Introduction

Token-based security is commonly used in today’s security architecture. There are several token-based security techniques. JWT is one of the more popular techniques. JWT token is used to identify authorized users.

What is the JWT WEB TOKEN?

JWT is useful for

JWT Token Structure

A JWT token contains a Header, a Payload, and a Signature.

How To Use JWT Authentication With WEB API

Header

Header contains the algorithms like RSA or HMACSHA256 and the information of the type of Token.

  1. {
  2. “alg” : ”” Algorithm like RSA or HMACSHA256
  3. “Type” : ”” Type of JWT Token
  4. }

Payload

Payload contains the information of rows, i.e., user credentials.

  1. {
  2. “loginname” : ”Gajendra”
  3. “password”:”123#”
  4. }
  • It contains claims.
  • Claims are user details or additional information

Signature

{ base64urlencoded (header) +”.”+ base64urlencoded (payload) +”.”+ secret }

  • Combine base64 encoded Header , base64 encoded Payload with secret
  • These provide more security.
A combination of all headers, payload and signatures converts into JWT TOKEN.

How Does JWT Work?

Step 1
Client logs in with his/her credentials.
How To Use JWT Authentication With WEB API
Step 2
Server generates a Jwt token at server side.
How To Use JWT Authentication With WEB API
Step 3
After token generation, the server returns a token in response.
How To Use JWT Authentication With WEB API
Step 4
Now, the client sends a copy of the token to validate the token.

How To Use JWT Authentication With WEB API
Step 5
The server checks JWT token to see if it's valid or not.
How To Use JWT Authentication With WEB API
Step 6
After the token is validated, the server sends a status message to the client.
How To Use JWT Authentication With WEB API

Working With JWT

Step 1
User Login - User normally logs in with his/her credentials such as User Name and Password.
  1. [Route("UserLogin")]
  2. [HttpPost]
  3. public ResponseVM UserLogin(LoginVM objVM) {
  4. var objlst = wmsEN.Usp_Login(objVM.UserName, UtilityVM.Encryptdata(objVM.Passward), "").ToList < Usp_Login_Result > ().FirstOrDefault();
  5. if (objlst.Status == -1) return new ResponseVM {
  6. Status = "Invalid", Message = "Invalid User."
  7. };
  8. if (objlst.Status == 0) return new ResponseVM {
  9. Status = "Inactive", Message = "User Inactive."
  10. };
  11. else return new ResponseVM {
  12. Status = "Success", Message = TokenManager.GenerateToken(objVM.UserName)
  13. };
  14. }
Step 2
Server generates a JWT token.

Jwt secret string

  1. private static string Secret = "ERMN05OPLoDvbTTa/QkqLNMI7cPLguaRyHzyg7n5qNBVjQmtBhz4SzYh4NBVCXi3KJHlSXKP+oi2+bXr6CUYTR==";

Create Jwt Token

First you have to add Microsoft.IdentityModel.Tokens and System.IdentityModel.Tokens.Jwt references from NuGet Package Manager.

