Google Sign-In Required for .NET Guided Labs
To verify code authenticity, store your pushed GitHub repositories, and earn the .NET Enterprise certification, please sign in with your student account.
Day 30Sprint 3 • Security & Auth
2 Hours
Day 30: JWT Authentication & Role-Based Authorization in .NET
Modern stateless APIs do not store session cookies on the server. Instead, upon successful authentication, the server generates a cryptographically signed JWT. The client includes this token in the Authorization: Bearer <token> header for every subsequent request.
Understand JSON Web Tokens (Header, Payload, Signature)
Configure AddAuthentication and AddJwtBearer in Program.cs
Generate cryptographically signed JWT tokens with Claims (UserId, Roles)
Protect endpoints using [Authorize] and [Authorize(Roles = "Admin")]
Core Architectural Insights
- JWT tokens are stateless and contain signed user claims
- AddJwtBearer validates Issuer, Audience, Lifetime, and IssuerSigningKey
- ClaimsPrincipal exposes user info via User.Identity.Name or User.Claims
- Role-based access control (RBAC) restricts endpoints to authorized roles
Real-World Developer Analogy
A JWT is like a sealed, hologram-stamped VIP concert wristband. Security guards at each door don't need to call the front desk; they simply inspect the tamper-evident stamp on the wristband.