12.5 Lab - Securing API With JWT

Use Int32.Parse() to parse the id parameter from type string to type int.

The 204 status code indicates that the request was successful and that there is no additional content to send in the request body.

Configure the appsettings.json file.

// Configures the appsettings config file.
var appSettingsSection = Configuration.GetSection("AppSettings");
services.Configure<AppSettings>(appSettingsSection);

Add authentication settings to the JWT signing key.

// Adds authentication settings to the JWT signing key.
var appSettings = appSettingsSection.Get<AppSettings>();
var key = Encoding.ASCII.GetBytes(appSettings.JwtSigningKey);
services.AddAuthentication(x =>
{
x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(x =>
{
x.RequireHttpsMetadata = false;
x.SaveToken = true;
x.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey = new SymmetricSecurityKey(key),
ValidateIssuer = false,
ValidateAudience = false
};
});

Install the AutoMapper.Extensions.Microsoft.DependencyInjection package.

Add the below code after adding authentication to the JWT signing key in the ConfigureServices method, to map the appsettings.json file to the AppSettings class.

// Maps the appsettings and start up to the application to allow the use of the appsettings class.
services.AddAutoMapper(typeof(Startup));
services.AddScoped<AppSettings>(serviceProvider => appSettings);

[Route("api/[controller]")]
[ApiController, AllowAnonymous]

The ApiController attribute enables certain API specific behaviors, such as automatic HTTP 400 responses and attribute routing requirements.

The AllowAnonymous attribute allows access to non-authenticated users.

Set the appSettings parameter to the _appSettings field.

Set the appSettings parameter's Users property to the _users field.

Create a method named GetToken that returns type IActionResult and accepts two parameters, both of type string, one named username and the other named password.

Add a HttpPost attribute, with a route of "token" at the method level.

Get the user from the AuthenticationController's list of users whose username and password properties matches the passed in parameters.

User authenticateUser = _users.FirstOrDefault(user => user.Password == password && user.Username.ToLower() == username.ToLower());

Authenticate the found user by verifying that they exist. If the found user is equal to null, return a call to Unauthorized.

if (authenticateUser == null)
{
// If they do not exist return unauthorized access.
return Unauthorized();
}

The Unauthorzied method is a built in method from the ApiController class that the ApiController attribute provides access to, and creates a 401 unauthorized result.

Create a new instance of the JWTSecurityTokenHandler class which will be used for creating and validating a JWT token.

var tokenHandler = new JwtSecurityTokenHandler();

Add the below code after creating a new token handler to encode the JwtSigningKey into a series of bytes, storing the result in a key variable.

var key = Encoding.ASCII.GetBytes(_appSettings.JwtSigningKey);

Create a new SecurityTokenDescriptor to act as a placeholder for all attributes of the JWT.

var tokenDescriptor = new SecurityTokenDescriptor
{
Subject = new ClaimsIdentity(new Claim[]
{
new Claim(ClaimTypes.Name, username)
}),
Expires = DateTime.UtcNow.AddDays(7),
SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
};

A claim holds the facts about the user that holds the token, in this instance the user would be "claiming" to be an admin.

The Expires property sets the length of time that the token is valid for, in this instance the token will expire in 7 days.

The SigningCredentials class is used to define the security key and the algorithm used to generate the digital signature.

To create the token that will be generated for the user, call the tokenHandler's CreateToken method, passing in the tokenDescriptor variable. Set the result to variable named token.

var token = tokenHandler.CreateToken(tokenDescriptor);

Return the generated token.

return Content(tokenHandler.WriteToken(token));

The POST/token call should look like the below image.