Error" is shown in the Login Form. Also, the console by default shows less info than yours. Please advise. Thank you.

[@MrEnerage]

Have you changed your API from http to https?

[@bradbernhardt750]

I got the same error. In my case it was because I used my own string for Encoding.UTF8.GetBytes("...") and the random string I chose wasn't long enough. It needs to be over a certain number of characters.

[@omarsebakhi]

​@@bradbernhardt750 Thank so so so much!!! I was looking in the comments if someone has the same issue and fixed it. Yes, my super secret word was short enough to rise that Internal Server Error!

[@omarsebakhi]

Thank you so much to write this, I was looking for someone has the same issue.

[@sanyamgupta2065]

@@bradbernhardt750 Thank You Sir.

[@ItsJustEza]

Hi Tim, on the internet people say "don't roll your own auth". Is this video rolling your own auth? People say it so casually but they never say where the border is between rolling your own and not rolling your own. Does the process in this video fall under "not rolling your own" or do you need to go to something like Identity Server 4 to fall in that bucket?

[@ItsJustEza]

@IAmTimCorey Hi Tim, this question has really been on my mind lately, could you help me out?

[@md.mizanurrahmanmilon3745]

I am a big fan of your videos :) cheers.

[@IAmTimCorey]

Thanks!

[@BrokeBillionare]

This was the most interesting lecture up until now in this series. Your lecture are amazing but WPF is so boring and dry(I am coming from angular and java-script) and I was waiting for asp core for so long. This lecture made that wait worth while. Can you let me know if you plan for security lessons sometime later? I am interested to learning how to make a secure banking type app without relying on third party packages.

[@IAmTimCorey]

We already have security on our WPF application using the API. We will cover securing data more in the future. I'm assuming you don't think this is a third-party package (Microsoft Identity). Don't create your own security. That is a BAD idea.

[@BrokeBillionare]

IAmTimCorey Do we have any other alternatives apart from identity in asp.net? Is there a separate oauth based security protocol?

[@rc2893]

When I added the non prerelease version (4.0.1) of swagger I could not add the using Microsoft.OpenApi.Models; using statement without getting a can not a reference error. I removed the non prerelease and installed the prerelease version (5.0.0-rc4) of swagger and everything worked as shown in the video.

[@IAmTimCorey]

Well, 5 has breaking changes from 4. That's probably one of them. You might be able to still get it to work but I'm not sure.

[@onyebuchiboss]

I am having this same problem as well, but cant find the prerelease on nuget?, infact my nuget never shows pre release like Tims does.

[@camilogomez7167]

Same problem, the prerelease versions can be installed checking the box where says "include prerelease" when you are going to install the nuget package.

[@magnus7538]

Hi Tim! Great tutorial! I have a question: When we create a Web API using Individual User Accounts and add the [Authorize] attribute to our API methods, I am not able to call them without logging in first. What exactly does JWT Authorization add to security beyond what we already have? Thanks!

[@IAmTimCorey]

JWT is an upgrade to what we have but it will continue to work the way you expect. A JWT is a standard token. It includes additional information (or can) about the claims a user has access to.

[@magnus7538]

@@IAmTimCorey Thanks Tim!

[@mortenkiilfinsas5195]

Hi Tim! Love your videos! I am having a issue that I am using .Net Core 3.1.3, and when running the application the same way you are doing, I cannot see the traffic that you are seeing in the console portion of the application. I only see information that is has started up and such. Do you know why or where to look for a option on adding this logging? All the information I find is basically on how to limit the logging, not adding that portion of logging. I appreciate any assistance.

[@IAmTimCorey]

I believe that is because the settings in your appsettings.developer.config filter out those pieces of data. I think .NET Core 3.1 added those new settings.

[@mortenkiilfinsas5195]

Thank you for the help! I did not find a appsettings.developer.config, but I did find a appsettings.developer.json and when I changed "Microsoft" from "Warning" to "Information", I saw all the traffic in the Console window, just as you did in the video. Thanks! :D

[@seanmcpadden1831]

Something that really tripped me up was _context.UserRoles. It was showing an error and I couldn't hit ctrl dot and add a using statement. In the end I manually added System.Linq at the top of the page and it worked. 👍

[@IAmTimCorey]

Ah. Yep, those don't always get put on the suggestion list for fixes. Great job tracking it down.

[@JoeBonez]

Excellent video, thank you

[@IAmTimCorey]

You are welcome.

[@berthos7793]

Did you need to use dynamic there instead of object? Maybe I missed where you used any members from the token.

[@LarryB15]

Just a note on Microsoft.AspNetCore.JwtBearer. I tried to install the latest 5.0 version and it was rejected because it did not support .NetCoreApp 3.1. I had to specifically select the 3.1.0 package.

[@IAmTimCorey]

Thanks for sharing that.

[@jt-so6fl]

Great series,congrats. I've probably missed it but have gone through the tutorials in the series that deal with the web api side of things and I can't see endpoints for user/role creation/deletion. Can anyone advise on this please?

[@IAmTimCorey]

User creation is built into what Microsoft provides. Role creation is something we need to add (we have not yet).

[@markcain2116]

How do you get your field to automatically have the underscore in it? e.g _config instead of this.config as my VS does?

[@IAmTimCorey]

In Tools -> Options under the Text Editor section, inside C# -> Code Style -> Naming, add a naming style called "_fieldName" that has a required prefix of underscore, capitalization of camel Case Name and then save it. That will give you what I have.

[@johnsinclair1447]

@@IAmTimCorey Thanks! That WAS very helpful!!

