How to implement JWT token in Asp.net mvc c#

Implementing JWT (JSON Web Token) in ASP.NET MVC 4.5 involves configuring your application to issue and validate JWT tokens. Here's a clear, step-by-step guide to help you implement JWT authentication in your ASP.NET MVC 4.5 application:

Step 1: Install Necessary Packages

First, you need to install the necessary NuGet packages for JWT. In this case, we will use the System.IdentityModel.Tokens.Jwt package.

1. Open the NuGet Package Manager Console.
2. Install the package by running the following command:

   Install-Package System.IdentityModel.Tokens.Jwt
   

Step 2: Create a JWT Helper Class

Create a helper class to handle the creation and validation of JWT tokens.

using System;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Security.Cryptography;
using Microsoft.IdentityModel.Tokens;

public static class JwtHelper
{
    private static readonly string SecretKey = "YourSecretKeyHere"; // Ensure this is a secure key
    private static readonly SymmetricSecurityKey SigningKey = new SymmetricSecurityKey(Convert.FromBase64String(SecretKey));

    public static string GenerateToken(string username, int expireMinutes = 30)
    {
        var tokenHandler = new JwtSecurityTokenHandler();
        var now = DateTime.UtcNow;
        var tokenDescriptor = new SecurityTokenDescriptor
        {
            Subject = new ClaimsIdentity(new[]
            {
                new Claim(ClaimTypes.Name, username)
            }),
            Expires = now.AddMinutes(expireMinutes),
            SigningCredentials = new SigningCredentials(SigningKey, SecurityAlgorithms.HmacSha256Signature)
        };

        var stoken = tokenHandler.CreateToken(tokenDescriptor);
        var token = tokenHandler.WriteToken(stoken);

        return token;
    }

    public static ClaimsPrincipal GetPrincipal(string token)
    {
        try
        {
            var tokenHandler = new JwtSecurityTokenHandler();
            var validationParameters = new TokenValidationParameters
            {
                ValidateIssuer = false,
                ValidateAudience = false,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = SigningKey
            };

            var principal = tokenHandler.ValidateToken(token, validationParameters, out _);
            return principal;
        }
        catch (Exception)
        {
            return null;
        }
    }
}

Step 3: Implement Login Action

In your controller, implement a login action that issues a JWT token upon successful authentication.

using System.Web.Mvc;

public class AccountController : Controller
{
    [HttpPost]
    public ActionResult Login(string username, string password)
    {
        // Implement your user authentication logic here
        bool isAuthenticated = AuthenticateUser(username, password);

        if (isAuthenticated)
        {
            string token = JwtHelper.GenerateToken(username);
            return Json(new { token });
        }
        else
        {
            return Json(new { error = "Invalid username or password" });
        }
    }

    private bool AuthenticateUser(string username, string password)
    {
        // Replace with your user authentication logic
        return username == "testuser" && password == "testpassword";
    }
}

Step 4: Secure Your Actions with JWT

To secure your controller actions with JWT, create an action filter that validates the JWT token.

using System.Linq;
using System.Web.Mvc;

public class JwtAuthorizeAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        var request = filterContext.HttpContext.Request;
        var authHeader = request.Headers["Authorization"];

        if (authHeader != null && authHeader.StartsWith("Bearer"))
        {
            var token = authHeader.Substring("Bearer ".Length).Trim();

            var principal = JwtHelper.GetPrincipal(token);

            if (principal == null)
            {
                filterContext.Result = new HttpUnauthorizedResult("Invalid token");
                return;
            }

            // Set the current principal
            System.Threading.Thread.CurrentPrincipal = principal;
            base.OnActionExecuting(filterContext);
        }
        else
        {
            filterContext.Result = new HttpUnauthorizedResult("Missing token");
        }
    }
}

Step 5: Apply the JwtAuthorize Attribute

Apply the JwtAuthorize attribute to the actions or controllers you want to secure.

public class SecureController : Controller
{
    [JwtAuthorize]
    public ActionResult SecureAction()
    {
        return Content("This is a secure action");
    }
}

Step 6: Testing

Test your implementation by:

• Calling the login action to get a JWT token.
• Using that token in the Authorization header for requests to secure actions.