Low level: JWT authentication implementation in Asp.Net Core C#

b – We inject our JWT middleware in the Startup class Configure method, so it intercepts all the calls coming to the application now.

app.UseMiddleware<JwtMiddleware>()

c – We create an Invoke method in the JwtMiddleware class.

This method is then invoked on each call. It this method we retrieve the token from the call request Authorization header, we then pass the token to attachUserToContext  method, in that method we dencrypt the token to extract the UserId.

public async Task Invoke(HttpContext context, IUserService userService)
{
    var token = context.Request.Headers["Authorization"].
                 FirstOrDefault()?.Split(" ").Last();

    if (!string.IsNullOrWhiteSpace(token))
        attachUserToContext(context, userService, token);

    await _next(context);
}

Then we again validate the userId extracted using our  UserService, after that it attaches the retrieved User data/object to the HttpContext as show below:

private void attachUserToContext(HttpContext context, IUserService userService,
                                   string token)
{
    //  LifetimeValidator lifetimeValidator = l;
    try
    {
        var tokenHandler = new JwtSecurityTokenHandler();
        var key = Encoding.ASCII.GetBytes(_appSettings.Secret);
        tokenHandler.ValidateToken(token, new TokenValidationParameters
        {
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(key),
            ValidateIssuer = false,
            ValidateAudience = false,
            // set clockskew to zero so tokens expire exactly at token expiration 
            // time (instead of 5 minutes later)
            ClockSkew = TimeSpan.Zero,
            LifetimeValidator = lifetimeValidator
        }, out SecurityToken validatedToken);

        var jwtToken = (JwtSecurityToken)validatedToken;
        var userId = jwtToken.Claims.First(x => x.Type == "id").Value;

        // attach user to context on successful jwt validation
        context.Items["User"] = userService.GetById(userId);
    }
    catch
    {
        // do nothing if jwt validation fails
        // user is not attached to context so request won't have access to
        // secure routes
    }
}

d – We create an Authorize attribute in another class called AuthorizeAttribute

Its OnAuthorization method contains the logic to check whether there is any User present in the context using:

var user = (Entities.User)context.HttpContext.Items["User"]

If it does not find the user then it returns UnAuthorized 401 response.

e – In all the controllers where we want to implement authentication, we add the Authorize attribute on the controller class like this:

[Authorize]
public class ToDoItemController : Controller

Then calls coming to the controller are passed to the OnAuthorization method of the AuthorizeAttribute class before hitting any method of the controller class.

There it checks whether we have User data is present in HttpContext or not, which means whether the User data was added into the HttpContext by the Invoke method of the JwtMiddleware class, which essentially means whether the request was made along with a valid token, which ultimately means whether the request is authentic.