JWT Navigator for .NET APIs

JWT Authentication in .NET: Building a Real OAuth 2.0 Authorization Server: Client Registration

In the previous article we finally turned our demo authorisation server into something that feels like a real OAuth 2.0 implementation. We consolidated the token and refresh endpoints into a single /token endpoint that dispatches on the official grant_type parameter. We switched to standard OAuth conventions: snake_case,

JWT Authentication in .NET: Creating an OAuth 2.0 Compatible Token Endpoint

Although this blog is focused on the role of JWTs in .NET APIs, when you begin to make a concerted study of the subject, you discover that JWTs are actually part of a wider authentication landscape. They're a central component of OAuth 2.0 and the proposed OAuth

Common JWT Attacks in .NET APIs (and How to Block Them)

If you're like me, whenever you watch a video tutorial about building .NET APIs, the teacher always gives you the minimum information necessary and seldom explains why you should do something. It's always like: "Here's this cool feature and everybody says you should

From Demo JWT to Production JWT: Adding Proper Audience Validation

I originally planned for this article to focus on common JWT attacks in ASP.NET API's. But while reviewing the code from this series, I realised an important gap: We hadn’t properly covered audience validation. In earlier articles, we intentionally kept the implementation minimal so we could

Lazy JWT Key Rotation in .NET: Redis-Powered JWKS That Just Works

In the previous article we added the two standard JWKS discovery endpoints to our authentication server. As part of the OpenId Connect (OIDC) protocol, the first of these endpoints enables an API to discover where the other relevant endpoints are and the second endpoint publishes the public keys that clients

The Ultimate JWKS Setup for Robust JWT Validation in ASP.NET 10

This article isn't going to be as long as the previous article, but it's going to be just as interesting and powerful. I'm going to be covering JWKS, that is, a JSON Web Key Set. Why JWKS matters for scalable API's In

Revoke JWTs in .NET: Stop Stolen Tokens Dead with Simple Code

In the last article, we finished the topic we started in the article before last, which was refreshing tokens. We're developing API's that use JWT (JSON Web Tokens) as access tokens to provide a secure, self-contained way of authenticating using a compact URL-friendly format. All the

JWT Refresh Tokens Done Right: Proactive Background Refresh + Rotation + Sliding Expiry in ASP.NET Core

In the previous article, we built out our authentication server API to include an endpoint to refresh our JWT. We created a SQLite database to store them and we implemented a rotation policy based on the OAuth 2.1 specification. Then we built a client API to call the authentication

Refresh Tokens Done Right: Avoid Common JWT Pitfalls in .NET

In the previous article, we built an ASP.NET Minimal API in .NET 10 with JWT authentication. In this article, we're going to take the code we wrote last time and extend it to include refresh tokens, so we in effect have our own authentication server. That means

Build a Secure .NET Minimal API with JWT Authentication – Step by Step

In the previous article, I discussed the structure of a JWT, how to construct one manually in code and the principles behind each step of the process. In this article I'm going to take that knowledge and show you how to build a working ASP.NET Minimal API

Inside a JWT: Build Your Own Token from Scratch in .NET

In the last post I used an analogy about authentication being like a passport which identifies you to the resource you're trying to access. In this post I'm going to show you how to make a JWT from scratch without using the standard .NET libraries, so

Why Authentication Matters: The Passport Every .NET API Needs

The passport analogy What is authentication and why do we need it? A good analogy is to think about the concept of authentication as a passport. If you want to get into a country, you have to show them your passport. It proves who you are. How does it prove