[@torrvic1156]

I apologize for a little critics but is it correct from REST point to name you endpoints like you did Tim? You mentioned CRUD operations and also you used capital letters. Maybe it’s me not understanding things correctly.

[@IAmTimCorey]

I'm not a firm believer in true REST, especially since no API actually implements REST properly, even if they claim they do. As for CRUD, that just stands for Create, Read, Update, and Delete. Meaning CRUD just stands for the various operation types with data.

[@torrvic1156]

@@IAmTimCorey thank you Tim! I really enjoyed you video and learned about automatic creation of constructor with a specific readonly variable and also I learned that I can build only one project to learn if there are any mistakes in it.

[@rekarpc98]

Error: CS1936 Could not find an implementation of the query pattern for source type 'DbSet'. 'Join' not found. Solution: Add "using System.Linq;" at top.

[@IAmTimCorey]

Thanks for sharing.

[@jitendrapanchal8699]

Thanks for the great tutorial Tim. I am new to WebAPI, and did not understand how the FormUrlEncodedContent passed from APIHelper mapped the values to the 3 parameters in Create method in Token Controller? Task Create(string username, string password, string grant_type)

[@dayo365]

hi Tim Thanx again for the wonderful videos.. I would like to know the name of the console like debug tool that you are using. thanx

[@IAmTimCorey]

The one that pops up when we launch the website? That is Kestrel and it is built-in to Visual Studio. Instead of selecting IIS Express when launching a website, select the option that matches the name of your project. That will launch Kestrel. I go into much more depth about it in my upcoming Blazor Server: In Depth course (coming in the next week or so).

[@dayo365]

@@IAmTimCorey Thanx alot and keep up the good work. it is so Helpful.

[@zoltantoth4717]

@@IAmTimCorey After a while I found it. If I choose TRMApi as startup project (instead of multiple startup projects) I can do what you wrote. But still, Kestrel console lacks of detailed info. Why? Thank you.

[@richardcoady6402]

Thanks Tim, Question, Secure Jwt token storage for client side for use in SPA is something which I have found difficult to come up with a clean secure solution. Using cookies, local storage, etc giving javascript access makes venerable to xss any thoughts. Maybe it is a different video.

[@IAmTimCorey]

You are already giving JavaScript access when it authenticates, since your SPA is running fully on the client using JavaScript (in addition to C#, in the case of Blazor WebAssembly). Storing the tokens in LocalStorage or SessionStorage is fine to do: stackoverflow.com/questions/63698112/storing-a-jwt-token-in-blazor-client-side Here is Microsoft's guidance on it: docs.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/?view=aspnetcore-6.0

[@sen.alexandru]

Hi Tim! How do you authorize your APIs? Apart from jwt, do you use user/role claims? Will you make a video on this topic?

[@IAmTimCorey]

In this course, we will be using roles.

[@sen.alexandru]

@@IAmTimCorey Microsoft.Identity comes with user and role claims (tables and logic). What is their purpose and how should we use them, in a sentence? My rookie question is, do you consider enough to use role authorization or something more complex like read/write rights for each endpoint in a medium sized business app? Needless to say how useful your content is in my day to day life

[@AlexVandenBos]

Hello Tim; would you mind doing a tutorial on Kestrel? I had to listen very carefully at what you were saying in this video, and try various interpretations of what you said (Castrol, Kastrol, Kestral..) I found a topic, but not really a way to install something?

[@IAmTimCorey]

Kestrel is the web server that comes with Visual Studio. It isn’t really for stand-alone use, although you can use it that way. I’ll add it to my suggestion list.

[@AlexVandenBos]

@@IAmTimCorey Thank you, I found out how to run it using my Visual Studio, but the output is basically nothing, while you clearly have output each time an action is performed, my Kestrel is dead silent..

[@beautifulheartsoothingreci28]

Amazing tutorial, but I still don't understand a few things: Why did you only need to add JWT authentication to the server/API side? How does your WPF client store the JWT Token it got from the API? How does it attach the Token to the header of subsequent calls to the API after successful login? How does the API know if a user authenticated previously? (How does it store the login state of a user?) Are you storing Tokens in a database? Sorry that's a lot of questions but I'm just a little confused now :/

[@lebeluet]

Newbies lesson learned in this video. Swagger is Case Sensitive. At 1:07:20 I get the same fetch error but no fail message from Castro. The problem was in my Startups.cs file : V in lieu of v was x.SwaggerEndpoint("/swagger/V1/swagger.json" is x.SwaggerEndpoint("/swagger/v1/swagger.json"

[@IAmTimCorey]

Interesting. I didn't know that this was the case for the URL.

[@SunnyTomcat1]

Thanks! Same happened for me ;)

[@NOCKSCITNEY]

Thank you so much for placing this in the comments. I too had this issue and I wasn't getting anything from Kestrel. For me though I'd used the capital V on the part above setup.SwaggerDoc("V1 . . . . . . and then everywhere else used the lower case "v".

[@anilyadav-yv6uk]

You have created token controller to create token and authenticate user detail.But from wpf client what you have used to access and store this token in wpf prject

[@IAmTimCorey]

I'm not sure what part is confusing you but the good news is that I do everything on screen so you can see what I'm doing and why as I do it.

[@anilyadav-yv6uk]

@@IAmTimCorey I mean to say that in Apihelper when we are authenticating user and after that you have added product endpoint to display and add product. In this when we send request to webapi for get and add product where to pass token to header

[@randypenajimenez3893]

Really Nice! One question, is mandatory to refresh the token?

