JWT just generates a unique token, that contains information about the user, and some other parameters such as length of authorized time, and expiration date. So with a token, you can store it in the browsers Local Storage using JavaScript and read it back it using JavaScript. With JavaScript you can get info out of the token, or check to see if the token is expired, and then refresh it or issue a new one. In Angular, you pickup the token, and pass the token in the header sent to the .Net Core V2.2+ API.
headers: new HttpHeaders({
"Content-Type": "application/json",
"Accept": "application/json",
"Authorization": "Bearer " + tokenGetter
})
And then the API will run a service or something called Authorize.
[HttpGet("GetAdminBrands/{page}/{show}"), Authorize]
public async Task GetAdminBrands(int page, int show)
{
var brand = await _brandsRepository.GetBrands(page, show);
return brand;
}
You set this up in Startup
services.AddAuthorization(auth =>
{
auth.AddPolicy("Bearer", new AuthorizationPolicyBuilder()
.AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)
.RequireAuthenticatedUser().Build());
});
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
{
var settings = Configuration.GetSection("Settings");
var secretKey = settings.GetValue("Auth0:Secret");
var signingKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(secretKey));
var authority = settings.GetValue("Auth0:Authority");
var audience = settings.GetValue("Auth0:Audience");
options.RequireHttpsMetadata = false;
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
ValidateIssuer = true,
ValidateAudience = true,
ValidateLifetime = true,
ValidIssuer = authority,
ValidAudience = audience,
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey))
};
});
So above is what I'm using now, which is Angular wrapped in .Net Core V2.2+ The code I posted earlier was a work around or hack to avoid using Microsoft.Identity in it's full scale, since I just wanted a partial portion of it. What I mean by full scale was having to use such a large chunk of controllers, models and views in which no explanation was really provided in how it works and why. Microsoft.Identity was take it or leave it with
