{"id":36890,"date":"2017-04-06T08:45:05","date_gmt":"2017-04-06T15:45:05","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/webdev\/?p=9615"},"modified":"2017-04-06T08:45:05","modified_gmt":"2017-04-06T15:45:05","slug":"jwt-validation-and-authorization-in-asp-net-core","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/dotnet\/jwt-validation-and-authorization-in-asp-net-core\/","title":{"rendered":"JWT Validation and Authorization in ASP.NET Core"},"content":{"rendered":"

This post was written and submitted by Michael Rousos<\/em><\/p>\n

In several previous<\/a> posts<\/a>, I discussed a customer scenario I ran into recently that required issuing bearer tokens from an ASP.NET Core authentication server and then validating those tokens in a separate ASP.NET Core web service which may not have access to the authentication server. The previous posts covered how to setup an authentication server for issuing bearer tokens in ASP.NET Core using libraries like OpenIddict<\/a> or IdentityServer4<\/a>. In this post, I’m going to cover the other end of token use on ASP.NET Core – how to validate JWT tokens and use them to authenticate users.<\/p>\n

Although this post focuses on .NET Core scenarios, there are also many options for using and validating bearer tokens in the .NET Framework, including the code shown here (which works on both .NET Core and the .NET Framework) and Azure Active Directory packages like Microsoft.Owin.Security.ActiveDirectory<\/a>, which are covered in detail in Azure documentation<\/a>.<\/p>\n

JWT Authentication<\/h2>\n

The good news is that authenticating with JWT tokens in ASP.NET Core is straightforward. Middleware exists in the Microsoft.AspNetCore.Authentication.JwtBearer<\/a> package that does most of the work for us!<\/p>\n

To test this out, let’s create a new ASP.NET Core web API project. Unlike the web app in my previous post, you don’t need to add any authentication to this web app when creating the project. No identity or user information is managed by the app directly. Instead, it will get all the user information it needs directly from the JWT token that authenticates a caller.<\/p>\n

Once the web API is created, decorate some of its actions (like the default Values controller) with [Authorize]<\/code> attributes. This will cause ASP.NET Core to only allow calls to the attributed APIs if the user is authenticated and logged in.<\/p>\n

To actually support JWT bearer authentication as a means of proving identity, all that’s needed is a call to the UseJwtBearerAuthentication<\/code> extension method (from the Microsoft.AspNetCore.Authentication.JwtBearer<\/code> package) in the app’s Startup.Configure<\/code> method. Because ASP.NET Core middleware executes in the order it is added in Startup<\/code>, it’s important that the UseJwtBearerAuthentication<\/code> call comes before UseMvc<\/code>.<\/p>\n

UseJwtBearerAuthentication<\/code> takes a JwtBearerOptions<\/code> parameter which specifies how to handle incoming tokens. A typical, simple use of UseJwtBearerAuthentication<\/code> might look like this:<\/p>\n<\/article>\n

app.UseJwtBearerAuthentication<\/span>(new JwtBearerOptions<\/span>()\n<\/pre>\n
\n
\n
{\n    Audience = \"<\/span>http:\/\/localhost:5001\/\"<\/span><\/span>, \n    Authority = \"<\/span>http:\/\/localhost:5000\/\"<\/span><\/span>, \n    AutomaticAuthenticate = true<\/span>\n});<\/pre>\n<\/div>\n<\/article>\n
The parameters in such a usage are:<\/p>\n
\n