[@IAmTimCorey]

You can set up the security how you want. However, the longer the token is valid, the longer it can be used after it is stolen. If a token can be used forever, it would be worth it to steal it and get it to work for you. If it lasts for 20 minutes, that's not enough time to steal it, and get it to work for you.

[@masterasp.netcore7086]

from the Usability perspective When the token expires after that user gets logged out of the system and needs to log in again. Logging into the application every 10 minutes could lead to a very bad user experience. Therefore, to overcome this problem we use ‘refresh tokens. The idea is to generate two tokens: an access token (valid for 10 minutes) and a refresh token, with a longer lifetime. Every time the access token gets expired, the client-side app sends a request to generate a new access token, using the refresh token. this post is worth reading decatechlabs.com/oauth2-explained-and-how-oauth2-works-oauth-in-action

Hello Tim. Thanks again for all your video. I'va also the error at minute 55:45 but me the UserId is null. Do you have an idea of what it could be?

[@IAmTimCorey]

Do you have valid credentials in the user table?

@@IAmTimCorey Hello Tim. Yes I have this. I'll try to redo all the module....

In fact I cannot make it. In the APIHelper in the GetLoggedInUserInfo at the line using (HttpResponseMessage response = await _apiClient.GetAsync("/api/User")) I have a response 'Unauthorize'.

I redo everything.Still not work.....

[@sahaskuk]

The 'taxRate' from 'Web.config' of the old API was not transferred to the 'appsettings.json' of the new API. This leads to an exception during 'Check Out' when the 'taxRate' is fetched for verification at the back-end, by the API Library, in the 'ConfigHelper.cs' file. Please address this issue in an upcoming video.

[@IAmTimCorey]

Ah, thanks for pointing that out. Will do.

[@dungho5974]

Hi Tim, I stuck at 50:00 as my application show Internal Server Error message when I hit the Log In button. Could you help me with that? Also there is no Kestrel console pop up when I run the app.

[@IAmTimCorey]

It sounds like you might not be launching both applications. Check to be sure you are starting both the WPF and API projects when running the application.

[@dungho5974]

@@IAmTimCorey I did let them both running, the problem I have may happen here, where in returned null: var output = new { Access_Token = new JwtSecurityTokenHandler().WriteToken(token), UserName = username };

[@jerbuddy]

Hey Tim, fantastic stuff! I asked early last year another video about my connection string not working while trying to work through that video but on .net core, it ended up being exactly the issue you had at the start of this! I'd given up and just hard coded it until now. Today I went through all these steps and got it working, but one thing i had to do was convert all my controllers and data access files from using static to newing things up, it took forever. What is the advantages/purpose of using non static over static in your dataaccess stuff? This was a ton of work to simply get the connection string working correctly, so i'm hoping I gained something else by converting over from static. Thanks again as always!

[@IAmTimCorey]

Good question. By using dependency injection, we can test our controllers and other items without a lot of work. We can just replace the implementation of the data access class, for instance, with a mocked implementation. I just did this in the solution video for the Weekly Challenge series on building a soda machine application.

[@jerbuddy]

@@IAmTimCorey ah gotcha, that makes sense. Thanks again!

[@responsibleparty]

FWIW, I would love to see a straight forward video on Web API authentication. Something simple that is secure but doesn't involve Microsoft identity platform or Azure. And it should also show how to call that API as well. I'm having such a hard time wrapping my head around this, or understanding why .NET Core doesn't have an option to add the simplicity of individual accounts when creating Web API projects (which this video seems to be using). I will watch the rest of the video in the hopes I can learn more about JWT, but the video was a bit jarring because it appears to start out already in the middle of a project, and seems to focus on topics not related to authentication.

[@IAmTimCorey]

Well, this isn't the first video in the series, so yes, you are coming into authentication in the middle. As for adding a "simple" identity system, I'm not sure what that would look like. Authentication and authorization are hard. Making sure they are secure takes a LOT of work. So, we have a built-in Identity in ASP.NET Core that we can use (that's what I'm upgrading to here) or we can use a third-party system. If you want simple, though, I recommend Azure Active Directory B2C. It is free for up to 50,000 monthly active users (a user that actively logs in is counted as 1 regardless of how many times they log in during the month). It is also easy to implement in a C# application. I did a course on it: www.iamtimcorey.com/p/azure-ad-b2c-start-to-finish

[@responsibleparty]

@@IAmTimCorey Yeah, I didn't expect the series because there was no part XXX in the title. I think JWT is the defacto standard. But it would be nice to have a video that focuses only on that, shows how to write the client end, and deals with the fact the individual accounts are no longer an option when creating Web API projects. Anyway, that's the video I would love to see. I am getting good content from this video, but there are just so many questions that come to mind. Thanks.

[@dmytrohryshyn]

Hello Tim at 55:45 you captured `userId` and paste it to data base row. In my case a have got null in `userId` field, so my MPF not receiving token from the API. I am debugging 2 days. In the API token controller it is generate a token also you mentioned `program.cs` is consumer. But seems after API controller my generated token has null some were. I am not really experienced well, but I think something go wrong in `porgram.cs` in API project.

[@erikvolger5631]

Had the same problem. My TokenController was decorated with [ApiController] and it didn't work. My parameters were all null. When I removed the attribute the parameters got through... (maybe this was an issue because of the project type I chose...) Also check your route, and make sure in startup.cs routes are configured for controllers.

[@erikvolger5631]

Found it: I accidentally added a second constructor on a Controller. After merging into one constructor all my problems were gone...

