Token-based authentication is a security mechanism that allows users to authenticate themselves and receive a token that can be used to access protected resources. This method is widely used in modern web applications, especially those that require stateless communication between the client and server. In token-based authentication, the server generates a token upon successful login, which the client must include in subsequent requests to access protected endpoints.

Key Features of Token-Based Authentication

• Stateless: The server does not need to store session information, making it scalable and suitable for distributed systems.
• Decoupled: The client and server can be developed independently, as the client only needs to handle the token.
• Cross-Domain Support: Tokens can be used across different domains, making it ideal for APIs consumed by various clients.

Implementing Token-Based Authentication in ASP.NET Web API

Below are the steps to implement token-based authentication using JWT (JSON Web Tokens) in an ASP.NET Web API application.

Step 1: Set Up Your ASP.NET Web API Project

Start by creating a new ASP.NET Web API project in Visual Studio. You can choose the "ASP.NET Web Application" template and select "Web API" as the project type.

Step 2: Install Required NuGet Packages

You need to install the following NuGet packages to enable JWT authentication:

        
        Install-Package Microsoft.AspNetCore.Authentication.JwtBearer
        Install-Package System.IdentityModel.Tokens.Jwt
            

Step 3: Configure JWT Authentication

In the Startup.cs file, configure the JWT authentication in the ConfigureServices method:

        
        using Microsoft.AspNetCore.Authentication.JwtBearer;
        using Microsoft.IdentityModel.Tokens;
        using System.Text;

        public class Startup
        {
            public void ConfigureServices(IServiceCollection services)
            {
                services.AddAuthentication(x =>
                {
                    x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                    x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
                })
                .AddJwtBearer(x =>
                {
                    x.RequireHttpsMetadata = false;
                    x.SaveToken = true;
                    x.TokenValidationParameters = new TokenValidationParameters
                    {
                        ValidateIssuer = false,
                        ValidateAudience = false,
                        ValidateLifetime = true,
                        ValidateIssuerSigningKey = true,
                        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("your_secret_key_here"))
                    };
                });

                services.AddControllers();
            }

            public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
            {
                app.UseRouting();
                app.UseAuthentication(); // Enable authentication
                app.UseAuthorization(); // Enable authorization

                app.UseEndpoints(endpoints =>
                {
                    endpoints.MapControllers();
                });
            }
        }
            

Step 4: Create a Login Endpoint

Create a controller to handle user login and generate JWT tokens. Below is an example of an AuthController:

        
        using Microsoft.AspNetCore.Mvc;
        using System;
        using System.IdentityModel.Tokens.Jwt;
        using System.Security.Claims;
        using System.Text;

        [Route("api/[controller]")]
        [ApiController]
        public class AuthController : ControllerBase
        {
            [HttpPost("login")]
            public IActionResult Login([FromBody] UserLogin login)
            {
                // Validate user credentials (this is just a placeholder)
                if (login.Username == "user" && login.Password == "password")
                {
                    var tokenHandler = new JwtSecurityTokenHandler();
                    var key = Encoding.UTF8.GetBytes("your_secret_key_here");
                    var tokenDescriptor = new SecurityTokenDescriptor
                    {
                        Subject = new ClaimsIdentity(new Claim[]
                        {
                            new Claim(ClaimTypes.Name, login.Username)
                        }),
                        Expires = DateTime.UtcNow.AddHours(1),
                        SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
                    };
                    var token = tokenHandler.CreateToken(tokenDescriptor);
                    return Ok(new { Token = tokenHandler.WriteToken(token) });
                }
                return Unauthorized (); // Return 401 if authentication fails
            }
        }

        public class UserLogin
        {
            public string Username { get; set; }
            public string Password { get; set; }
        }
            

Step 5: Protecting API Endpoints with Token Authentication

You can protect specific API endpoints by using the [Authorize] attribute. Below is an example of a ProductsController that requires a valid token for access:

        
        using Microsoft.AspNetCore.Authorization;
        using Microsoft.AspNetCore.Mvc;
        using System.Collections.Generic;

        [Route("api/[controller]")]
        [ApiController]
        [Authorize] // Require authentication for all actions in this controller
        public class ProductsController : ControllerBase
        {
            // GET api/products
            [HttpGet]
            public IActionResult Get()
            {
                var products = new List<string> { "Product1", "Product2", "Product3" };
                return Ok(products); // Return the list of products
            }
        }
            

Conclusion

Token-based authentication is a robust method for securing APIs in ASP.NET Web API applications. By implementing JWT for token generation and validation, you can ensure that only authenticated users can access protected resources. This approach enhances security while maintaining the flexibility and scalability of your application.