Token Based Authentication in ASP.NET Core

Question

I'm working with ASP.NET Core application. I'm trying to implement Token Based Authentication but can not figure out how to use new Security System for my case. I went through examples but they didn't help me much, they are using either cookie authentication or external authentication (GitHub, Microsoft, Twitter).

What my scenario is: angularjs application should request /token url passing username and password. WebApi should authorize user and return access_token which will be used by angularjs app in following requests.

I've found great article about implementing exactly what I need in current version of ASP.NET - Token Based Authentication using ASP.NET Web API 2, Owin, and Identity. But it is not obvious for me how to do the same thing in ASP.NET Core.

My question is: how to configure ASP.NET Core WebApi application to work with token based authentication?

Answer 1

Update for .Net Core 3.1:

David Fowler (architect for the ASP .NET Core team) has put together an incredibly simple set of task applications, including a simple application demonstrating JWT. I'll be incorporating his updates and simplistic style to this post soon.

Updated for .Net Core 2:

Previous versions of this answer used RSA; it's really not necessary if your same code that is generating the tokens is also verifying the tokens. However, if you're distributing the responsibility, you probably still want to do this using an instance of Microsoft.IdentityModel.Tokens.RsaSecurityKey.

1. Create a few constants that we'll be using later; here's what I did:

   const string TokenAudience = "Myself";
   const string TokenIssuer = "MyProject";
   

2. Add this to your Startup.cs's ConfigureServices. We'll use dependency injection later to access these settings. I'm assuming that your authenticationConfiguration is a ConfigurationSection or Configuration object such that you can have a different config for debug and production. Make sure you store your key securely! It can be any string.

   var keySecret = authenticationConfiguration["JwtSigningKey"];
   var symmetricKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(keySecret));
   
   services.AddTransient(_ => new JwtSignInHandler(symmetricKey));
   
   services.AddAuthentication(options =>
   {
       // This causes the default authentication scheme to be JWT.
       // Without this, the Authorization header is not checked and
       // you'll get no results. However, this also means that if
       // you're already using cookies in your app, they won't be 
       // checked by default.
       options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
   })
       .AddJwtBearer(options =>
       {
           options.TokenValidationParameters.ValidateIssuerSigningKey = true;
           options.TokenValidationParameters.IssuerSigningKey = symmetricKey;
           options.TokenValidationParameters.ValidAudience = JwtSignInHandler.TokenAudience;
           options.TokenValidationParameters.ValidIssuer = JwtSignInHandler.TokenIssuer;
       });
   

   I've seen other answers change other settings, such as ClockSkew; the defaults are set such that it should work for distributed environments whose clocks aren't exactly in sync. These are the only settings you need to change.

3. Set up Authentication. You should have this line before any middleware that requires your User info, such as app.UseMvc().

   app.UseAuthentication();
   

   Note that this will not cause your token to be emitted with the SignInManager or anything else. You will need to provide your own mechanism for outputting your JWT - see below.

4. You may want to specify an AuthorizationPolicy. This will allow you to specify controllers and actions that only allow Bearer tokens as authentication using [Authorize("Bearer")].

   services.AddAuthorization(auth =>
   {
       auth.AddPolicy("Bearer", new AuthorizationPolicyBuilder()
           .AddAuthenticationTypes(JwtBearerDefaults.AuthenticationType)
           .RequireAuthenticatedUser().Build());
   });
   

5. Here comes the tricky part: building the token.

   class JwtSignInHandler
   {
       public const string TokenAudience = "Myself";
       public const string TokenIssuer = "MyProject";
       private readonly SymmetricSecurityKey key;
   
       public JwtSignInHandler(SymmetricSecurityKey symmetricKey)
       {
           this.key = symmetricKey;
       }
   
       public string BuildJwt(ClaimsPrincipal principal)
       {
           var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
   
           var token = new JwtSecurityToken(
               issuer: TokenIssuer,
               audience: TokenAudience,
               claims: principal.Claims,
               expires: DateTime.Now.AddMinutes(20),
               signingCredentials: creds
           );
   
           return new JwtSecurityTokenHandler().WriteToken(token);
       }
   }
   

   Then, in your controller where you want your token, something like the following:

   [HttpPost]
   public string AnonymousSignIn([FromServices] JwtSignInHandler tokenFactory)
   {
       var principal = new System.Security.Claims.ClaimsPrincipal(new[]
       {
           new System.Security.Claims.ClaimsIdentity(new[]
           {
               new System.Security.Claims.Claim(System.Security.Claims.ClaimTypes.Name, "Demo User")
           })
       });
       return tokenFactory.BuildJwt(principal);
   }
   

   Here, I'm assuming you already have a principal. If you are using Identity, you can use IUserClaimsPrincipalFactory<> to transform your User into a ClaimsPrincipal.

6. To test it: Get a token, put it into the form at jwt.io. The instructions I provided above also allow you to use the secret from your config to validate the signature!

7. If you were rendering this in a partial view on your HTML page in combination with the bearer-only authentication in .Net 4.5, you can now use a ViewComponent to do the same. It's mostly the same as the Controller Action code above.