[@girornsveinsson7970]

Thanks for the video. It is great to have a working template now with the authentication. This upgrading business can be really tricky though. I had a lot of problems with readAsync as I was always getting an error that http.net.formatting had a missing file. It is not easy to see what is actually wrong but finally I got it fixed by getting a Microsoft.AspNet.WebApi.Client nuget package in the UI project, even though it is in the library project where it is actually used. Kind of silly but at least I got it to work by doing that.

[@IAmTimCorey]

Knowing which NuGet packages to add in can be tricky. I'm glad you got it to work.

[@wi11king777]

Thanks for the tutorial. I can get to the api/product in the first part of the tutorial, but I get an "Internal Server Error" when I get to minute 55: I've watched and rewatched the tutorial several times. I set a breakpoint at the GetById in the UserController and it is not reached. Any help would be appreciated.

[@tomthelestaff-iamtimcorey7597]

I wish I had an answer I could give you, but I don't. Have you tried working backwards, removing the last changes until you reach the point were it was working. Building debugging skills is critical to your success so (and I know this is easy for ME to say), think of this as an opportunity!

[@wi11king777]

@@tomthelestaff-iamtimcorey7597 Found the issue, I created another constructor vice adding to the existing constructor for UserController @ kzbin.info/www/bejne/b4K4kKxtYrumeZo

[@alefauman2293]

@@wi11king777 I've also the same problem and I don't get it fixed. I've the following constructor public UserController(ApplicationDbContext context, UserManager userManager, IConfiguration config) { _context = context; _userManager = userManager; _config = config; } What other constructor do you have?

[@alefauman2293]

When debugging I saw that the underlying error was the following: System.InvalidOperationException: No authenticationScheme was specified, and there was no DefaultChallengeScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action configureOptions). The cause of this problem was a misspelling :JwtBeaerer When changing .AddJwtBearer("JwtBeaerer", jwtBearerOptions => to .AddJwtBearer("JwtBearer", jwtBearerOptions => the problem was solved.

[@brunpersilva]

I got a weird error when i left an empty constructor on the UserController and that gave me a 500 "internal server error" when the ApiHelper called the GetLoggedUserInfo method but after a day i finally figured it out, most problems seems to be simple things.

[@obscureorigin2642]

Tim do you know if you've done some special configuration to get all those info logs into Kestrel? I've been following this course from the start and I haven't noticed you doing anything about that and the "Logging" settings you have in appsettings.xml are the same as mine. Yet somehow I'm only getting a couple info logs from Microsoft.Hosting.Lifetime when I start my application but after that I get barely any. I also don't get that fail log as you do when you first try opening swagger and encounter that error.

[@IAmTimCorey]

I haven't done any special configuration. I do believe that there was a change between .NET Core 3.0 and 3.1 on what was shown. Either that or .NET Core 3.0 did not include an appsettings.developer.json file. Check that out. There may be different filters in that file that are limiting what you see.

[@obscureorigin2642]

@@IAmTimCorey Ah yes! .NET Core 3.0 did include an appsettings.developer.json file also, but there were different filters configured there. Thanks a lot for pointing that out!

[@mochamothmedia]

It may be worth going over the git mv command so that the copied controllers and models carry over their version history. Would have to make the move and the modifications in 2 separate commits, though.

[@tomthelestaff-iamtimcorey7597]

Thanks for the tip. Feel free to share move details for the other viewers

[@eyesuskirstos]

tnx, why you use MVC controller for token insted of API controller?

[@IAmTimCorey]

Microsoft Identity uses the MVC systems.

[@onyebuchiboss]

Hi Tim, my VS 2019 doesnt show the command line interface like your does?

[@IAmTimCorey]

When you launch your web application, you have two options. One is named IIS Express. This is probably the one you are using. The dropdown also allows you to choose a type that is named the same as your project name. This is the Kestrel server and it opens up a command window when your web application launches.

[@onyebuchiboss]

@@IAmTimCorey cheers.

[@SunnySingh-wz3ky]

@@IAmTimCorey However, my Kestrel info does not seem to show as much info as yours does? Does this have something to do with Logger settings or kestrel settings?

[@Tahmasib13]

@@SunnySingh-wz3ky same problem

[@JohnPeter-yf5jf]

@@SunnySingh-wz3ky open the arrow next to appsettins.json you'll see Development.json - change Microsoft to Information. or you can add this to your Startup class to override that file. services.AddLogging(logger => { logger.AddFilter("Microsoft", LogLevel.Information) .AddFilter("System", LogLevel.Information) .AddFilter("NTOastNotify", LogLevel.Information) .AddConsole(); });

[@NOCKSCITNEY]

Tim, quick question if I may. I am upgrading to .netcore 6.0 as I go through these and I'm just wondering if there was a change at some point to the way Kestral works as although I had the Swagger error, I had no errors reported in the Kestral window, which would have made it hard to debug if I wasn't following along. Are there some settings that you can add to change the level of logging?

[@IAmTimCorey]

Yes, they changed the logging levels in the appsettings.development.json file. You can change them back to see more detailed logs.

[@mov4736]

after following along until the end, I noticed something. After we added JWT, I can no longer login through the browser. What approach could I take if I wanted to allow both types of logins (assume browser mvc uses standard method + mobile app using the api)?

[@IAmTimCorey]

Yep, we are going to address this in the future (I believe this is still on the todo list but it is a priority).

