JWT Authentication In ASP.NET Core

To run this code require .net core 2.1 Runtime and it is out of support now any suggestion sir ?

Hi Jignesh Trivedi how did you implement jwt authentication without implementing Authorization filter.Microsoft should recruit you for inventing such a great way and wasting readers time and above all frustating them

Thomas SimoneJignesh: I was enjoying this when I came across a slight mispelling. In GenerateJSONWebToken, I got to DateOfJoing and had to stop. I didn't recognize the word. So I looked it up and was surprised when I only found an entry in UrbanDictionary. Granted, below the snippet is the correct word 'Joining'. DateOfJoing is not something I have seen, shall we say, documented before. :^0 Other than that, nice work, sir.

Hello Jignesh, Thank you for sharing this beautiful article on JWT Token Generation. This article is very useful and helped me in implementation of API model for my project. I was wondering; why the token expiration is not working however I found it in some other article to add "ClockSkew = TimeSpan.Zero" inside TokenValidationParameters under Program.cs file. Which should ensure to expire the token at the defined given time.

Tanks! Nice bro

Sir please make a blog on facebook n google authentication in same above application

Hi, I want to use this in ASP.NET Core MVC. Is storing the token in session good idea?

I have a couple of questions . can you please clarify this? 1. I got a token from the server. I just passed it to someone to use this token. he could able to access the API with the token until it expires. How can we restrict this? 2.I got a token from the server with an expiry time of 15 min. before 15 min I hit token controller and got another token with an expiry time of 15 min. Now I have two tokens with valid time. will the two tokens work? or only the latest one? if so how can we validate?

Hi, when coding, I keep seeing this error with UserModel: The type or namespace of 'UserModel' could not be found. How can I fix this? Thank you.

Good one article Jignesh bhai. Keep writing this kind of blog and keep motivating us. Thanks.

Hii Jigenesh, very good article, can you post a article on JWT Authentication with asymetric keys ??

Nice article...

I use [authorize] in my project and shows 401 error after that what i do ?

How can we use JWT without registration or login credentials?

Yes, it works . thanks for the explanation and example code

Is JWT token to use in a different web api 2.0 or web application ?

Hi Jignesh, fantastic explanation. I want to know where is middleware? I am new to this stuff and I thought that middleware should do authentication and authorization.

Always returning same token, how to come out this

Great post, thanks.

Thanks for the solution Jignesh.. I want to quickly highlight 1 errors in the code which i downloaded from site. In LoginController.cs file -> AuthenticateUser method you should use the parameter object "login" to check if user name is valid of not like this if (login.Username == "Jignesh")

JWT enough elaborated Thanks Jignesh Trivedi

I got the token and passed it in WeatherForecast api but I received Bearer error="invalid_token", error_description="The audience 'empty' is invalid"

401 Error in [Authorize]

Download code not working

Hi, I had used your code to generate token but I am getting "Missing id, name, or email in the JWT token."

Can you explain JWT(with short lifespan e.g 15 seconds) with refresh token(an arbitrary string stored in database).Very good article.

HI I want add custom authorize filter, because we have customer request and response for jwt, So can you please help to authorize by my method and return my message json

Very good article, it really helps.

Commendable explanation. Can you explain JWT(with short lifespan e.g 30 seconds) with refresh token(an arbitrary string stored in database) thanks a lot

It throws error "Could not get any response", Any solution?

Great sir.

Nice Explanation, I have to implement a custom Authorization message when token expire over the [Authorize] attribute. Please suggest me how to override ?

Token key validation always return 401

Muito bom o artigo mais voc? poderia explica esse mesmo exemplo utilizando WINDOWS FORMS

Good work. Helpful

I am getting an error "ShowPII is hidden" - I am not sure if it is a missed configuration

Hi Jignesh, Why did you not use the userInfo parameter on GenerateJSONWebToken() method?

Hi Jignesh, i have two separate project first is patient and second is api project and i call every api method form my patient project so i need authorization from patient project to api project so please help me my emaild: [email protected] contact:- 7507577769

You created jwt token in one project ,but how to validate same token in another project please tell me.

