Asp.Net Web Api Using Basic Auth Token Auth Jwt Complete Guide

Step 1: Set Up ASP.NET Core Web API Project

1. Open Visual Studio and create a new project.
2. Select "ASP.NET Core Web Application" and click "Next".
3. Provide a suitable project name and click "Next".
4. Choose ".NET Core" as the target framework and select "ASP.NET Core 5.0" or later. Choose "API" as the project template and leave authentication as "No Authentication".
5. Click "Create".

Step 2: Add Basic Auth Middleware

1. Create a Basic Authentication Scheme:

   • Create a new folder named Authentication in your project.
   • Add a new class named BasicAuthenticationHandler:

   using System.Net.Http.Headers;
   using System.Security.Principal;
   using System.Text;
   using System.Text.Encodings.Web;
   using System.Threading.Tasks;
   using Microsoft.AspNetCore.Authentication;
   using Microsoft.Extensions.Logging;
   using Microsoft.Extensions.Options;
   
   namespace WebApiWithAuth.Authentication
   {
       public class BasicAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
       {
           public BasicAuthenticationHandler(
               IOptionsMonitor<AuthenticationSchemeOptions> options,
               ILoggerFactory logger,
               UrlEncoder encoder,
               ISystemClock clock)
               : base(options, logger, encoder, clock)
           {
           }
   
           protected override Task<AuthenticateResult> HandleAuthenticateAsync()
           {
               if (!Request.Headers.ContainsKey("Authorization"))
               {
                   return Task.FromResult(AuthenticateResult.NoResult());
               }
   
               string authorizationHeader = Request.Headers["Authorization"];
               var authorizationHeaderValues = AuthenticationHeaderValue.Parse(authorizationHeader);
   
               if (!authorizationHeaderValues.Scheme.Equals("Basic", StringComparison.OrdinalIgnoreCase) ||
                   string.IsNullOrWhiteSpace(authorizationHeaderValues.Parameter))
               {
                   return Task.FromResult(AuthenticateResult.NoResult());
               }
   
               string parameter = authorizationHeaderValues.Parameter;
               byte[] bytesFromBase64String = Convert.FromBase64String(parameter);
               string decodedString = Encoding.UTF8.GetString(bytesFromBase64String);
   
               string username = decodedString.Split(':')[0];
               string password = decodedString.Split(':')[1];
   
               if (!ValidateCredentials(username, password))
               {
                   return Task.FromResult(AuthenticateResult.Fail("Invalid credentials"));
               }
   
               ClaimsIdentity identity = new ClaimsIdentity(
                   new[]
                   {
                       new Claim(ClaimTypes.Name, username)
                   },
                   Scheme.Name
               );
   
               ClaimsPrincipal principal = new ClaimsPrincipal(identity);
               AuthenticationTicket ticket = new AuthenticationTicket(principal, Scheme.Name);
   
               return Task.FromResult(AuthenticateResult.Success(ticket));
           }
   
           private bool ValidateCredentials(string username, string password)
           {
               // Just for demonstration.
               return username == "admin" && password == "password";
           }
       }
   }
   

2. Register the Basic Auth Middleware:

   • Open Startup.cs or Program.cs if you are using .NET 6 or later.
   • Add the following code in the ConfigureServices method:

   using Microsoft.AspNetCore.Authentication;
   
   public void ConfigureServices(IServiceCollection services)
   {
       // Basic auth
       services.AddAuthentication("BasicAuthentication")
           .AddScheme<AuthenticationSchemeOptions, BasicAuthenticationHandler>("BasicAuthentication", null);
   
       services.AddControllers();
   }
   

   • Add the following code in the Configure method:

   public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
   {
       if (env.IsDevelopment())
       {
           app.UseDeveloperExceptionPage();
       }
   
       app.UseRouting();
   
       // Add basic auth to the pipeline
       app.UseAuthentication();
       app.UseAuthorization();
   
       app.UseEndpoints(endpoints =>
       {
           endpoints.MapControllers();
       });
   }
   

Step 3: Create a Token Auth Scheme (JWT)

1. Install the JWT NuGet Package:

   • Open NuGet Package Manager and install Microsoft.AspNetCore.Authentication.JwtBearer.

