A JSON Web Token (JWT) is a compact, claims-based token used to transmit information securely between parties. In an ASP.NET Core API, it supports authentication by allowing a successful login to return a token for later requests. section 9.0 section 9.2.6
The practical workflow places JWT creation in an AccountController. Register creates an Identity user; Login verifies the submitted username and password, creates signing credentials from a configured signing key, and returns a JWT. section 9.2.6
A JWT-based account flow includes these implementation decisions:
- Inject UserManager for creating users and SignInManager for login-related identity work, together with IConfiguration for reading JWT settings. section 9.2.6
- Expose separate POST endpoints, /Account/Register and /Account/Login, using action-based routing in AccountController. section 9.2.6
- Create signing credentials with the configured JWT:SigningKey and the HmacSha256 security algorithm before producing the login response. section 9.2.6
- Verify the result through SwaggerUI by registering a user, correcting validation or password-policy errors, and submitting valid login credentials. section 9.2.6
Logging in with a JWT
Submit a LoginDTO containing a username and password to /Account/Login. After the identity lookup and password check succeed, the endpoint returns a JWT response that can be used by the API's authentication flow. section 9.2.6
Listing 9.3 AccountController boilerplate
using Microsoft.AspNetCore.Mvc;
using Microsoft.EntityFrameworkCore;
using MyBGList.DTO;
using MyBGList.Models;
using System.Linq.Expressions;
using System.Linq.Dynamic.Core;
using System.ComponentModel.DataAnnotations;
using MyBGList.Attributes;
using System.Diagnostics;
using Microsoft.AspNetCore.Identity; #1
using Microsoft.IdentityModel.Tokens; #1
using System.IdentityModel.Tokens.Jwt; #1
using System.Security.Claims; #1
namespace MyBGList.Controllers
{
[Route("[controller]/[action]")] #2
[ApiController]
public class AccountController : ControllerBase
{
private readonly ApplicationDbContext _context;
private readonly ILogger<DomainsController> _logger;
private readonly IConfiguration _configuration;
private readonly UserManager<ApiUser> _userManager; #3
private readonly SignInManager<ApiUser> _signInManager; #4
public AccountController(
ApplicationDbContext context,
ILogger<DomainsController> logger,
IConfiguration configuration,
UserManager<ApiUser> userManager, #3
SignInManager<ApiUser> signInManager) #4
{
_context = context;
_logger = logger;
_configuration = configuration;
_userManager = userManager; #3
_signInManager = signInManager; #4
}
[HttpPost]
[ResponseCache(CacheProfileName = "NoCache")]
public async Task<ActionResult> Register() #5
{
throw new NotImplementedException();
}
[HttpPost]
[ResponseCache(CacheProfileName = "NoCache")]
public async Task<ActionResult> Login() #6
{
throw new NotImplementedException();
}
}
}
Inspect the AccountController boilerplate to see the namespaces, dependency-injected services, route declaration, and JWT-related types used by the implementation. section 9.2.6
