How deeply does ASP.NET Core in Action, 3e cover security scheme?

Defines schemes and requirements with Swashbuckle, but stops short of implementing authentication or authorization itself.

Security scheme

As explained in ASP.NET Core in Action, 3e

An OpenAPI security scheme is a declaration describing the authentication or authorization mechanism an HTTP API uses to protect operations.

An OpenAPI security scheme describes how an HTTP API authenticates or authorizes callers. Defining the scheme lets Swagger UI understand the protection mechanism and provide an authorization workflow for testing protected operations. section 25.5

Configure a scheme in two steps:

Define the mechanism, such as JWT bearer authentication, OAuth 2.0, OpenID Connect, or simple bearer authentication. section 25.5
Declare which endpoints use the scheme by adding a security requirement; applying it globally protects the whole API. section 25.5 section 25.7
Register an OpenApiSecurityScheme with Swashbuckle using AddSecurityDefinition(), then connect it with AddSecurityRequirement(). section 25.7

JWT bearer authentication in Swagger UI

After registering a bearer scheme, Swagger UI displays an Authorize button. Enter Bearer <token>, including the space and prefix; Swagger UI then saves the value and attaches it to subsequent requests in the Authorization header. section 25.5

How ASP.NET Core in Action, 3e covers it

liveBook manning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Secure APIsA security scheme is an OpenAPI configuration object that describes how an API request is authenticated and authorized, including credential type, placement, and scopes.
liveBook manning.com

The Design of Web APIs, Second EditionA security scheme is an API security mechanism definition that specifies how a consumer authenticates or authorizes access.

Compare how 3 books explain security scheme →

Related concepts

OpenAPI specificationused by · The OpenAPI Specification is a standard, machine-readable format for describing HTTP APIs, including their operations, inputs, outputs, data structures, and security requirements.
AddSecurityDefinitionimplemented by · AddSecurityDefinition is a Swashbuckle configuration method that registers a security scheme in an OpenAPI document.
breaking changeproduces · A breaking change is a modification to an interface, behavior, format, configuration, or contract that can prevent existing consumers from working correctly without changes.
scopehas part · Scope is a defined boundary specifying which entities, activities, resources, or conditions are included or governed in a particular context.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.