Architecturing .NET Core WebApp

Hugo Sousa

Hey guys,

How are you? I need your help. I don't have a lot of experience architecturing projects but at the moment I'm trying to do it. And I would you to give me some feedback. My big question is the Authentication. I'm gonna to explain what I want to Develop. So, the architecture I want basically is one .NET Core API Project protected with JWT token. This project will be responsible for the authentication and to make available all the services I need for my app. And then I have a .NET Core MVC project (client). This client will have a login/register page and all the front-end of my WebApp. My big question is, as i'm generating the token in my API, what's the best way to manage client-side authentication and authorization? Should I create CustomAttributes? What is the best practice for this? Thank you very much.

Hugo Sousa

3 Replies

Know the answer? Post it — somebody with the same question will find it here.

Priyanka K S5y ago
Hi,
For backend follow this article :

https://www.c-sharpcorner.com/article/how-to-override-customauthorization-class-in-net-core/

For Frontend:

Use Antiforgery Token (XSFR) with JWT Token. XSFR is new for every request & keeps your every request safe & secure.
Sachin Singh5y ago
First, why are you creating an API? if you have planned for Android or IOS, or you want the data to share on multiple platforms then it is good to have an API layer in your project, so that the same data/logic can be shared.

Otherwise, if you have to develop just a web app then there is no need to create an API.

For API:- Token-based Authentication (JWT), so you are already in the right direction.

For Web APP:- Cookies-based Auth (Asp.Net Core Identity (membership provider ), Identity provides everything that you need.

Apart from that, make sure your app is HTTPS enabled. and not CSRF or XSS vulnerable?

Also, Identity is now a Razor class library, so you just need to scaffold and customize it as per your requirement.
Mahesh Chand5y ago
It seems like you are creating an API just for your own Web app. Is this correct? Will the data be stored on some other server? Where? Cloud? Will the API be hosted on the server server as the website? Will there be a different team of developers working in the API project? How many users do you expect Web app to be used by? Are the user access Web App are a part of an existing organization and already have an auth method such as AD? Do you have a public registraion on your website?