ASP.NET 5: Authorization and Authentication with Bearer and JWT
By: Marcos Vinicios
Tags: Authentication, Software Development, Csharp, Dotnet, Jwt

In this article, I will show how can we create an authorization and authentication schema based on user roles in ASP.NET 5.

This article will not show the user registration in the database, for that, I will simulate with “hard code”. We will not have interactions with the database.

Requirements

For building our application we’ll need a few tools:

Are you ready? Let’s go!!

1️⃣ We need to create a new project ASP.NET Core Web Application

2️⃣ We need to add the next packages:

dotnet add package Microsoft.AspNetCore.Authentication

dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer

To perform authentication we will need a username, password, and a “profile role”. Like I said before this article is not to cover the data access, we will set users in a “hard code” repository.

3️⃣ We will then create a folder in the root called Models and inside it the “User.cs” file with this code.

4️⃣ Our next item is the repository, and for that, we will create a folder in the root called Repositories and inside it the “UserRepository.cs” file, with this code

5️⃣ Finally, we will need a key, a secret, to generate the Token, this key must be a string that only the server knows, it is called a Private Key. For this scenario, we will create a file called “Settings.cs” at the root of the application with the following code.

In production scenarios, we should put this key in the settings.

How to create a token?

On the “Microsoft.Authentication.Jwt” package we have the class JwtSecurityTokenHandler which is used to generate a Token but we need to provide some information, that is called SecurityTokenDescriptor, in this, we have the user profile information, the time to expire, and others.

In this example, we are going to create a service to generate the token, to be able to call this wherever we want, without having to duplicate our code.

For that we will create a folder called “Services” and inside create a file called “TokenService.cs” with the following code:

This is just what we need to create the token.

Adding Authentication and Authorization 🔐

Now we need to inform our application that we want to work with authentication, authorization, and the token format which in our case is JWT.

For that in the “Startup.cs” class on ConfigureServices method, we need to inform ASP.NET that we are using authentication and for that, we use the AddAuthentication feature, in this, we inform witch is the type and the challenge. Still in the ConfigureServices, we inform that we will use JwtBearer and its configuration, this is done in the AddJwtBeater method. Next, we have our “Startup.cs” class.

Authentication

To exemplify authentication we need to create a controller as shown in the following code.

Now we need to run the API and perform a Post request using Postman as I show in the following image.

Action using Postman

As a result, we have the user information and the token.

Note: Attention to the port, in my case, is “61076” please check yours.

Authorization

To finalize let’s add some methods in the controller to see the possibilities when we work with authorization, but before that a simple explanation:

AllowAnonymos : allow anonymous access, without any authentication;

: allow anonymous access, without any authentication; Authorize : to access, the user must be authenticated, but the “role” doesn’t apply in this case;

: to access, the user must be authenticated, but the “role” doesn’t apply in this case; Authorize(Roles=”role1,role2,role3”): the user must be authenticated, and need to have one of the roles in the list.

Let’s see how looks the finalized code in “HomeController.cs” as shown below.

Now we are able to test the new endpoint in this controller, for that let’s use postman again, don’t forget we need to inform the token like is shown below.

Conclusion

You could see how easy is to implement the Authorization and Authentication using Bearer and JWT with .Net 5.

I uploaded the code for the normal implementation in this repository

Other Articles