[@MrMahmudmirza]

Hi Tim, We have a legacy (WPF, WCF) application designed back in 2015 and for the website believe it or not its old VB6 Web Classes which integrate with the WCF etc. Customer are requesting an API which will allow them to login using JWT etc. I watched your earlier (part of TimCo Retail Management) video about Web API and generate access Token etc. But then you upgraded that to .Net Core. My question is the customer are using somewhat legacy application and require an API so shall I stick to your previous Web API and access token or upgrade to .Net Core to generate JWT? I am a little confused and so request if you could explain please? Many Thanks.

[@StudentCompanion]

Hi Tim, Is Windows Communication Foundation dead? Is it really worth it to learn it at the moment? Or web API is the new way to go? You hardly if never mentioned it in your courses, while your courses are really world and covering many scenarios,. so I assume you can now live without it. Are there special cases where it's best suited to use it? Thanks for great courses, from Electrical background, i am learning a lot from your courses.

[@IAmTimCorey]

WCF is not moving to .NET Core, at least not by Microsoft. There is a group working to make an open-source port (Microsoft gave them the code to work from). WCF was always a specialized communication system. For general web communication, API is the way to go. If you need a more specialized communication system in .NET Core and beyond, you would look at gRPC. It isn't the same as WCF but it does cover some of those specialized scenarios (especially things like talking to IoT devices).

[@StudentCompanion]

@@IAmTimCorey thanks

[@SuperDre74]

uhh, I'm just past the point of 5:23 and you're telling you get something but you're not authorized.... But if you look closely, when the default page opens when the app is started, you are automatically logged into the site, and you already had your roles set for your user including "Cashier", so you ARE actually authorized and that's why it will show you the products, logout and try it again, and you'll see you'll get the loginpage and your breakpoint in ProductController is not hit. And now I also see a 'bug' in IsValidUsernameAndPassword() as you use FindByEmailAsync, but it should be FindByNameAsync (which normally would be the same, but doesn't have to be (check the database)

[@IAmTimCorey]

I'm not sure I'm tracking. We aren't opening the app at this point, we are trying through the API and getting data even though we should not be.

[@SuperDre74]

@@IAmTimCorey you got the data because you logged into the website with 'remember me' AND you added the roles to your user in the previous video, so because you are logged in AND have the needed role of cashier you got a list of products when you added the /api/product after the url. So autherize worked as it should. If you logged out and then tried /api/product, the site would have asked you to log in. And so it might have been better to find out why it worked and used that method in the library instead of trying the old way with token.

[@pippaloves]

Is this source code for Patreon Members or people who buy the course? Sorry - I am a little confused.

[@IAmTimCorey]

Patreon members had access to the source code when the course was releasing live. Now that the course has been fully released, the source code is all on the paid version of the course only: www.iamtimcorey.com/salespage.html?course=ba-trm-00

[@pippaloves]

@@IAmTimCorey ok got you. Thank you so much for these videos! Life changing.

[@andrewcreating]

my question is how do you remain login? do you send the token all the time each time you make a request or is it something that I can store in the cookies and be able to persist login, instead of login everytime I send a request on api

[@masterasp.netcore7086]

in bearer authentication you always send the jwt token in header for each request and in case your token expire you can make use of refresh token workflow and you save the refresh token in the http only cookie. this post is in regular web api but concept is same . worth reading decatechlabs.com/secure-webapi-using-jwt

[@DecklonNyarko]

Thanks for this tutorial, much appreciated. why do get this error each time i try to login or register on client side. "AggregateException: One or more errors occurred. (No connection could be made because the target machine actively refused it. (localhost:5001))"

[@torrvic1156]

Database is not available. Check you connection string and also you database (if it’s up and running).

[@thegodtwon40]

Toward the end of this video yesterday, after we had installed all of the swashbuckle/swagger packages we needed to continue to our project, everything ran just fine. However, I had realized earlier that the kestrel wasn't popping up when I ran the app, so I doinked around with some settings to get the kestrel to show up, and afterwards when I ran the app and tried to login to our api login form I kept getting the following error: "An error occurred while sending the request." I have my start up projects set as TRMApi and TRMDesktopUI, which I believe are correct. Not sure what I've broken, but I need advice on what I need to do to fix it so my app will run properly again or at least where I should start looking for what the problem is. Thanks ahead of time for any tips, help, advice.

[@IAmTimCorey]

If you change from IIS Express to Kestrel, your URL changes (specifically the port number). That means you need to update your WPF project to look at the correct URL for it to work.

[@Brickscrap]

Tim, sorry to ask this here, but I can't find an answer - my Kestrel output only seems to be showing info level logs, and I can't find how to change it for the life of me... Do you have any idea how I can fix it?

[@IAmTimCorey]

Check your appsettings.development.json file. That's probably where the settings are that are limiting what gets displayed.

[@serghus6317]

For some reason my Combo Box is not populated with AvalilableRoles. It was with the old version of API. Any suggestions, please?

[@IAmTimCorey]

Sounds like it is time to tune up your debugging skills. Put a breakpoint in your code and step through it.

[@santiagopiaggio2099]

Hi tim! Thanks for the video It seems i have an error on min 55:40 , when you get an exception, i get an Internal Error -> Debugging i found out that is happening in the GenerateToken method, on line 74 : var output = new { Access_Token = new JwtSecurityTokenHandler().WriteToken(token), Username = username }; It won't go though that one. Any ideas on what's going on? Thanks :)

[@IAmTimCorey]

Not sure. Put a breakpoint in and step through the code. Hopefully that will give you a better idea of where it is breaking (because I think it is inside the token handler method) and maybe it will give you a better error message. Also check to be sure your code matches mine exactly

[@santiagopiaggio2099]

@@IAmTimCorey If someone is having the same problem, the solution is here: The problem was in the line 70 : new SymmetricSecurityKey(Encoding.UTF8.GetBytes("MySecretKeyIsSecretDoNotTellAnyonePlease")), The problem was the secret key string was too short! I used to have "MySecretKey" only, after debugging and consulting with stackoverflow, i found the solution. Just try that key right there "MySecretKeyIsSecretDoNotTellAnyonePlease" and it should be fine. Hope this helps anyone.

