JWT Authentication in ASP.NET Core Web API in CRUD operation

Hi Firoz,

To implement JWT authentication in an ASP.NET Core Web API with CRUD operations, you need to:

Set up JWT in your ASP.NET Core Web API project.
Secure your API endpoints with JWT authentication.
Create CRUD operations with authentication and authorization.

Steps:

1. Install Required Packages

In your ASP.NET Core project, install the following NuGet packages:

Install-Package Microsoft.AspNetCore.Authentication.JwtBearer
Install-Package System.IdentityModel.Tokens.Jwt

2. Configure JWT Authentication in Startup.cs (or Program.cs in .NET 6/7)

In .NET 6/7, configure JWT authentication in Program.cs as follows:

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        // Add JWT Authentication
        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddJwtBearer(options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                ValidIssuer = "yourIssuer",
                ValidAudience = "yourAudience",
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("your_secret_key")) // Replace with your key
            };
        });

        services.AddControllers();
        services.AddAuthorization();
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        app.UseRouting();

        // Enable authentication
        app.UseAuthentication();
        app.UseAuthorization();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
    }
}

3. Generate JWT Token:

In your controller, create a method to generate the JWT token after a successful login:

[HttpPost("login")]
public IActionResult Login([FromBody] UserLoginDto login)
{
    if (login.Username == "testuser" && login.Password == "password") // Example credentials
    {
        var token = GenerateJwtToken();
        return Ok(new { token });
    }
    return Unauthorized();
}

private string GenerateJwtToken()
{
    var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("your_secret_key"));
    var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);

    var tokenDescriptor = new SecurityTokenDescriptor
    {
        Subject = new ClaimsIdentity(new[]
        {
            new Claim(ClaimTypes.Name, "testuser"),
            new Claim(ClaimTypes.Role, "User")
        }),
        Expires = DateTime.Now.AddMinutes(30),
        Issuer = "yourIssuer",
        Audience = "yourAudience",
        SigningCredentials = credentials
    };

    var tokenHandler = new JwtSecurityTokenHandler();
    var token = tokenHandler.CreateToken(tokenDescriptor);
    return tokenHandler.WriteToken(token);
}

4. Secure CRUD Endpoints with JWT Authentication

You can now protect your CRUD API endpoints with [Authorize] to ensure they can only be accessed with a valid JWT token.

[Authorize]
[ApiController]
[Route("api/[controller]")]
public class ItemsController : ControllerBase
{
    private static List _items = new List();

    // GET: api/items
    [HttpGet]
    public IActionResult Get()
    {
        return Ok(_items);
    }

    // GET: api/items/5
    [HttpGet("{id}")]
    public IActionResult Get(int id)
    {
        var item = _items.FirstOrDefault(i => i.Id == id);
        if (item == null)
            return NotFound();
        return Ok(item);
    }

    // POST: api/items
    [HttpPost]
    public IActionResult Post([FromBody] Item item)
    {
        _items.Add(item);
        return CreatedAtAction(nameof(Get), new { id = item.Id }, item);
    }

    // PUT: api/items/5
    [HttpPut("{id}")]
    public IActionResult Put(int id, [FromBody] Item updatedItem)
    {
        var item = _items.FirstOrDefault(i => i.Id == id);
        if (item == null)
            return NotFound();

        item.Name = updatedItem.Name;
        item.Description = updatedItem.Description;
        return NoContent();
    }

    // DELETE: api/items/5
    [HttpDelete("{id}")]
    public IActionResult Delete(int id)
    {
        var item = _items.FirstOrDefault(i => i.Id == id);
        if (item == null)
            return NotFound();

        _items.Remove(item);
        return NoContent();
    }
}

5. Test the JWT Authentication with CRUD

Login: Send a POST request to /login to get the JWT token.
Use JWT in CRUD operations: Include the JWT token in the Authorization header of your API requests:

Authorization: Bearer your_jwt_token

This setup ensures that all CRUD operations are protected by JWT authentication. Only users with a valid token can access these endpoints.