2. Configure token authentication:

   • Add a class for JWT settings:

   public class JwtTokenSettings
   {
       public string SecretKey { get; set; }
       public string Issuer { get; set; }
       public string Audience { get; set; }
   }
   

   • Add the JWT settings in appsettings.json:

   "JwtTokenSettings": {
       "SecretKey": "a_secret_key_that_should_be_kept_secret",
       "Issuer": "yourdomain.com",
       "Audience": "yourdomain.com"
   }
   

3. Configure JWT in Startup.cs or Program.cs:

   using Microsoft.AspNetCore.Authentication.JwtBearer;
   using Microsoft.IdentityModel.Tokens;
   
   // Inside ConfigureServices method
   services.Configure<JwtTokenSettings>(Configuration.GetSection("JwtTokenSettings"));
   
   services.AddAuthentication(options =>
   {
       options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
       options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
   })
   .AddJwtBearer(options =>
   {
       JwtTokenSettings jwtTokenSettings = Configuration.GetSection("JwtTokenSettings").Get<JwtTokenSettings>();
       options.TokenValidationParameters = new TokenValidationParameters
       {
           ValidateIssuer = true,
           ValidateAudience = true,
           ValidateLifetime = true,
           ValidateIssuerSigningKey = true,
           ValidIssuer = jwtTokenSettings.Issuer,
           ValidAudience = jwtTokenSettings.Audience,
           IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtTokenSettings.SecretKey))
       };
   });
   
   services.AddControllers();
   

4. Create a token generation service:

   using Microsoft.IdentityModel.Tokens;
   using System;
   using System.IdentityModel.Tokens.Jwt;
   using System.Security.Claims;
   
   public class TokenService
   {
       private readonly JwtTokenSettings _jwtTokenSettings;
   
       public TokenService(IOptions<JwtTokenSettings> jwtTokenSettings)
       {
           _jwtTokenSettings = jwtTokenSettings.Value;
       }
   
       public string GenerateToken(string username)
       {
           var tokenHandler = new JwtSecurityTokenHandler();
           var key = Encoding.ASCII.GetBytes(_jwtTokenSettings.SecretKey);
           var tokenDescriptor = new SecurityTokenDescriptor
           {
               Subject = new ClaimsIdentity(new Claim[]
               {
                   new Claim(ClaimTypes.Name, username)
               }),
               Expires = DateTime.UtcNow.AddDays(7),
               Issuer = _jwtTokenSettings.Issuer,
               Audience = _jwtTokenSettings.Audience,
               SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
           };
           var token = tokenHandler.CreateToken(tokenDescriptor);
           return tokenHandler.WriteToken(token);
       }
   }
   

5. Register the token service in Startup.cs or Program.cs:

   services.AddSingleton<TokenService>();
   

6. Create a controller for authentication:

   using Microsoft.AspNetCore.Mvc;
   using Microsoft.Extensions.Options;
   
   [ApiController]
   [Route("[controller]")]
   public class AuthController : ControllerBase
   {
       private readonly TokenService _tokenService;
       private readonly JwtTokenSettings _jwtTokenSettings;
   
       public AuthController(TokenService tokenService, IOptions<JwtTokenSettings> jwtTokenSettings)
       {
           _tokenService = tokenService;
           _jwtTokenSettings = jwtTokenSettings.Value;
       }
   
       [HttpPost("login")]
       public IActionResult Login([FromBody] LoginRequest request)
       {
           if (!ValidateCredentials(request.Username, request.Password))
           {
               return Unauthorized();
           }
   
           string token = _tokenService.GenerateToken(request.Username);
   
           return Ok(new
           {
               token,
               token_type = "Bearer",
               expires_in = 604800 // 7 days
           });
       }
   
       private bool ValidateCredentials(string username, string password)
       {
           // Just for demonstration.
           return username == "admin" && password == "password";
       }
   }
   
   public class LoginRequest
   {
       public string Username { get; set; }
       public string Password { get; set; }
   }
   

Step 4: Secure Your Controllers

You can now secure your controllers using either Basic Auth or JWT.

1. For Basic Auth:

   • Add the [Authorize(AuthenticationSchemes = "BasicAuthentication")] attribute to your controller or actions.

   [ApiController]
   [Route("api/[controller]")]
   [Authorize(AuthenticationSchemes = "BasicAuthentication")]
   public class ProductsController : ControllerBase
   {
       [HttpGet]
       public IActionResult GetProducts()
       {
           // Your logic here
           return Ok(new[] { "Product1", "Product2" });
       }
   }
   

2. For JWT Auth:

   • Add the [Authorize] attribute to your controller or actions.

   [ApiController]
   [Route("api/[controller]")]
   [Authorize]
   public class OrdersController : ControllerBase
   {
       [HttpGet]
       public IActionResult GetOrders()
       {
           // Your logic here
           return Ok(new[] { "Order1", "Order2" });
       }
   }
   

Summary

You've gone through setting up a simple ASP.NET Core Web API with both Basic Authentication and JWT Authentication. You can now test your application with tools like Postman or curl.

Testing the API

1. Basic Auth:

   • Send a request with the Authorization header:

     GET /api/products
     Host: localhost:5000
     Authorization: Basic YWRtaW46cGFzc3dvcmQ=
     

     (where YWRtaW46cGFzc3dvcmQ= is the base64 encoding of admin:password).

2. JWT Auth:

   • First, get the token: