Authentication and authorization are critical components of securing an ASP.NET Web API application. Authentication verifies the identity of a user, while authorization determines whether the authenticated user has permission to perform specific actions. This guide will explain how to implement both authentication and authorization in ASP.NET Web API using token-based authentication with JWT (JSON Web Tokens).

Step 1: Set Up Your ASP.NET Web API Project

Start by creating a new ASP.NET Web API project in Visual Studio. You can choose the "ASP.NET Web Application" template and select "Web API" as the project type.

Step 2: Install Required NuGet Packages

You need to install the following NuGet packages to enable JWT authentication:

        
        Install-Package Microsoft.AspNetCore.Authentication.JwtBearer
        Install-Package System.IdentityModel.Tokens.Jwt
            

Step 3: Configure JWT Authentication

In the Startup.cs file, configure the JWT authentication in the ConfigureServices method:

        
        using Microsoft.AspNetCore.Authentication.JwtBearer;
        using Microsoft.IdentityModel.Tokens;
        using System.Text;

        public class Startup
        {
            public void ConfigureServices(IServiceCollection services)
            {
                services.AddAuthentication(x =>
                {
                    x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                    x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
                })
                .AddJwtBearer(x =>
                {
                    x.RequireHttpsMetadata = false;
                    x.SaveToken = true;
                    x.TokenValidationParameters = new TokenValidationParameters
                    {
                        ValidateIssuer = false,
                        ValidateAudience = false,
                        ValidateLifetime = true,
                        ValidateIssuerSigningKey = true,
                        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("your_secret_key_here"))
                    };
                });

                services.AddControllers();
            }

            public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
            {
                app.UseRouting();
                app.UseAuthentication(); // Enable authentication
                app.UseAuthorization(); // Enable authorization

                app.UseEndpoints(endpoints =>
                {
                    endpoints.MapControllers();
                });
            }
        }
            

Step 4: Create a Login Endpoint

Create a controller to handle user login and generate JWT tokens. Below is an example of an AuthController:

        
        using Microsoft.AspNetCore.Mvc;
        using System;
        using System.IdentityModel.Tokens.Jwt;
        using System.Security.Claims;
        using System.Text;

        [Route("api/[controller]")]
        [ApiController]
        public class AuthController : ControllerBase
        {
            [HttpPost("login")]
            public IActionResult Login([FromBody] UserLogin login)
            {
                // Validate user credentials (this is just a placeholder)
                if (login.Username == "user" && login.Password == "password")
                {
                    var tokenHandler = new JwtSecurityTokenHandler();
                    var key = Encoding.UTF8.GetBytes("your_secret_key_here");
                    var tokenDescriptor = new SecurityTokenDescriptor
                    {
                        Subject = new ClaimsIdentity(new Claim[]
                        {
                            new Claim(ClaimTypes.Name, login.Username)
                        }),
                        Expires = DateTime.UtcNow.AddHours(1),
                        SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
                    };
                    var token = tokenHandler.CreateToken(tokenDescriptor);
                    return Ok(new { Token = tokenHandler.WriteToken(token) });
                }
                return Unauthorized(); // Return 401 if authentication fails
            }
        }

        public class UserLogin
        {
            public string Username { get; set; }
            public string Password { get; set; }
        }
            

Step 5: Protecting API Endpoints with Authorization

You can protect specific API endpoints by using the [Authorize] attribute. Below is an example of a ProductsController that requires authentication:

        
        using Microsoft.AspNetCore.Authorization;
        using Microsoft.AspNetCore.Mvc;
        using System.Collections.Generic;

        [Route("api/[controller]")]
        [ApiController]
        [Authorize] // Require authentication for all actions in this controller
        public class ProductsController : ControllerBase
        {
            // GET api/products
            [HttpGet]
            public IActionResult Get()
            {
                var products = new List<string> { "Product1", "Product2", "Product3" };
                return Ok(products); // Return the list of products
            }
        }
            

Conclusion

Implementing authentication and authorization in ASP.NET Web API is essential for securing your application. By using JWT for token-based authentication and applying the [Authorize] attribute to your controllers or actions, you can ensure that only authenticated users can access protected resources. Following the steps outlined in this guide, you can effectively secure your ASP.NET Web API application.