Secure a .NET Core API with Bearer Authentication
Вставка
- Опубліковано 24 лют 2020
- In this step by step tutorial, I show you how to secure a .NET Core API with JWT Bearer Authentication, using Azure Active Directory as the Identity and Access Management Layer. I also show you how to write a “secure” API client to call and authenticate to the secured API endpoint.
We use the Microsoft.Identity.Client and Microsoft.AspNetCore.Authentication.JwtBearer packages amongst others.
Level: Intermediate
Code on GitHub: github.com/binarythistle/S03E...
Companion Article: dotnetplaybook.com/secure-a-n...
My Book: www.apress.com/gp/book/978148... - Наука та технологія
This is really great. I watched about a million videos and blogs and all are talking bits and pieces but couldn’t get a complete picture. This session gave me the whole picture and finally I am able to successfully build a system for my purpose. Great explanations. Really loved !!!!
After searching for many many hours on this topic, with no luck, I came across this video. You explained things clearly and made a lot of sense out of a confusing topic. Many thanks!!
Absolutely love the way you've explained all of this. I've been googling, watched other videos, tutorials, but nothing comes even close to what you've done here. Cannot thank you enough!
Would love for you to have a video on setting up an Azure WebApp running behind an Azure Front Door.
Great video! I'm a Sr Software Engineer (and manager) and found a lot of value in your video. Explained everything very well! Thanks for sharing!
Les Jacson σε ευχαριστούμε που υπάρχεις και μας δίνεις τόσες χρήσιμες συμβουλές!!
By far, the best tutorial on authentication. Thank you so much for this amazing tutorial.
Love your teaching style, very realistic and practical explanation. Thanks very much for making this video, you have demystified the Bearer Authentication a great deal
I'm going to keep the track on this season, great series of tutorials. Awsome job man, just awsome!
This is honestly the best .NET Core channel out there.
Thank you for explaining everything so clearly. I’ve been wanting to learn this for a long time. Since I started watching your videos it finally starts to make sense to me.
I dont mean to be offtopic but does someone know of a trick to log back into an Instagram account??
I stupidly lost my login password. I would appreciate any tricks you can offer me.
Les Jackson Sir. You save my lot of time. This is exactly what I have assigned to do. Superb!!!
The best video ever. Very well explained. What is missing is additional video in case you have swagger and you need to be able to test the API using AAD.
46:50 - music got me off the edge of my seat. The suspension was intense. Good video btw Les
Wow! How easily you have explained this complicated topic. Thanks for sharing this video.
I went through all the steps. Wounderfully explained! Keep up the hard work!
Thank you for putting this video together. This was especially relevant to something I am working on now and helped clarify a topic I was finding otherwise confusing when trying to read through the documentation. This video made is simple and straightforward. I've liked and subscribed, thank you again!
The Key things in your Videos are Very well explained, Practical usage and content oriented. Thank you so much for sharing your knowledge.
Hi Les,
thank you for your time and for sharing with us this video 🤞
[EDIT] - I forgot to say thank you for the video, extremely useful indeed!
17:25 Regarding your advice not to use appsettings.json for production use. I can appreciate that there is a need to be careful with this during development: the application is on your local machine along with the appsettings.json file which reveals security critical information. And you certainly wouldn't want to commit that to git or any other version control.
But once you've deployed to your production environment I feel like it's pretty safe to use appsettings.json. This is because the file is then on the server (be it Azure or somewhere else). Nobody else has access to it. And, if they do, it means they already have control of your server and therefore the security has already been compromised.
So on local machine: be careful with appsettings.json as it contains secure information.
On production (deployed to server): appsettings.json is OK.
Do you disagree?
It's October 2022 but for me it's still the best free material about a practical approach to learn authentication in .NET on the internet.
Great job. Congratulations and thank you!
Which channel best for paid version?
Awesome video, best teacher I have ever seen. Now I understand that whole bunch of Azure AD authentication via JWT Bearer Token in only 60 minutes. Thumbs up :-)
Thank you Les for your time. I was getting crazy until I saw your video with the resourceId "/.default" . I missed this part. Thank you.
Fantastic video - it's nice to follow a video through to the end and everything works! - I added the token to Postman and received a status 200 OK - looking forward to S3 E2 - thanks!
