Authentication & Authorization with JWT Bearer

Securing APIs with signed tokens, claims, roles, and policies

« Model Validation & RFC 7807 ProblemDetails« Previous Configuration, appsettings.json & The Options Pattern »Next »

Securing cloud APIs requires robust authentication and authorization. ASP.NET Core offers first-class support for JWT Bearer token validation, claims-based access control, and policy-driven authorization.

Configuring JWT Bearer in Program.cs

AddAuthentication(JwtBearerDefaults.AuthenticationScheme): Tells the framework to look for Authorization: Bearer <token> headers.

TokenValidationParameters: Verifies token signature, valid issuer, audience, and expiration date.

[Authorize]: Restricts endpoint access strictly to authenticated requests presenting valid tokens.

[Authorize(Roles = "Admin")]: Restricts access based on user role claims.

JWT Bearer Configuration in Program.cs

Try It Yourself »

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Text;

var builder = WebApplication.CreateBuilder(args);
var jwtKey = builder.Configuration["Jwt:Key"] ?? "super-secret-security-key-32-bytes!!";

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = builder.Configuration["Jwt:Issuer"],
            ValidAudience = builder.Configuration["Jwt:Audience"],
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtKey))
        };
    });

builder.Services.AddAuthorization();

var app = builder.Build();

app.UseAuthentication(); // Must precede UseAuthorization
app.UseAuthorization();

The authentication middleware validates cryptographic signatures before routing requests to endpoints.

Google AdSense Slot (inContentBanner)

Set your Publisher ID in src/config/ads.ts to display live ads.

Test Yourself With Exercise

+15 XP

Which method call MUST precede app.UseAuthorization() in the middleware pipeline?

« Previous: Model Validation & RFC 7807 ProblemDetails Next: Configuration, appsettings.json & The Options Pattern »