ASP.NET Core 2.0 Bearer Authentication

Problem

How to implement bearer authentication in ASP.NET Core 2.0

Solution

Create an empty project and update Startup to configure JWT bearer authentication,

public void ConfigureServices(
IServiceCollection services)
{
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options => {
options.TokenValidationParameters =
new TokenValidationParameters
{
ValidateIssuer = true,
ValidateAudience = true,
ValidateLifetime = true,
ValidateIssuerSigningKey = true,
ValidIssuer = "Fiver.Security.Bearer",
ValidAudience = "Fiver.Security.Bearer",
IssuerSigningKey =
JwtSecurityKey.Create("fiversecret ")
};
});
services.AddMvc();
}
public void Configure(
IApplicationBuilder app,
IHostingEnvironment env)
{
app.UseAuthentication();
app.UseMvcWithDefaultRoute();
}

Add a class to create signing key,

public static class JwtSecurityKey
{
public static SymmetricSecurityKey Create(string secret)
{
return new SymmetricSecurityKey(Encoding.ASCII.GetBytes(secret));
}
}

Add an API controller and secure with [Authorize] attribute,

[Authorize]
[Route("movies")]
public class MoviesController : Controller
{
[HttpGet]
public IActionResult Get()
{
var dict = new Dictionary<string, string>();
HttpContext.User.Claims.ToList()
.ForEach(item => dict.Add(item.Type, item.Value));
return Ok(dict);
}
}

Discussion

Bearer Tokens (or just Tokens) are commonly used to authenticate Web APIs because they are framework independent, unlike something like Cookie Authentication that is tightly coupled with ASP.NET Core framework.

JSON Web Tokens (JWT) is commonly used to transfer user claims to the server as a base 64 URL encoded value. In order for clients to send a token, they must include an Authorization header with a value of “Bearer [token]”, where [token] is the token value.

Middleware

When setting up bearer services you specify how incoming token is validated e.g. code in the Solution section would validate based on Issuer, Audience and Expiry values.

When configuring authentication you could hook into lifecycle events too,

options.Events = new JwtBearerEvents
{
OnAuthenticationFailed = context =>
{
Console.WriteLine("OnAuthenticationFailed: " +
context.Exception.Message);
return Task.CompletedTask;
},
OnTokenValidated = context =>
{
Console.WriteLine("OnTokenValidated: " +
context.SecurityToken);
return Task.CompletedTask;
}
};

Token

Usually tokens will be created by using OAuth framework like IdentityServer 4. However, you could also have an endpoint in your application to create token based on client credentials. Below is a snippet from the sample project that creates a JWT,

// in JwtTokenBuilder.cs
public JwtToken Build()
{
EnsureArguments();
var claims = new List<Claim>
{
new Claim(JwtRegisteredClaimNames.Sub, this.subject),
new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
}
.Union(this.claims.Select(item => new Claim(item.Key, item.Value)));
var token = new JwtSecurityToken(
issuer: this.issuer,
audience: this.audience,
claims: claims,
expires: DateTime.UtcNow.AddMinutes(expiryInMinutes),
signingCredentials: new SigningCredentials(
this.securityKey,
SecurityAlgorithms.HmacSha256));
return new JwtToken(token);
}

You could have a controller to use this method and create tokens,

[Route("token")]
[AllowAnonymous]
public class TokenController : Controller
{
[HttpPost]
public IActionResult Create([FromBody]LoginInputModel inputModel)
{
if (inputModel.Username != "james" && inputModel.Password != "bond")
return Unauthorized();
var token = new JwtTokenBuilder()
.AddSecurityKey(JwtSecurityKey.Create("fiversecret "))
.AddSubject("james bond")
.AddIssuer("Fiver.Security.Bearer")
.AddAudience("Fiver.Security.Bearer")
.AddClaim("MembershipId", "111")
.AddExpiry(1)
.Build();
return Ok(token.Value);
}
}

Now you could make a request to this controller in order to obtain a new token,

Using the token you could access the API,

jQuery

You could use jQuery to get tokens and access secure resources. To do so enable the use of Static Files in Startup,

public void Configure(
IApplicationBuilder app,
IHostingEnvironment env)
{
app.UseStaticFiles();
...
}

Create a controller to return a view,

public class JQueryController : Controller
{
public IActionResult Index()
{
return View();
}
}

Add Index view that uses jQuery (jQuery script lives in folder wwwroot/js),

<html>
<head>
<meta name="viewport" content="width=device-width" />
<title>ASP.NET Core Bearer Auth</title>
<script src="~/js/jquery.min.js"></script>
</head>
<body>
<div>
<strong>ASP.NET Core Bearer Auth</strong>
<input type="button" id="GetToken" value="Get Token" />
<div id="token"></div>
<hr />
<input type="button" id="UseToken" value="Use Token" />
<div id="result"></div>
</div>
<script>
$(function () {
$("#GetToken").click(function () {
$.ajax({
type: 'POST',
url: '@Url.Action("Create", "Token")',
data: JSON.stringify({ "Username": "james", "Password": "bond" }),
contentType: "application/json"
}).done(function (data, statusText, xhdr) {
$("#token").text(data);
}).fail(function (xhdr, statusText, errorText) {
$("#token").text(errorText);
});
});
$("#UseToken").click(function () {
$.ajax({
method: 'GET',
url: '@Url.Action("Get", "Movies")',
beforeSend: function (xhdr) {
xhdr.setRequestHeader(
"Authorization", "Bearer " + $("#token").text());
}
}).done(function (data, statusText, xhdr) {
$("#result").text(JSON.stringify(data));
}).fail(function (xhdr, statusText, errorText) {
$("#result").text(JSON.stringify(xhdr));
});
});
});
</script>
</body>
</html>

Source Code

GitHub

12 Comments

Join the conversation! Your thoughts help the community grow.

Madan Shekar6y ago
I have implemented this code in core 2.2. I am able to generate the token, once I passed that token in the header in the sense I am getting 401 error
Akhilesh Tripathi7y ago
Very timely. I'm embarking on this very thing in the next few days. Thanks for putting this together!
Ale Fransoa8y ago
Great article, thank you very much
Esben Pedersen8y ago
In AddClaims method, this line is wrong: this.claims.Union(claims); since Union returns the union but it doesn't mutate the collection.
Raymond Li8y ago
// Thanks for your useful article, but is this logic correct? if (inputModel.Username != "james" && inputModel.Password != "bond") return Unauthorized();
Muhammad Mohsin8y ago
Simple and to the point, Thanks :)
vijay sahu8y ago
Not able to figure out the namsespace for JwtToken in // in JwtTokenBuilder.cs
- Guest User8y ago
  Fiver.Security.Bearer.Helpers
Ashwin Kumar8y ago
Hi Tahir....your blog https://tahirnaushad.com/ is no longer available. Could you tell the new URL or any other place where we can find that blog.
Tridip Bhattacharjee8y ago
How many type of token exist? what is bearer token?
- Jatin Saini8y ago
  As far as i know Id tokens, Access tokens, Refresh tokens, Validating tokens are available for different purposes. First three tokens are represented as "Bearer Token". Bearer Token or Token both are same thing. Its just encrypted values of issuer, audience, claims, expires and signing credentials etc. You can also add custom claims to internal usage. The token you're seeing above in this article is JWT (JSON Web Token). Notice we place "bearer" keyword while passing the token in header, this "Authorization: <type> <credentials>" pattern was introduced by the W3C in HTTP 1.0.
Ahsan Siddique8y ago
Level...well done Brother