  1. public static string GenerateToken(string username) {
  2. byte[] key = Convert.FromBase64String(Secret);
  3. SymmetricSecurityKey securityKey = new SymmetricSecurityKey(key);
  4. SecurityTokenDescriptor descriptor = new SecurityTokenDescriptor {
  5. Subject = new ClaimsIdentity(new [] {
  6. new Claim(ClaimTypes.Name, username)
  7. }),
  8. Expires = DateTime.UtcNow.AddMinutes(30),
  9. SigningCredentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256Signature)
  10. };
  11. JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
  12. JwtSecurityToken token = handler.CreateJwtSecurityToken(descriptor);
  13. return handler.WriteToken(token);
  14. }
  15. public static ClaimsPrincipal GetPrincipal(string token) {
  16. try {
  17. JwtSecurityTokenHandler tokenHandler = new JwtSecurityTokenHandler();
  18. JwtSecurityToken jwtToken = (JwtSecurityToken) tokenHandler.ReadToken(token);
  19. if (jwtToken == null) return null;
  20. byte[] key = Convert.FromBase64String(Secret);
  21. TokenValidationParameters parameters = new TokenValidationParameters() {
  22. RequireExpirationTime = true,
  23. ValidateIssuer = false,
  24. ValidateAudience = false,
  25. IssuerSigningKey = new SymmetricSecurityKey(key)
  26. };
  27. SecurityToken securityToken;
  28. ClaimsPrincipal principal = tokenHandler.ValidateToken(token, parameters, out securityToken);
  29. return principal;
  30. } catch {
  31. return null;
  32. }
  33. }
Step 3
Check for token validation.
  1. [Route("Validate")]
  2. [HttpGet]
  3. public ResponseVM Validate(string token, string username) {
  4. int UserId = new UserRepository().GetUser(username);
  5. if (UserId == 0) return new ResponseVM {
  6. Status = "Invalid", Message = "Invalid User."
  7. };
  8. string tokenUsername = TokenManager.ValidateToken(token);
  9. if (username.Equals(tokenUsername)) {
  10. return new ResponseVM {
  11. Status = "Success",
  12. Message = "OK",
  13. };
  14. }
  15. return new ResponseVM {
  16. Status = "Invalid", Message = "Invalid Token."
  17. };
  18. }
  19. public static string ValidateToken(string token) {
  20. string username = null;
  21. ClaimsPrincipal principal = GetPrincipal(token);
  22. if (principal == null) return null;
  23. ClaimsIdentity identity = null;
  24. try {
  25. identity = (ClaimsIdentity) principal.Identity;
  26. } catch (NullReferenceException) {
  27. return null;
  28. }
  29. Claim usernameClaim = identity.FindFirst(ClaimTypes.Name);
  30. username = usernameClaim.Value;
  31. return username;
  32. }
Here is the complete TokenManager class.
  1. using Microsoft.IdentityModel.Tokens;
  2. using System;
  3. using System.Collections.Generic;
  4. using System.IdentityModel.Tokens.Jwt;
  5. using System.Linq;
  6. using System.Security.Claims;
  7. using System.Web;
  9. namespace WMS.Models.VM
  10. {
  11. public class TokenManager
  12. {
  13. private static string Secret = "ERMN05OPLoDvbTTa/QkqLNMI7cPLguaRyHzyg7n5qNBVjQmtBhz4SzYh4NBVCXi3KJHlSXKP+oi2+bXr6CUYTR==";
  14. public static string GenerateToken(string username)
  15. {
  16. byte[] key = Convert.FromBase64String(Secret);
  17. SymmetricSecurityKey securityKey = new SymmetricSecurityKey(key);
  18. SecurityTokenDescriptor descriptor = new SecurityTokenDescriptor
  19. {
  20. Subject = new ClaimsIdentity(new[] {
  21. new Claim(ClaimTypes.Name, username)}),
  22. Expires = DateTime.UtcNow.AddMinutes(30),
  23. SigningCredentials = new SigningCredentials(securityKey,
  24. SecurityAlgorithms.HmacSha256Signature)
  25. };
  27. JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
  28. JwtSecurityToken token = handler.CreateJwtSecurityToken(descriptor);
  29. return handler.WriteToken(token);
  30. }
  31. public static ClaimsPrincipal GetPrincipal(string token)
  32. {
  33. try
  34. {
  35. JwtSecurityTokenHandler tokenHandler = new JwtSecurityTokenHandler();
  36. JwtSecurityToken jwtToken = (JwtSecurityToken)tokenHandler.ReadToken(token);
  37. if (jwtToken == null)
  38. return null;
  39. byte[] key = Convert.FromBase64String(Secret);
  40. TokenValidationParameters parameters = new TokenValidationParameters()
  41. {
  42. RequireExpirationTime = true,
  43. ValidateIssuer = false,
  44. ValidateAudience = false,
  45. IssuerSigningKey = new SymmetricSecurityKey(key)
  46. };
  47. SecurityToken securityToken;
  48. ClaimsPrincipal principal = tokenHandler.ValidateToken(token,
  49. parameters, out securityToken);
  50. return principal;
  51. }
  52. catch
  53. {
  54. return null;
  55. }
  56. }
  57. public static string ValidateToken(string token)
  58. {
  59. string username = null;
  60. ClaimsPrincipal principal = GetPrincipal(token);
  61. if (principal == null)
  62. return null;
  63. ClaimsIdentity identity = null;
  64. try
  65. {
  66. identity = (ClaimsIdentity)principal.Identity;
  67. }
  68. catch (NullReferenceException)
  69. {
  70. return null;
  71. }
  72. Claim usernameClaim = identity.FindFirst(ClaimTypes.Name);
  73. username = usernameClaim.Value;
  74. return username;
  75. }
  77. }
  78. }

Summary

In this article, I have explained the Jwt token authentication and how it works.