Securing a REST API with JWT Authentication in .NET Core

In today's digital landscape, securing web applications is paramount. As developers, we often leverage RESTful APIs to enable communication between the client and server. However, exposing APIs without proper authentication can lead to significant security vulnerabilities. One effective way to secure a REST API is by using JSON Web Tokens (JWT). In this article, we'll explore how to implement JWT authentication in a .NET Core application, providing you with actionable insights and step-by-step instructions.

What is JWT Authentication?

JWT, or JSON Web Token, is an open standard that defines a compact way to securely transmit information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.

Key Components of JWT

A JWT consists of three parts:

1. Header: Contains metadata about the token, including the type of token and the signing algorithm used.
2. Payload: Contains the claims, which are the statements about an entity (usually the user) and additional data.
3. Signature: Created by taking the encoded header, the encoded payload, a secret, and signing it using the specified algorithm.

Use Cases for JWT

• Authentication: Verifying user identity after they log in.
• Authorization: Granting access to resources based on user roles.
• Information Exchange: Transmitting information securely between parties.

Setting Up a .NET Core REST API

Before diving into JWT authentication, let's set up a simple REST API using .NET Core.

Step 1: Create a New .NET Core Project

Open your terminal and run the following command:

dotnet new webapi -n JwtAuthDemo
cd JwtAuthDemo

This creates a new Web API project named JwtAuthDemo.

Step 2: Install Required Packages

To implement JWT authentication, you need to install the following NuGet packages:

dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer
dotnet add package System.IdentityModel.Tokens.Jwt

Step 3: Configure JWT Authentication

Open Startup.cs and modify the ConfigureServices method to add JWT authentication:

public void ConfigureServices(IServiceCollection services)
{
    services.AddControllers();

    // JWT Authentication
    var key = Encoding.ASCII.GetBytes("Your_Secret_Key_Here");
    services.AddAuthentication(x =>
    {
        x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
        x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    })
    .AddJwtBearer(x =>
    {
        x.RequireHttpsMetadata = true;
        x.SaveToken = true;
        x.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(key),
            ValidateIssuer = false,
            ValidateAudience = false
        };
    });
}

Step 4: Add a Login Endpoint

Next, create a controller for user authentication. Create a new file named AuthController.cs in the Controllers folder:

using Microsoft.AspNetCore.Mvc;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;

[Route("api/[controller]")]
[ApiController]
public class AuthController : ControllerBase
{
    [HttpPost("login")]
    public IActionResult Login([FromBody] UserLogin userLogin)
    {
        // Validate the user credentials (this is a mock example)
        if (userLogin.Username == "test" && userLogin.Password == "password")
        {
            var tokenHandler = new JwtSecurityTokenHandler();
            var key = Encoding.ASCII.GetBytes("Your_Secret_Key_Here");
            var tokenDescriptor = new SecurityTokenDescriptor
            {
                Subject = new ClaimsIdentity(new Claim[]
                {
                    new Claim(ClaimTypes.Name, userLogin.Username)
                }),
                Expires = DateTime.UtcNow.AddHours(1),
                SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
            };
            var token = tokenHandler.CreateToken(tokenDescriptor);
            return Ok(new { Token = tokenHandler.WriteToken(token) });
        }
        return Unauthorized();
    }
}

Step 5: Create a User Login Model

Create a new class named UserLogin.cs in the Models folder:

public class UserLogin
{
    public string Username { get; set; }
    public string Password { get; set; }
}

Step 6: Protecting Routes with JWT

To secure your API endpoints, you can use the [Authorize] attribute. Create a new controller named ValuesController.cs:

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

[Route("api/[controller]")]
[ApiController]
[Authorize]
public class ValuesController : ControllerBase
{
    [HttpGet]
    public IActionResult GetValues()
    {
        return Ok(new string[] { "value1", "value2" });
    }
}

Testing Your API

Step 1: Run Your Application

You can run your application using the following command:

dotnet run

Step 2: Use Postman to Test

1. Login: Send a POST request to http://localhost:5000/api/auth/login with a JSON body: json { "username": "test", "password": "password" }

2. Access Protected Route: Use the token you receive in the login response to access the protected endpoint:

3. Set the Authorization header in Postman: Authorization: Bearer <your_token>

4. Send a GET Request: Access http://localhost:5000/api/values.

Conclusion

Securing a REST API with JWT authentication in .NET Core is an effective way to ensure that only authorized users can access your resources. By following the steps outlined in this article, you can easily implement JWT authentication in your applications. Remember to keep your secret keys safe and consider additional security measures, such as HTTPS and regular token expiration. With these practices in place, you can build robust and secure APIs that meet modern security standards. Happy coding!