Secure a .NET Core API with Bearer Authentication
Вставка
- Опубліковано 1 лют 2025
- In this step by step tutorial, I show you how to secure a .NET Core API with JWT Bearer Authentication, using Azure Active Directory as the Identity and Access Management Layer. I also show you how to write a “secure” API client to call and authenticate to the secured API endpoint.
We use the Microsoft.Identity.Client and Microsoft.AspNetCore.Authentication.JwtBearer packages amongst others.
Level: Intermediate
Code on GitHub: github.com/bin...
Companion Article: dotnetplaybook...
My Book: www.apress.com...
It's October 2022 but for me it's still the best free material about a practical approach to learn authentication in .NET on the internet.
Great job. Congratulations and thank you!
Which channel best for paid version?
Les Jacson σε ευχαριστούμε που υπάρχεις και μας δίνεις τόσες χρήσιμες συμβουλές!!
This is honestly the best .NET Core channel out there.
[EDIT] - I forgot to say thank you for the video, extremely useful indeed!
17:25 Regarding your advice not to use appsettings.json for production use. I can appreciate that there is a need to be careful with this during development: the application is on your local machine along with the appsettings.json file which reveals security critical information. And you certainly wouldn't want to commit that to git or any other version control.
But once you've deployed to your production environment I feel like it's pretty safe to use appsettings.json. This is because the file is then on the server (be it Azure or somewhere else). Nobody else has access to it. And, if they do, it means they already have control of your server and therefore the security has already been compromised.
So on local machine: be careful with appsettings.json as it contains secure information.
On production (deployed to server): appsettings.json is OK.
Do you disagree?
Watch out on minute 31. Azure added an extra field when creating a client secret. Make sure you copie the value and not the ID!!
Super video thank you so much.
Ok, Les, you got me! I spent 2 days on your 3 hr. API video and transferred all that knowledge to my big project, works Great! Now adding the tokens. Lots of little bumps that force a good developer to understand their environments, like sometimes VS Code just gets lost and you have to restart it, all good. I love your stuff is CURRENT! 2017 is ancient times in technology;-) Enjoy the wine, wish I could deliver it personally and share a bottle to thank you. I think that would be a riot! Keep going and good luck! Oh yes, you should get yourself a green screen;-)
The best video ever. Very well explained. What is missing is additional video in case you have swagger and you need to be able to test the API using AAD.
Absolutely love the way you've explained all of this. I've been googling, watched other videos, tutorials, but nothing comes even close to what you've done here. Cannot thank you enough!
Would love for you to have a video on setting up an Azure WebApp running behind an Azure Front Door.
Thank you for explaining everything so clearly. I’ve been wanting to learn this for a long time. Since I started watching your videos it finally starts to make sense to me.
I dont mean to be offtopic but does someone know of a trick to log back into an Instagram account??
I stupidly lost my login password. I would appreciate any tricks you can offer me.
46:50 - music got me off the edge of my seat. The suspension was intense. Good video btw Les
After searching for many many hours on this topic, with no luck, I came across this video. You explained things clearly and made a lot of sense out of a confusing topic. Many thanks!!
Loved this video! Good explanation, my teachers could learn a lot from u!
I did get an error at the end: "The remote certificate is invalid according to the validation procedure".
But I got it working by adding this code right above making the httpClient:
HttpClientHandler clientHandler = new HttpClientHandler();
clientHandler.ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => { return true; };
The HttpClient then uses another constructer like this:
var httpClient = new HttpClient(clientHandler);
Thanks a lot! Subbed immediately ;)
Thanks for sharing your solution.
Imho this should be only necessary for local testing.
BTW, thanks Les for your great work.
I tried that, it didn't work, now I get Unauthorized back even though I did get the token
Love your teaching style, very realistic and practical explanation. Thanks very much for making this video, you have demystified the Bearer Authentication a great deal
I am at 5:28, and I had no any info earlier, how this works, just what you show on your diagram, and scenario. Just for fun, from your diagram, I guess, the way it works is, that the JSON token is signed by one of Azure's private keys and the dot net core tool kit has the Azure's public key(s). This is how I'd implement this. I am looking for the end of the story, if I was right. Your videos are tremendously entertaining.
Great video! I'm a Sr Software Engineer (and manager) and found a lot of value in your video. Explained everything very well! Thanks for sharing!
Les Jackson Sir. You save my lot of time. This is exactly what I have assigned to do. Superb!!!
Thank you Les for your time. I was getting crazy until I saw your video with the resourceId "/.default" . I missed this part. Thank you.
The Key things in your Videos are Very well explained, Practical usage and content oriented. Thank you so much for sharing your knowledge.
I found a lot of value in this video and the way it is explained is very impressive! Great video. Loved it
Awesome video, best teacher I have ever seen. Now I understand that whole bunch of Azure AD authentication via JWT Bearer Token in only 60 minutes. Thumbs up :-)
I'm going to keep the track on this season, great series of tutorials. Awsome job man, just awsome!