Can we use this jwt authentication mechanism for mvc razor web applications? I have a scenario where I generate token through login action inside Login controller which returns a token. Now since I have token now I need to get redirected to home controller with action Index on the success event of Login ajax call. But since the home controller is authorized I am not able to get redirected. Am simply using window.location.href = "Home/Index" right now. Is there any way we can pass token also that is stored in my local storage?

Private UserModel AuthenticateUser(UserModel login) { UserModel user = null; //Validate the User Credentials //Demo Purpose, I have Passed HardCoded User Information if (login.Username == "Jignesh") { user = new UserModel { Username = "Jignesh Trivedi", EmailAddress = "[email protected]", DateOfJoing = new DateTime(2010, 08, 02) }; } return user; }

Shahbaz Hussain, cors is already configured services.AddCors(options => { options.AddPolicy("CorsPolicy", builder => builder.AllowAnyOrigin() .AllowAnyMethod() .AllowAnyHeader() .AllowCredentials() .Build()); }); and also changed authorize filter to [Authorize(AuthenticationSchemes = "Bearer")], still finding same issue.

I am facing a issue, on decorating the api wth [authorize] . while hitting api with token on https coming up with "HttpRequestException: Response status code does not indicate success: 404 (Not Found).". removing authorize filter it comes with proper response. please your thought on this.

I am facing an issue. I have client side app made via reactjs and web api using asp.net core. Now i have written one api to generate pdf and i have used Authorize filter. When i remove this filter from api, my client side app is able to download pdf but if i use this filter, then pdf is downloaded but coming blank. Is there any issue with token generation?

Good work, I run it successfully

Whats the best place to store the Key and Secret ?Right now im storing in web.config .Once we move to production it will be a issue if i store it in the Web.Config <add key="APiID" value="abcID"/> <add key="APIPWD" value="abcPW"/>

I have downloaded your sample code, make it run. Now I am trying this on Fiddler but I am unable to get the token.

Its working ok with header name - Authorization header Value - "Bearer xxxxxxxxxxx". Thanks for this article.

Hello Sir, I implemented your code but I am facing the error of 401.

How do you call the login action method? I am getting a 404 error on calling login

I had set token expire 1minute. after 1 minute i had used same token itis working. how to check token expiry.

Good article to explain the concept in easy language.

What are steps need to follow to work this example code with actual database

Please help am getting , error="invalid_token", error_description="The audience is invalid"

Can u send the any jwt document?

How to use JWT for security in .asmx file when I create web services ? Please Reply

Here is a package built by me which smoothly integrates Jwt Bearer Token Security in your Asp Net Core app in minutes. It is called AspNetCore.Security.Jwt. Also, provides Swagger UI integration too. GitHub: https://github.com/VeritasSoftware/AspNetCore.Security.Jwt

Thanks, very useful. One question - how to make logged in user accessible in the _Layout.cshtml file? I can access this.User but it's empty, doesn't contain claims. In normal views and controllers it works fine.

Thank you for this clear explanation. I have a web application that has both user identification (using asp.net core identity) and an API. I would like to create a new API release with JWT token identity. I am a bit confused whether it is an all or nothing approach, in other words, once I use JWT for the API, do I need to use it through out also on the web site? Or should I have separate Core applications? That would be a pity, adding complexity.

Hi, LoginController at Line 65 . I think it should be 'login.Username' not 'user.Username', right?

Hi Jignesh, my GET doesn't work. The POST works well, I've got the token. I have created a function with httpget and allowAnonymous but still have 404. DO you have any idea? Thanks

Nice one. Bookmarked

Hello Jignesh Trivedi sir, i have gone thru your articles on JWT(https://www.c-sharpcorner.com/article/introduction-to-jwt/ & https://www.c-sharpcorner.com/article/jwt-json-web-token-authentication-in-asp-net-core/) and i wish to implement it in ASP.Net Web-API. Thanks for your contribution on JWT with .Net Core.

Thanks for the article.