Section 29 — JWT & Web API Authentication
Identity with Web API
It is an API that manages users, passwords, profile data, roles, tokens, email confirmation, external logins etc.
It is by default built on top of EntityFrameworkCore; you can also create custom data stores.
Register Endpoint
Register UI
Login Endpoint
Login UI
Introduction to JWT
A JSON Web Token (JWT) is a compact and self-contained object for securely transmitting information between parties as a JSON object.
Contents of JWT
1. Header (base 64 string)
Defines the type of token and the signing algorithm used.
Eg: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9
2. Payload (base 64 string)
Contains user claims (user details such as name, email or user type).
Eg: { “userId”: “b08f86af-35da-48f2-8fab-cef3904660bd”}
Eg: eyJ1c2VySWQiOiJiMDhmOZhZi0zNWRhLTQ4ZjItOOTA0NjYwYmQifQ
3. Signature (base 64 string)
It is used to verify to ensure that the message wasn’t changed along the way.
It is usually signed by using a secret key (HMAC algorithm).
- xN_h82PHVTA9vdoHrcZxH-x5
JWT Algorithm
Inputs:
header
{“typ”: “JWT”,
“alg”: “HS256”
}payload
{“userId”: “b08f86af-35da-48f2-8fab-cef3904660bd”
}secret
MySecret
Algorithm:
data = base64Encode( header ) + "." + base64Encode( payload )hashedData = hash( data, secret )
signature = base64encode( hashedData )
jwtToken = data + ”.” + signature
Example JWT token:
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiJiMDhmODZhZi0zNWRhLTQ4ZjItOOTA0NjYwYmQifQ.-xN_h82PHVTCMA9vdoHrcZxH-x5mb11y1537t3rGzcM
Refresh Tokens - JWT
A refresh token is a token (base-64 string of a random number) that is used to obtain a new JWT token every time, when it is expired.
