A security token is a credential presented in an HTTP request to convey verified identity information to a service. In an ASP.NET Core web API, tokens let an external identity provider manage user accounts while the API verifies the presented token. section 9.0 section 9.5
A token-based request follows this deployment path:
- Obtain authentication information through an identity provider such as Microsoft, Facebook, X, Auth0, or Okta. section 9.5
- Present the authentication token to the web API, usually in JSON Web Token (JWT) format. section 9.5
- Configure ASP.NET Core Identity to authenticate the token, then use authorization to control access to resources. section 9.0 section 9.5
Listing 9.15 Adding authentication and authorization
using Microsoft.AspNetCore.Authentication.JwtBearer; #1
builder.Services
.AddAuthentication(
JwtBearerDefaults.AuthenticationScheme) #2
.AddJwtBearer(); #3
var app = builder.Build(); #4
app.UseAuthentication(); #5
app.UseAuthorization(); #6
The configuration listing shows the essential ASP.NET Core pipeline: register JWT bearer authentication, build the application, and enable authentication before authorization. section 9.5
Configure the JWT bearer package with Microsoft.AspNetCore.Authentication.JwtBearer and ensure the configured scheme name matches the name used by authorization policies. ASP.NET Core schemes are distinct from HTTP authentication schemes, so the default Bearer name can be confusing. section 9.5