Awesome step by step tutorial for authenticating .Net core API.
This is really great. I watched about a million videos and blogs and all are talking bits and pieces but couldn’t get a complete picture. This session gave me the whole picture and finally I am able to successfully build a system for my purpose. Great explanations. Really loved !!!!
Thank you so much man, you just tabledout a lot for most of us. Awesome video
Wow! How easily you have explained this complicated topic. Thanks for sharing this video.
Fantastic video - it's nice to follow a video through to the end and everything works! - I added the token to Postman and received a status 200 OK - looking forward to S3 E2 - thanks!
By far, the best tutorial on authentication. Thank you so much for this amazing tutorial.
First time seeing your videos... subscribed to your channel in the middle of watching the video. Great content and great delivery! I'll look through to see some of your other titles and look forward to what you do in the future. Thanks for the great work.
Thank you for putting this video together. This was especially relevant to something I am working on now and helped clarify a topic I was finding otherwise confusing when trying to read through the documentation. This video made is simple and straightforward. I've liked and subscribed, thank you again!
Watching your video like some rocking movies....Great mate!
Oh wow! Thanks Sandeep!
Thank you very much for your videos, I'm a student as an IT Dev, and your the best teacher I could ask for.
Greetings from Melbourne Maxime! Thanks for the lovely comment - I really appreciate it. Cheers, Les
well explained, even if im not azur developer, the concepts are well explained. keep going with the good work
Great video Les....I have been following your videos and found them extremly crisp and to the point without rushing in....It would be great if you did video on a production quality code for a small microservice app which would include Authentication / Authorization, Unit Testing etc. I know it might be a long video, but still it might be of great help...Thanks for your effort mate...
That is a great video tutorial. Thanks for explaining everything in a detailed manner. Looking forward to seeing more videos from you.
Pretty neat explanation in layman terms and been searching for this kind of video...thank you so much.
Awesome! Cheers Lokesh!
Another great video from Les. I enjoy his teaching style and clear explanations. But I had to ditch this approach for securing the API I'm building because I cannot see how to set up user roles with this approach. I'm probably missing something simple, but it's throwing me for a loop. I would love to see a video showing how to set up user login and adding user role claims to the JWT token in Azure.
I would be interested in third party sign in (Twitter, Google, etc) and associating that sign in with an application user. For example a user might have a profile in our application, and that profile should be associated with their third party sign in. Hope that makes sense. Keep up the great videos.
Yes, this, PLEASE
Yes, i agree - a user sign in tutorial would be fantastic :) Thanks for the helpful video
@Les Jackson, please post an video on OAuth
Yes, exactly we need this
Super informational video. Followed it along in VSCode and although I had some issues in Azure (Granting API access was greyed out), it all worked and I can say I learned something very useful! Thanks for sharing!
Thank you so much. I have taken up learning about securing an Api and this video was a great beginning.
Thank you Les. This is really very helpful video and you explained every step very well . I was very much confused regarding this azure active directory steps . Now understand very well. I would love to watch your more videos.Thank you again.
It's a very excellent video to explain such complicated topic and used the easiest way to demo how to achieve most of requests as we have to make sure them running in demon mode! thanks!
I went through all the steps. Wounderfully explained! Keep up the hard work!
Hi Les,
Just wanted to say thank you for making this video. This what i need to figure it out the Authentication flow on Azure Ad.
I like your other videos that have broken the parts of your video, it's easy to follow because I will know what topic you're talking to that point. It's hard to watch the video for more than 15 minutes.
I immediately hit subscribe just by looking at the shelf in the background :) my kinda guy. Pluss, ofcourse, the content seems spot on for me (after 5 minutes in)
Nice job, thanks for sharing your knowledge! From now on "Les is more for sure".
Wow this is awesome.. it'd be really helpful if you could make a series on this topic with other types of clients too. Loved it Les. Thank you so much
Wonderful video, very nicely explained, This was really helpful to me. Thank you.
Excellent tutorial. Thanks a lot for demonstrating the practical approach.
Thank you so much for the crystal clear explanation. I was able to follow without any problem. Thanks once again for the great videos. Could you please do some videos on Microsoft Azure Services for Developers.
Thank you so much ... i loved it .. tried the same with Azure CLI since I wasn't having an access to Azure AD ... had a hard time with command line but now i can relate this stuff and search for precise Azure CLI commands ... Thanks again..
Thanks for putting this together! It really helped clarify a lot of things for me.
Very Satisfying video! content cleared laid out! I enjoyed and learned thoroughly! Best tutorial better than Udemy and Plural sight content! Thank you, Subscribed!!
Like your videos and style a lot! Will for sure buy your book in the near future! Thanks for the awesome material!
Excellent and well explained one of the complicated topic, great work!!