[@onefreeradical]

@@santiagopiaggio2099 thanks a thousand times. same trap

[@iusamaaziz]

@@santiagopiaggio2099 thank you buddy

[@theguire]

I am not getting verbose messages from kestrel like Time is at 1:07.49. I looked into customization, i googled kestrel and have not found anything that helps. Anyone?

[@rekarpc98]

Change the "Microsoft": "Warning" key/value pair to "Microsoft": "Information" in appsettings.Development.json

[@mdabuzar2130]

Hi Tim, Please share a video on covariance and contra variance

[@IAmTimCorey]

I will add it to the list. Thanks for the suggestion.

[@mdabuzar2130]

@@IAmTimCorey Hello Sir, Please share detail video on tfs and VSTS installation or setup. Only you can.

[@onyebuchiboss]

@@mdabuzar2130 VSTS is literally the first video of these series using Git.

[@williamphibbs6674]

For some odd reason, in the API for Swagger I can't login, I'm getting an internal server error. My api/User says to pass in text/plain instead of application/json I've been trouble shooting for a couple of hours and can't get it to login, Is anybody else having this problem?

[@IAmTimCorey]

Try putting breakpoints in and see if you can see what the actual internal server error is.

[@williamphibbs6674]

@@IAmTimCorey The api/User has no parameter passed in even though my GetLoggedInUserInfo says accept "application/json" so using (HttpResponseMessage response = await _apiClient.GetAsync("api/User")) brings back nothing and therefore the LoggedInUserModel is null

[@abdesssssa7469]

@@williamphibbs6674 in case you still have this issue, or if someone else has this, check the usercontroller, if you added a new constructor for Iconfiguration depandancy injection it'll throw the same error. that's what worked for me at least ...

[@onyebuchiboss]

Hi Tim, all the API calls on the frontend is failing to parse the returned result as it sees its media format as html/text no longer Json as started in the httpClient header, new to .net Core, dont know where to change the media format. there is no app_start folder to change all that config ?

[@IAmTimCorey]

By default, ASP.NET Core API returns JSON for API calls. I'm wondering if your client is actually asking for it in another format. Maybe check out these docs and see if they help: docs.microsoft.com/en-us/aspnet/core/web-api/advanced/formatting?view=aspnetcore-3.0

[@onyebuchiboss]

@@IAmTimCorey Thanks for the quick response Tim, I have tried calling it on POSTMAN, without the Authorise annotation on method, it returns back a response as expected, but with the authorise, it default to the Login page, hence why its sending an html/text response that my UI ReadAsync method cant read. I am a user in all roles as well, but dont why this is happening?

[@ezeewin6741]

If a user reset their password, the JWTs generated before the password change would still be valid, right? And if so, what would be the best way to tackle such an issue?

[@IAmTimCorey]

Correct. The user was authenticated at the time, which really shouldn't be much of an issue because they were who they said they were at the time. The JWT will expire and they will need to renew, at which point they will need to enter their new credentials.

[@valentinakoronaiou2926]

when you add and remove the roles (without Logging Off) they create a new instance in the dropdown and then you see multiple admins and cashiers and managers.

[@IAmTimCorey]

That's a bug we need to get fixed.

[@matterece3164]

I'm trying to do this on a separate project and it seems that I need to add "AllowAnonymous" on top of the TokenController. Is it necessary?

[@IAmTimCorey]

Yes, because you can't be authenticated before you are authenticated.

[@matterece3164]

@@IAmTimCorey btw, which is a better approach. Doing it this way or using IdentityServer. If it's this way, how can I expose the register, login methods from the MVC template?

[@_rcs]

The authentication system broke when we moved to the .NET Core API, was this purely because the .NET Core API didn't have the necessary configuration in Startup.cs? Would it have been possible to continue using the Bearer tokens (and not introduce JWT) if we modified Startup.cs appropriately?

[@IAmTimCorey]

It is possible.

[@macmcmillen6282]

When I run this my Kestrel window doesn't show all the request/response calls that your's does. Mine just says it's listening on localhost:5001. It also says it's hosting environment: Development... It doesn't show anything else, no matter how I use the API or UI. Is there some configuration to Kestrel that's required so that it outputs all the requests and responses? Thanks.

[@IAmTimCorey]

They made some changes, I believe in 3.1, that modified what Kestrel shows. I believe you need to modify the settings in appsettings.developer.json to allow it to show more items.

[@macmcmillen6282]

@@IAmTimCorey Thanks Tim. I changed the "Microsoft": "Warning" key/value pair to "Microsoft": "Information" in appsettings.Development.json, and that did the trick.

[@hellyworld9325]

At the very end, when I login and go to User Display, I can Remove a role and then when I go to Add a role, it adds the role back to the database but doesn't add the role name back to the UserRoles listbox. It has a blue outline that the role name is there but the letters aren't there. So it's there but it's not there. Any idea why this is happening???

[@IAmTimCorey]

It sounds like you have a naming issue when selecting which value to show in the listbox.