Thank you so much ... i loved it .. tried the same with Azure CLI since I wasn't having an access to Azure AD ... had a hard time with command line but now i can relate this stuff and search for precise Azure CLI commands ... Thanks again..
Ok, Les, you got me! I spent 2 days on your 3 hr. API video and transferred all that knowledge to my big project, works Great! Now adding the tokens. Lots of little bumps that force a good developer to understand their environments, like sometimes VS Code just gets lost and you have to restart it, all good. I love your stuff is CURRENT! 2017 is ancient times in technology;-) Enjoy the wine, wish I could deliver it personally and share a bottle to thank you. I think that would be a riot! Keep going and good luck! Oh yes, you should get yourself a green screen;-)
Watch out on minute 31. Azure added an extra field when creating a client secret. Make sure you copie the value and not the ID!!
Super video thank you so much.
You are a complete champion my friend, thanks!
That is a great video tutorial. Thanks for explaining everything in a detailed manner. Looking forward to seeing more videos from you.
Awesome step by step tutorial for authenticating .Net core API.
Thank you so much. I have taken up learning about securing an Api and this video was a great beginning.
Great video Les....I have been following your videos and found them extremly crisp and to the point without rushing in....It would be great if you did video on a production quality code for a small microservice app which would include Authentication / Authorization, Unit Testing etc. I know it might be a long video, but still it might be of great help...Thanks for your effort mate...
I found a lot of value in this video and the way it is explained is very impressive! Great video. Loved it
Super informational video. Followed it along in VSCode and although I had some issues in Azure (Granting API access was greyed out), it all worked and I can say I learned something very useful! Thanks for sharing!
First time seeing your videos... subscribed to your channel in the middle of watching the video. Great content and great delivery! I'll look through to see some of your other titles and look forward to what you do in the future. Thanks for the great work.
Hi Les,
Just wanted to say thank you for making this video. This what i need to figure it out the Authentication flow on Azure Ad.
Another great video from Les. I enjoy his teaching style and clear explanations. But I had to ditch this approach for securing the API I'm building because I cannot see how to set up user roles with this approach. I'm probably missing something simple, but it's throwing me for a loop. I would love to see a video showing how to set up user login and adding user role claims to the JWT token in Azure.
Watching your video like some rocking movies....Great mate!
Oh wow! Thanks Sandeep!
You are really fantastic Jackson..Thanks for this wonderful session
It's a very excellent video to explain such complicated topic and used the easiest way to demo how to achieve most of requests as we have to make sure them running in demon mode! thanks!
Excellent tutorial. Thanks a lot for demonstrating the practical approach.
Pretty neat explanation in layman terms and been searching for this kind of video...thank you so much.
Awesome! Cheers Lokesh!
Wow this is awesome.. it'd be really helpful if you could make a series on this topic with other types of clients too. Loved it Les. Thank you so much
Thank you so much man, you just tabledout a lot for most of us. Awesome video
Thank you Les. This is really very helpful video and you explained every step very well . I was very much confused regarding this azure active directory steps . Now understand very well. I would love to watch your more videos.Thank you again.
I am at 5:28, and I had no any info earlier, how this works, just what you show on your diagram, and scenario. Just for fun, from your diagram, I guess, the way it works is, that the JSON token is signed by one of Azure's private keys and the dot net core tool kit has the Azure's public key(s). This is how I'd implement this. I am looking for the end of the story, if I was right. Your videos are tremendously entertaining.
So beautifully explained and coded. Thank You for making such stuff
Greatest .net core tutorial out there!
Fantastic!!
This was a great tutorial coupled with lucid explanation.
Thanks for putting this together! It really helped clarify a lot of things for me.
Thank you so much Les!!. Excellent!1 Real world problem and you covered it perfect. Easy to understand.
Cool glad it helped you out! Cheers, Les
I like your other videos that have broken the parts of your video, it's easy to follow because I will know what topic you're talking to that point. It's hard to watch the video for more than 15 minutes.
Like your videos and style a lot! Will for sure buy your book in the near future! Thanks for the awesome material!
Great Video. It saves me. I see a lot of implementation but they are quite complicated and not complete.
Thank you so much for sharing your knowledge on this channel.
