Bearer authentication

As explained in ASP.NET Core in Action, 3e

A bearer token is a credential string that conveys authentication information to a service, typically relying on a signature to detect tampering rather than requiring possession-based proof.

Bearer authentication lets a client call a protected API by sending a token. A bearer token is a string containing authentication details about a user or app. Whoever has the token can use it; they do not have to prove they were its original recipient. Treat it like a password: keep it out of URL query strings, which may be logged. section 25.1.2 section 25.2

A central identity provider can sign users in and return tokens to a browser or mobile app. The client then passes a token to an API, so the API does not need to handle sign-in or manage users directly. JSON Web Tokens (JWTs) are a common bearer-token format. A JWT is typically signed to detect tampering, but it is not encrypted by default: its contents can be read. section 25.1.2 section 25.7

Figure 25.8 When an API request contains a bearer token, the token is validated and deserialized by the authentication middleware. The middleware creates a ClaimsPrincipal from the token, optionally transforming it with additional claims, and sets the HttpContext.User property. Subsequent middleware sees the request as authenticated.

Follow a token through ASP.NET Core authentication: middleware validates and deserializes it, creates a ClaimsPrincipal, and sets HttpContext.User for the rest of the request. section 25.2

To try JWT bearer authentication in an ASP.NET Core minimal API:

• Add the Microsoft.AspNetCore.Authentication.JwtBearer package and register authentication with AddAuthentication().AddJwtBearer(). section 25.7
• Run dotnet user-jwts create to generate a token for local testing. Send it in the Authorization header as Bearer <token>. section 25.7
• Protect minimal API endpoints with RequireAuthorization() or an [Authorize] attribute. section 25.7

Testing with Swagger UI

Define a bearer security scheme and its requirements in the OpenAPI document. Swagger UI then displays an Authorize button. Enter Bearer <token>, including the prefix and space; Swagger UI attaches that value to subsequent requests in the Authorization header. section 25.5

Browser-based apps need particular care because storing bearer tokens in the browser exposes them to risk. A Backend for Frontend approach instead keeps tokens in an ASP.NET Core backend and uses an authentication cookie between the browser and that backend. section 25.2

How ASP.NET Core in Action, 3e covers it

How deep it goes

Defines token possession and follows JWT validation through middleware, then gives practical setup and testing steps.

Examples

Tests a minimal API with a dotnet user-jwts token sent through Swagger UI.

What it assumes

Introduces bearer tokens from their definition while contrasting API authentication with cookies in traditional web apps.

What you can do after

Apply it via AddJwtBearer and dotnet user-jwts to authenticate and test ASP.NET Core minimal API requests.

How it connects

Links bearer authentication to identity providers, JWTs, claims, authorization policies, and cookie authentication.

liveBookmanning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Building Web APIs with ASP.NET CoreToken-based authentication verifies a caller by requiring a token that represents the caller's authenticated identity or claims.
• 

  liveBookmanning.com
  Spring in Action, Sixth EditionAn access token presented in an HTTP Authorization header using the Bearer authentication scheme.
• 

  liveBookmanning.com
  .NET in Action, Second EditionBearer authentication is an HTTP authentication method in which possession of a bearer token grants access to a protected resource.
• 

  liveBookmanning.com
  Secure APIsA bearer token is an access credential whose possession is sufficient to present it for authorization without proving possession of a separate key.

Compare how 5 books explain bearer authentication →

Related concepts

• authenticationkind of · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• cookiealternative to · An HTTP cookie is a small piece of data that a server asks a user agent to store and return with subsequent requests within its scope.
• HTTP Authorization headeruses · The HTTP Authorization header is a request header that carries credentials or other authentication or authorization information for accessing a resource.
• API keyuses · An API key is a credential used to identify or authorize a client accessing an application programming interface.
• basic authenticationcontrasts with · HTTP Basic authentication is an HTTP scheme that transmits a username and password in a Base64-encoded Authorization header, requiring external protection such as TLS for confidentiality.
• openid connectcontrasts with · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.