[@hellyworld9325]

@@IAmTimCorey Would this have to do with the Normalized name field in AspNetRoles table or something on the UserDisplayViewModel? Thank you for the prompt reply!

[@1mposs1b1e9]

Hi @IAmTimCorey I am getting a 405 Error from using (HttpResponseMessage response = await _apiClient.PostAsync("/Token", data)) in the API Helper, is this just happening to me and if not how would I fix the problem? Is it something to do with security?

[@IAmTimCorey]

That is a method not allowed error. It sounds like you have something misconfigured.

[@nanwu6803]

I have the same issue here in APIHelper.cs in Authenticate method, in the using statement using (HttpResponseMessage response = await _apiClient.PostAsync("/Token", data)) when I hit the Log In button, got red text: An error occurred while sending the request. any idea to solve this? I have set breakpoint, but when go into the using statement, it cannot step into, so, still no idea what's wrong.

[@tomaszwietrzyk2364]

@@nanwu6803 I experienced the same issue but in my case it was spelling in TokenController in [Route("/Token")]

[@LarryB15]

I've been following along today but I'm having a few issues with my project. I have got to the end of the video and my WPF UI is working as yours. However: If I add a uri of xxxxx/api/Product I get a completely blank page. If I go to swagger, which shows the Product uri and try it, nothing happens, I get no response. I put a break point on the constructor and the get() method in the ProductController I hit the breakpoints when running from WPF but not from the browser. Any ideas?

[@LarryB15]

I've tried not logging in, logging in from WPF UI and logging in from browser. each time I get the following output Request starting HTTP/2 GET localhost:5001/api/product info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2] Authorization failed. info: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler[12] AuthenticationScheme: JwtBearer was challenged. info: Microsoft.AspNetCore.Hosting.Diagnostics[2] Request finished in 16.0909ms 401

[@THE_NE0]

Are you gonna make a client app for that api or you already made one ?

[@IAmTimCorey]

I already made one. The WPF app connects to the API to get the data.

[@nanwu6803]

Hi Tim, thank you very much for the great course. I have encountered a problem while authenticating the username and password. when I hit the Log In button, got red text: An error occurred while sending the request. checked the username and password, they are correct. checked the _apiClient.BaseAddress, which is also correct (the 5001 one) in APIHelper.cs in Authenticate method, in the using statement using (HttpResponseMessage response = await _apiClient.PostAsync("/Token", data)), which return the exception. any idea to solve this? I have set breakpoint, but when go into the using statement, it cannot step into, so, still no idea what's wrong. Thanks!

[@nanwu6803]

some info in exception +InnerException {"The remote certificate is invalid according to the validation procedure."} System.Exception {System.Security.Authentication.AuthenticationException} Message "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel." string StackTrace " at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext& context) at System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult ar)" string

[@vartikagupta8816]

I am unable to get the logs in console somehow. I tried adding "Debug": { "Default": "Trace", "Microsoft": "Warning", "Microsoft.Hosting.Lifetime": "Information" } under the logging section in appsettings, to no effect. Any suggestions?

[@IAmTimCorey]

Check your appsettings.development.json file - that file probably is overriding these settings.

[@mdabuzar2130]

Hello Sir, Please don't leave in between the course. I need help of some inbuilt features added in core like JWT token and referesh token.

[@IAmTimCorey]

I'm not going anywhere, although I'm going to take a bit of a break from this series to cover some other things that have gotten backed up. I'll be back to this series soon though.

[@williamwade8119]

I have just started this series, using .Net 6 and I am getting this error "AuthenticationException: The remote certificate is invalid according to the validation procedure." I am not sure if this is related to changes in .Net Core between the versions. Anyone else running into this issue?

[@vanitanikam6361]

Hello I implemented Token and refresh token,But dont know how to use that in angular

[@IAmTimCorey]

Unfortunately, this channel doesn't cover Angular. The methods would be similar to what we do with WPF but you would need to translate the actions into JavaScript.

[@Wingloader]

Tim, I enrolled for the full course ;-) I am at the point in this vid where I am installing Swagger. I am way late into this course so versioning of Nuget packages has been a challenge. I've resolved everything on my own to this point but, I cannot get Swashbuckle.Core to install without this error: Severity Code Description Project File Line Suppression State Warning NU1701 Package 'Swashbuckle.Core 5.6.0' was restored using '.NETFramework,Version=v4.6.1, .NETFramework,Version=v4.6.2, .NETFramework,Version=v4.7, .NETFramework,Version=v4.7.1, .NETFramework,Version=v4.7.2, .NETFramework,Version=v4.8' instead of the project target framework '.NETCoreApp,Version=v3.1'. This package may not be fully compatible with your project. DataManagerAPI C:\Users\Joe\Git\Websites\MSIE\DataManagerAPI\DataManagerAPI.csproj 1 I googled the CRAP out of this and I cannot get Swashbuckle.Core to install as a .Net Core version. It reverts it to .Net Framework. In your tutorial, the first one you installed for Swashbuckle was Swashbuckle.AspNetCore. I tried using version 5.6.3 instead of the latest (6.3.0) thinking that it might be I need an older version. It installed that package just fine. I cannot get past this error for the Swashbuckle.Core. I spent at least 2 hours trying to resolve it. IF you know offhand what the answer is for this, I would be grateful if you could shed light on it. I am not asking you to do my work for me so if you don't know, please just tell me "sorry..." 🙂

[@rakeshchauhan-op8qw]

48:10 - Hi Tim, ever since Parlor went down, I feel that we as programmers need to take charge of Authentication as at least we have control.

