JWT Authentication in Razor Pages .net core

Question

Hi, I am big fan of your. Love you site and content. I need your help, with one of my project. Thank you very much for being so active for c# community. I have a website in Razor pages, but now i am planning to have a Web API also, so that i can use it as business layer/Data Layer for Mobile app and Blazor too. Now, as per your post, i can implement an API with JWT Authentication and will be using Roles in it also. Now my concern is, how i can implement the JWT Authentication in Razor Pages. Like i will log into Razor pages app and will call Web API from razor pages and API will return a JWT Authentication token. I want to use that JWT in Razor Pages for authorization and want to use attribute [Authorize(Role = "role")] in razor pages. Is this possible, if yet can you please create a post on this. Thanks, Rupinder

Sachin Singh · Answer

there are multiple examples available on net on how to secure razor apps https://fusionauth.io/blog/2020/05/06/securing-asp-netcore-razor-pages-app-with-oauth/ https://docs.microsoft.com/en-us/aspnet/core/security/authorization/secure-data?view=aspnetcore-5.0

Rijwan Ansari · Answer

Build token including roles as illustrated. \ private string BuildToken(LoginViewModel user) { var roles = new List (); var userRoles = userService.GetUserRoleByEmail(user.UserName); var secretKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config[ "Jwt:Key" ])); var signinCredentials = new SigningCredentials(secretKey, SecurityAlgorithms.HmacSha256); var claims = new List { new Claim(ClaimTypes.Name, user.UserName) }; if (roles.Count > 0) { foreach (var role in roles) { claims.Add( new Claim(ClaimTypes.Role, role.RoleName)); // Add your roles } } var tokeOptions = new JwtSecurityToken( issuer: _config[ "Jwt:Issuer" ], audience: _config[ "Jwt:Issuer" ], claims: claims, expires: DateTime.Now.AddMinutes(20), signingCredentials: signinCredentials ); return new JwtSecurityTokenHandler().WriteToken(tokeOptions); } Then authenticate in controller as shown: [HttpGet] [Authorize(Roles = "SuperAdmin" )] [Route( "SuperAdminAuth" )] public IEnumerable string > GetSuperAdmin() { return new string [] { "Rijwan-SuperAdmin" , "Satya" }; } [HttpGet] [Authorize(Roles = "Support" )] [Route( "SupportAuth" )] public IEnumerable string > GetSupport() { return new string [] { "Rijwan-Support" , "Satya" }; } You can try this way. If you face any specific error, please share. Regards Rijwan

Kiran Mohanty · Answer

Here is a link for you. https://auth0.com/blog/securing-asp-dot-net-core-2-applications-with-jwts/