Secure Serverless Azure Functions Using JWT Auth And C# (.Net 6)

GenerateJWTToken.cs

using JWT;
using JWT.Algorithms;
using JWT.Serializers;
using System.Collections.Generic;
namespace AzureFuntions_Auth_JWT {
    /// <summary>
    ///     Service class for performing authentication.
    /// </summary>
    public class GenerateJWTToken {
        private readonly IJwtAlgorithm _algorithm;
        private readonly IJsonSerializer _serializer;
        private readonly IBase64UrlEncoder _base64Encoder;
        private readonly IJwtEncoder _jwtEncoder;
        public GenerateJWTToken() {
            // JWT specific initialization.
            _algorithm = new HMACSHA256Algorithm();
            _serializer = new JsonNetSerializer();
            _base64Encoder = new JwtBase64UrlEncoder();
            _jwtEncoder = new JwtEncoder(_algorithm, _serializer, _base64Encoder);
        }
        public string IssuingJWT(string user) {
            Dictionary < string, object > claims = new Dictionary < string, object > {
                // JSON representation of the user Reference with ID and display name
                {
                    "username",
                    user
                },
                // TODO: Add other claims here as necessary; maybe from a user database
                {
                    "role",
                    "admin"
                }
            };
            string token = _jwtEncoder.Encode(claims, "Your Secret Securtity key string"); // Put this key in config
            return token;
        }
    }
}

Now let's consume this JWT Code in the Functional Code to get the token on basis of User credentials and attach that token in the response where that token can be consumed to get access for other endpoints for this we need to modify the existing API lets make those changes and check that response in the postman.

We just created an object for GenerateJWTToken Class to access that IssuingJWT Function which you can see in line number 27 & 28 in the code below

Function1.cs

using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Azure.WebJobs;
using Microsoft.Azure.WebJobs.Extensions.Http;
using Microsoft.Extensions.Logging;
using System;
using System.Threading.Tasks;
namespace AzureFuntions_Auth_JWT {
    public static class Function1 {
        [FunctionName(nameof(UserAuthenication))]
        public static async Task < IActionResult > UserAuthenication(
            [HttpTrigger(AuthorizationLevel.Anonymous, "post", Route = "auth")] UserCredentials userCredentials, ILogger log) {
            log.LogInformation("C# HTTP trigger function processed a request.");
            // TODO: Perform custom authentication here; we're just using a simple hard coded check for this example
            bool authenticated = userCredentials?.User.Equals("Jay", StringComparison.InvariantCultureIgnoreCase) ?? false;
            if (!authenticated) {
                return await Task.FromResult(new UnauthorizedResult()).ConfigureAwait(false);
            } else {
                GenerateJWTToken generateJWTToken = new();
                string token = generateJWTToken.IssuingJWT(userCredentials.User);
                return await Task.FromResult(new OkObjectResult(token)).ConfigureAwait(false);
            }
        }
    }
    public class UserCredentials {
        public string User {
            get;
            set;
        }
        public string Password {
            get;
            set;
        }
    }
}

Run and Test the same API in the postman again

In the next step we have to validate the JWT Token which we have generated using the auth API and now using the same token let's access another API for that we need to Validate the token by using the Key and username let's hook it up the code now.

ValidateJWT.cs

using JWT.Algorithms;
using JWT.Builder;
using Microsoft.AspNetCore.Http;
using System;
using System.Collections.Generic;
namespace AzureFuntions_Auth_JWT {
    public class ValidateJWT {
        public bool IsValid {
            get;
        }
        public string Username {
            get;
        }
        public string Role {
            get;
        }
        public ValidateJWT(HttpRequest request) {
            // Check if we have a header.
            if (!request.Headers.ContainsKey("Authorization")) {
                IsValid = false;
                return;
            }
            string authorizationHeader = request.Headers["Authorization"];
            // Check if the value is empty.
            if (string.IsNullOrEmpty(authorizationHeader)) {
                IsValid = false;
                return;
            }
            // Check if we can decode the header.
            IDictionary < string, object > claims = null;
            try {
                if (authorizationHeader.StartsWith("Bearer")) {
                    authorizationHeader = authorizationHeader.Substring(7);
                }
                // Validate the token and decode the claims.
                claims = new JwtBuilder().WithAlgorithm(new HMACSHA256Algorithm()).WithSecret("Your Secret Securtity key string").MustVerifySignature().Decode < IDictionary < string, object >> (authorizationHeader);
            } catch (Exception exception) {
                IsValid = false;
                return;
            }
            // Check if we have user claim.
            if (!claims.ContainsKey("username")) {
                IsValid = false;
                return;
            }
            IsValid = true;
            Username = Convert.ToString(claims["username"]);
            Role = Convert.ToString(claims["role"]);
        }
    }
}

Let's create another endpoint which will have to accept authentication in order to fetch the data from the system and in the output we are passing the JSON object of the user credentials after successful authentication pass. In this API actually, we were validating the API with our Credentials once its passes then we are allowed to send the success response as the output.

GetData

[FunctionName(nameof(GetData))]
public static async Task < IActionResult > GetData(
    [HttpTrigger(AuthorizationLevel.Anonymous, "post", Route = "data")] HttpRequest req, ILogger log) {
    // Check if we have authentication info.
    ValidateJWT auth = new ValidateJWT(req);
    if (!auth.IsValid) {
        return new UnauthorizedResult(); // No authentication info.
    }
    string postData = await req.ReadAsStringAsync();
    return new OkObjectResult($ "{postData}");
}

Run and test the API in Postman

That’s all there is to it!

Source Code - GItHub

Keep Learning.....!