Thanks!
Great Video. Thanks for creating such a wonder video which is easily understandable.
Great video, best one I've seen so far. Thanks so much!! But can you explain what is the id property in the appRoles section, In your example it was "id": "6543b78e-0f43-4fe9-bf84-0ce8b74c06a3"
You are a complete champion my friend, thanks!
Man that was cool - I just happened to be working on exactly these implementations, great clarity, fun music.
Glad it was helpful!
@@binarythistle 25:56 you missed the "/" between the values in authority....man i was so confused for an hour that why this is not working just for me
Fantastic!!
This was a great tutorial coupled with lucid explanation.
Thank you so much Les!!. Excellent!1 Real world problem and you covered it perfect. Easy to understand.
Cool glad it helped you out! Cheers, Les
Superb Video Les!! Thank you soo much for explaining in detail.
Hi Les,
thank you for your time and for sharing with us this video 🤞
Thank you very much for the amount of information that you made easy for us and that saved a lot of time, but frankly I was looking forward to seeing an illustrative example of a safe verification method for user authorization as full stack example :). We all very grateful for your efforts.
Best Regards
Thank you, Les, I would like to express my gratitude for your excellent video, and god bless you.
So beautifully explained and coded. Thank You for making such stuff
You are really fantastic Jackson..Thanks for this wonderful session
Wonderful session @Les
I really enjoyed the video! Great job and VERY helpful.
Great set of tutorials. The one improvement I would recommend is ditching that music at the start :)
I find the music at the beginning actually pretty cool
Greatest .net core tutorial out there!
This is very informative video. thanks for sharing your experience and knowledge. I wanted to understand this sing long time Azure AD, and api auth together!!
Can you create a video on best practices for how to store secure data like keys and passwords in vaults and access them in application ?
Great Video. It saves me. I see a lot of implementation but they are quite complicated and not complete.
Hi Les, truly interesting, informative and well composed video, that reveals the underlying mechanism of Azure AD being, kind of a registrar of resources. Just one question. For iOS and Android applications also do we need to register the corresponding client apps ?
I just finish :-)!! thank you a lot for all the tips, I really enjoy and learn with your way of teaching
Hi Carolina! I'm so happy to hear that - great work! And thank you for your kind feedback. Take care, Les
Hie, for me Grant permission button at 36:30 time , the button is disabled its not working can you tell me the reason
Thank for nicely explaining the concept step by step, It was crystal clear :-).
Jack, it was nice explanation,and cool to understand , thanks for the video.
Great video. I am however confused as to wether this should be done in code or through something like azure api management?
Great Video! Can you plase tell me in which Video you have explained where to store the Credentials for the Production Environment? Thank you!
Very good tutorial! Could you make one with a SPA app consuming this API? Thanks from Brazil!
Agree to this.. 👍☝️ plss.. sir.
Great channel! Thank you Les! Keep up the good work
Thank you so much for sharing your knowledge on this channel.
You made me a wise man :-)
fantastic sir,huge fan of you
Hi Les, thanks for the informative video. I'd be interested in the same kind of video showing how to set up a client app that authenticates with the API using a user name and password.
Great job! very well explained, bit by bit..
Thank you for this amazing tutorial. I saw lot of tutorial on this topic but I can say without any second thought that this is d best. If you can make a video to use Google, Facebook or Twitter to authenticate our Web API it will be more helpful.
Greate video, thanks a lot, you have really good teaching skill
Thank u for good lesson. But, I have a question? All these are by using OAuth 2.0?
Great job you just got a new sub
Covered a good amount in a video while making it simple
Thanks Les fantastic video; Question: what is the link to manage "sensitive information" for production environments?
Thank you so much for this tutorial, very well explained it helped me a lot.
Nice one Les, Only thing want to know why we created 2 resources
Fantastic video, thanks a lot. I would like to learn about a non Microsoft security (identity) alternative, some videos to recommended to me?
As Always Awesome tutorial.
Quick question on the Token.
I wan to use this for a mobile application project which use the API to do the processing like fetching the data, updating certain fields etc. If I am not mistaken, every time I try to call the API i need to send the token with the call correct?
And I noticed that the validity of the token is 1 hour. Is there a way to increase the expiry time of the token (May be let's say 1 day or a month etc) so I no need to generate the token over and over again?
Les thanks for the video. It was helpful.
thank you for the tutorial but do we have to use Azure Active Directory, can't we use the local Microsoft Identity management?
Any chance of doing a video on user secrets or correctly storing sensitive information in the appsettings.json file?
Did you find any solution?
Great tutorial, I would also be interested in hand-rolling my own authentication server for supplying the token. Is there some resources that you would recommend for the same.
Great video, really good explanation. One thing is annoying tho, the background static sound
You mentioned using user secrets or key vault and I understand why. It seems you leaned towards user secrets? Can you tell me why? Do you have any good resources for that?