[@IAmTimCorey]

That's an interesting discussion. On one hand, being able to control everything yourself allows you some autonomy. On the other hand, it means a larger area of attack. At the end of the day, you need to make the decision that fits best with your organization. If you are really concerned about the possibility of companies not allowing you to use their services then you should investigate stand-alone options. That does mean more risk and expense, but you have to weigh that against the likelihood of being dropped by services.

[@rakeshchauhan-op8qw]

@@IAmTimCorey Thanks, yeah good point. In future, I'll be building apps that will be flexible. Good job you have a video on SOLID for your audience.

[@jason71how]

How can I use JWT to authenticate users on desktop app?

[@IAmTimCorey]

Keep following along. We will have authentication in our WPF app (a desktop app) using JWT.

[@MasterKrepta]

After two hours of trying to figure it out, I am restoring to commenting. I am encountering an error with the password. At 55:00:00 I did not get any error. I am getting the 401 when i try to go to the products page as i should, but It just proceeded to give me an invalid password message in Kestral and a bad request, bypassing almost all the code written in this video near the bearer token. I did create the new user in the database as well. Everything seems to work until "return await _userManager.CheckPasswordAsync(user, password); " returns false.

[@IAmTimCorey]

At one point we moved databases. Are you sure the login name and password are in the database that your appsettings.json file is pointing to? Have you verified that the account is verified?

[@MasterKrepta]

@@IAmTimCorey Thank you for your input, Tim. I fixed it.. this is a really embarrassing error but as far as I can tell. When I recreated my account when we switched to TRMapi, I must have messed up the password I was using, because I created a new account, and am now returning a true value.

[@prajeshniraula1053]

I have encountered a problem while authenticating the username and password. After i enter the username and password an exception is caught in loginviewmodel that says "An error occurred while sending the request". The authenticate method in the ApiHelper awaits the httpresponse and hits back to the exception in loginviewmodel. Please help me solve this problem.

[@IAmTimCorey]

You are going to have to add some breakpoints and try debugging the issue to get more information.

[@nanwu6803]

I have got the same issue, any idea? thank you

[@rahulmathew8713]

Wat is the point of writing WPF in Dot Net Core, it will only work on Windows.

[@IAmTimCorey]

.NET Core is significantly faster than the .NET Framework with the same code. We can also interact with more modern code architectures, but the speed difference is the biggest issue.

[@thegodtwon40]

Whenever I attempt to add a new MVC controller to our TRMApi project, I get the following error: Visual Studio 2019 System.IO.FileNotFoundException: Could not load file or assembly'Microsoft.VisualStudio.Web.CodeGeneration.Utils, Version 3.1.2.0, Culture = neutral, PubliceKeyToken=adb9793829ddae60'. The system cannot find the file specified. Any idea what is causing this and how I can fix it? Thanks ahead of time for any and all comments/suggestions.

[@IAmTimCorey]

It looks like you don't have the correct version of .NET Core installed on your machine (3.1.2). Try updating Visual Studio.

[@thegodtwon40]

​@@IAmTimCorey The software update fixed the issue. After I completed the download and did a rebuild of the TRMApi project, I was able to create my new controller. Thanks again Tim.

[@jonwhitehead2102]

I added this to a new .net web application with razor template. The identity auth works for the api controller. however, when I add this line for the Jwt - DefaultAuthenticateScheme = "JwtBearer" the login section doesn't really jive with it. So if I comment this line out, and I don't login first (using Swagger) it will shoot the 401. But if I login to the default login from the razor login, it works. If I un-comment this line "DefaultAuthenticateScheme = "JwtBearer"" it will work in swagger but not via the default razor page/login. Seems like either or and I am missing something and just need to get past that. :)

[@IAmTimCorey]

Interesting. I’ll look into it.

[@jonwhitehead2102]

@@IAmTimCorey I think I figured out my problem. I created the API using the MVC project like you did to use roles and permissions for the API and it works with the JWT when I pass a token using swagger or postman. I think what's different is I'm trying to use the same MVC project to manage users and which roles they are in and now it also tries to use the JWT vs the authentication from identity. I'll create a new MVC project that connects to the same database and manage users that way. I was trying to make all in one versus the console app you created. Suffering is part of my learning :)

[@djangounchained7314]

I am getting "An error occurred while sending the request" when I try to test at the end the whole process... WTF!!! where to look? help me!!!

[@djangounchained7314]

The login window form appears with my old name and password already on it, when I click log in is when I am getting the error message

[@IAmTimCorey]

Sounds like it is time to level up your debugging skills. Track down where it is calling (the URL). Make sure the URL still exists. Run the command with Postman instead to see if you get the same error. Keep investigating until you find the solution.

[@djangounchained7314]

@@IAmTimCorey Baby mistake ... I was missing the s on the http !! =) problem solved ...

[@willievs]

First of all, thank you for a great series. After adding the HTTPGet and post code I still got errors, well just a 404. Eventually I found the problem. The Version number (V1) in the SwaggerDoc line is case sensitive when it gets to SwaggerEndpoint("/swagger/V1/swagger.json". If V1 used as SwaggerDoc and v1 used as Endpoint it WILL NOT WORK.

[@ahmedjelib]

Thanks for sharing.

[@rahulmathew8713]

I think the only flaw i see is your controller knows about your business logic. Actually it should not know that. Its not its responsibility. For JWT Token creation logic cant we move it from the controller. In real MVC architecture . Controller is treated as input device so in case of web its a weblistner it does not need to know the process of processing data. So I think JWT token creation logic should moved away from the conttoller.