ASP .NET Tutorial: JWT Bearer Tokens 🎯

Welcome to this comprehensive guide on JWT Bearer Tokens in ASP .NET! This tutorial is designed for beginners and intermediate learners, covering the topic from the ground up. Let's dive right in!

What are JWT Bearer Tokens? 📝

JWT (JSON Web Tokens) are a compact, URL-safe means of handling authentication and information exchange between parties. A Bearer Token is a token designation that implies the bearer is the only entity capable of using the token. In our case, we'll focus on JWT Bearer Tokens for authentication in ASP .NET.

Why Use JWT Bearer Tokens? 💡

Stateless: JWT eliminates the need to store session data on the server, making it more scalable.
Security: JWT includes a digital signature for secure token verification.
Simplicity: JWT is easy to implement and can be used with various programming languages and libraries.

How JWT Works? 💡

User authenticates (e.g., username and password).
Upon successful authentication, the server generates a JWT and sends it to the client (usually in the response header or cookie).
The client stores the JWT and sends it along with every subsequent request.
The server verifies the JWT and grants access if valid.

Creating a JWT in ASP .NET 📝

We'll use the built-in Microsoft.IdentityModel.Tokens namespace to create a JWT.

csharp

using System.IdentityModel.Tokens.Jwt;
using Microsoft.IdentityModel.Tokens;

// ...

var secret = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("your-secret-key"));
var credentials = new SigningCredentials(secret, SecurityAlgorithms.HmacSha256);

var claims = new[]
{
    new Claim(JwtRegisteredClaimNames.Sub, "your-username"),
    new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
};

var token = new JwtSecurityToken(
    issuer: "your-issuer",
    audience: "your-audience",
    claims: claims,
    expires: DateTime.Now.AddMinutes(60),
    signingCredentials: credentials
);

var tokenHandler = new JwtSecurityTokenHandler();
var jwtToken = tokenHandler.WriteToken(token);

Validating a JWT in ASP .NET 📝

csharp

using Microsoft.IdentityModel.Tokens;

// ...

var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("your-secret-key"));
var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

var tokenValidationParameters = new TokenValidationParameters
{
    ValidateIssuerSigningKey = true,
    IssuerSigningKey = key,
    ValidateIssuer = true,
    ValidIssuer = "your-issuer",
    ValidateAudience = true,
    ValidAudience = "your-audience",
    RequireExpirationTime = true,
    ValidateLifetime = true
};

var tokenHandler = new JwtSecurityTokenHandler();
var claimsPrincipal = tokenHandler.ValidateToken(token, tokenValidationParameters, out var validatedToken);