liveBook · Manning

Self-contained token

As explained in ASP.NET Core in Action, 3e

A self-contained token carries the metadata and claims needed for an API or other resource server to validate it without contacting the issuer.

A self-contained token carries the metadata, claims, and signature needed for an API to validate a bearer access token offline. JWT is the most common format. section 25.2

Its main tradeoffs are:

  • Offline validation avoids an issuer round trip, but the token cannot normally be revoked and therefore usually has a limited lifetime. section 25.2
  • Including many claims can make requests larger. section 25.2
  • A reference token offers revocation and keeps claims away from the client, but requires an issuer request for every API request. section 25.2

JWT authentication flow

An API receives a bearer JWT, verifies its signature, and lets authentication middleware validate and deserialize it into a ClaimsPrincipal assigned to HttpContext.User.

How ASP.NET Core in Action, 3e covers it

How deep it goes
Explains metadata, claims, signatures, offline validation, revocation limits, lifetimes, and request-size tradeoffs.
Examples
Uses JWTs decoded into header, payload, and signature, then processed by API authentication middleware.
What it assumes
Assumes familiarity with bearer authentication and distinguishes access tokens from OpenID Connect identity tokens.
What you can do after
Evaluate self-contained and reference tokens by validation path, revocation, privacy, lifetime, and request-size costs.
How it connects
Connects bearer tokens, access tokens, JWTs, reference tokens, authentication middleware, and ClaimsPrincipal.
Cover of ASP.NET Core in Action, 3e
liveBookmanning.com
Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.