Web API Authentication Using JWT Token

JWT - (JSON Web Token)

JWT basically consists of three parts.

• HEADER : ALGORITHM & TOKEN TYPE (JSON format which is encoded as a base64)
• PAYLOAD : DATA (JSON format which is encoded as a base64.)
• VERIFY SIGNATURE (Created and signed based on Header and Claims which is encoded as a base64.)

We use JWT just to verify that the request coming to our API is from a valid source. The above mentioned three parts are separated using dot (.) respectively in the encoded form.

It is basically used to encode our data using the algorithms we apply. JWT is very lightweight and can encode large amount of sensitive data which can even be passed as a query string.

Creation of JWT

• Use the NuGet package called System.IdentityModel.Tokens.Jwt from MS to generate the token.
• Validate for correct user from database and if validated, then generate the token by putting its information in payload and return that token to that user.
• Add .cs file and write the below method to generate token.
  

  private
  const string Secret = "db3OIsj+BXE9NZDy0t8W3TcNekrF+2d/1sFnWG4HnV8TZY30iTOdtVWJG8abWvB1GlOgJuQZdcF2Luqm/hccMw==";
  public static string GenerateToken(string username, int expireMinutes = 20) {
      var symmetricKey = Convert.FromBase64String(Secret);
      var tokenHandler = new JwtSecurityTokenHandler();
      var now = DateTime.UtcNow;
      var tokenDescriptor = new SecurityTokenDescriptor {
          Subject = new ClaimsIdentity(new [] {
                  new Claim(ClaimTypes.Name, username)
              }),
              Expires = now.AddMinutes(Convert.ToInt32(expireMinutes)),
              SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(symmetricKey), SecurityAlgorithms.HmacSha256Signature)
      };
      var stoken = tokenHandler.CreateToken(tokenDescriptor);
      var token = tokenHandler.WriteToken(stoken);
      return token;
  }

• The user will save the returned token either in session or local storage or in cookies, because for every new request, it will have to attach that token with request in header so that it can be validated with every new request. Thus, in this way, the API ensures that the incoming request is from a valid user.

Consumption of JWT

Add AuthorizationAttribute in WebApiConfigFile.

Eg

config.Filters.Add(new AuthorizeAttribute());

built JwtAuthenticationAttribute which inherits from IauthenticationFilter. With this attribute, you can authenticate any action. Just put this attribute on that action.

public class ValueController: ApiController {
    [JwtAuthentication]
    public string Get() {
        return "value";
    }
}

Below is the core method from authentication filter.

private static bool ValidateToken(string token, out string username) {
    username = null;
    var simplePrinciple = JwtManager.GetPrincipal(token);
    var identity = simplePrinciple.Identity as ClaimsIdentity;
    if (identity == null) return false;
    if (!identity.IsAuthenticated) return false;
    var usernameClaim = identity.FindFirst(ClaimTypes.Name);
    username = usernameClaim ? .Value;
    if (string.IsNullOrEmpty(username)) return false;
    // More validate to check whether username exists in system
    return true;
}
protected Task < IPrincipal > AuthenticateJwtToken(string token) {
    string username;
    if (ValidateToken(token, out username)) {
        // based on username to get more information from database in order to build local identity
        var claims = new List < Claim > {
            new Claim(ClaimTypes.Name, username)
            // Add more claims if needed: Roles, ...
        };
        var identity = new ClaimsIdentity(claims, "Jwt");
        IPrincipal user = new ClaimsPrincipal(identity);
        return Task.FromResult(user);
    }
    return Task.FromResult < IPrincipal > (null);
}

The workflow is using JWT library (NuGet package above) to validate the JWT token and then return back ClaimsPrincipal. We can perform more validation like checking whether user exists on our system and adding other custom validations if we want. The code is to validate JWT token and get principal back.

public static ClaimsPrincipal GetPrincipal(string token) {
    try {
        var tokenHandler = new JwtSecurityTokenHandler();
        var jwtToken = tokenHandler.ReadToken(token) as JwtSecurityToken;
        if (jwtToken == null) return null;
        var symmetricKey = Convert.FromBase64String(Secret);
        var validationParameters = new TokenValidationParameters() {
            RequireExpirationTime = true,
                ValidateIssuer = false,
                ValidateAudience = false,
                IssuerSigningKey = new SymmetricSecurityKey(symmetricKey)
        };
        SecurityToken securityToken;
        var principal = tokenHandler.ValidateToken(token, validationParameters, out securityToken);
        return principal;
    } catch (Exception) {
        //should write log
        return null;
    }
}

If the JWT token is validated and the principal is returned, you should build a new local identity and put more information into it to check the role authorization.