You made me a wise man :-)
Very Satisfying video! content cleared laid out! I enjoyed and learned thoroughly! Best tutorial better than Udemy and Plural sight content! Thank you, Subscribed!!
well explained, even if im not azur developer, the concepts are well explained. keep going with the good work
Wonderful session @Les
I immediately hit subscribe just by looking at the shelf in the background :) my kinda guy. Pluss, ofcourse, the content seems spot on for me (after 5 minutes in)
Great channel! Thank you Les! Keep up the good work
Superb Video Les!! Thank you soo much for explaining in detail.
Excellent and well explained one of the complicated topic, great work!!
Thanks!
Thank for nicely explaining the concept step by step, It was crystal clear :-).
I really enjoyed the video! Great job and VERY helpful.
Nice job, thanks for sharing your knowledge! From now on "Les is more for sure".
Thank you very much for your videos, I'm a student as an IT Dev, and your the best teacher I could ask for.
Greetings from Melbourne Maxime! Thanks for the lovely comment - I really appreciate it. Cheers, Les
Thank you very much for the amount of information that you made easy for us and that saved a lot of time, but frankly I was looking forward to seeing an illustrative example of a safe verification method for user authorization as full stack example :). We all very grateful for your efforts.
Best Regards
Jack, it was nice explanation,and cool to understand , thanks for the video.
Thank you so much for this tutorial, very well explained it helped me a lot.
Great job! very well explained, bit by bit..
Man that was cool - I just happened to be working on exactly these implementations, great clarity, fun music.
Glad it was helpful!
@@binarythistle 25:56 you missed the "/" between the values in authority....man i was so confused for an hour that why this is not working just for me
Thanks Les, great video as always :)
Wonderful video, very nicely explained, This was really helpful to me. Thank you.
Great Video. Thanks for creating such a wonder video which is easily understandable.
I just finish :-)!! thank you a lot for all the tips, I really enjoy and learn with your way of teaching
Hi Carolina! I'm so happy to hear that - great work! And thank you for your kind feedback. Take care, Les
Hie, for me Grant permission button at 36:30 time , the button is disabled its not working can you tell me the reason
Les(s) is More, actullay ! .. Thanks again for the great video !! :)
Very well done, sir! Thank you!
Great video again Les.
Loved this video! Good explanation, my teachers could learn a lot from u!
I did get an error at the end: "The remote certificate is invalid according to the validation procedure".
But I got it working by adding this code right above making the httpClient:
HttpClientHandler clientHandler = new HttpClientHandler();
clientHandler.ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => { return true; };
The HttpClient then uses another constructer like this:
var httpClient = new HttpClient(clientHandler);
Thanks a lot! Subbed immediately ;)
Thanks for sharing your solution.
Imho this should be only necessary for local testing.
BTW, thanks Les for your great work.
I tried that, it didn't work, now I get Unauthorized back even though I did get the token
Les thanks for the video. It was helpful.
Great job you just got a new sub
Covered a good amount in a video while making it simple
Thanks Les for amazing video !!!!!!!!
This is fantastic. Cheers mate!
My pleasure mate! Cheers, Les
great tutorial! man, thanks so much!
Thank you for nice explanation , it helped a lot...
Fantastic! As always.
Thank you so much for the crystal clear explanation. I was able to follow without any problem. Thanks once again for the great videos. Could you please do some videos on Microsoft Azure Services for Developers.
The best thank you for the great job that youre doing
This video is amazing. It really helped me a alot - thanks a bunch :)
Excellent video. Thanks
Greate video, thanks a lot, you have really good teaching skill
Great tutorial, thanks!
Congratulations with the great vídeo!
Thank you , you are too good!! could you please also make video for micro-services like this.
Thanks for such a great video
fantastic sir,huge fan of you
Thank you so much. You saved me.
I would be interested in third party sign in (Twitter, Google, etc) and associating that sign in with an application user. For example a user might have a profile in our application, and that profile should be associated with their third party sign in. Hope that makes sense. Keep up the great videos.
Yes, this, PLEASE
Yes, i agree - a user sign in tutorial would be fantastic :) Thanks for the helpful video
@Les Jackson, please post an video on OAuth
Yes, exactly we need this
Great video! Thanks man.
We are expecting more videos in FULL STACK (.net core , Entity FW and React/Blazor). I really like your Videos Thanks.
Good stuff again from Les