By the end of this session, you will be able to:

• Configure JWT bearer authentication in ASP.NET Core using AddAuthentication and AddJwtBearer
• Implement a login endpoint that issues signed JWT tokens from user credentials
• Protect endpoints with the [Authorize] attribute and verify a 401 is returned without a valid token
• Read identity claims (user ID, email, role) from the token inside a controller action
• Connect the issued token to the React frontend via the Authorization: Bearer header

{
  "Jwt": {
    "Secret": "your-super-secret-key-at-least-32-characters",
    "Issuer": "TaskManagerApi",
    "Audience": "TaskManagerApiUsers",
    "ExpiryMinutes": 60
  }
}

Issuer and Audience are validated on every incoming token to prevent tokens issued by another service from being accepted by this API.

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = builder.Configuration["Jwt:Issuer"],
            ValidAudience = builder.Configuration["Jwt:Audience"],
            IssuerSigningKey = new SymmetricSecurityKey(
                Encoding.UTF8.GetBytes(
                    builder.Configuration["Jwt:Secret"]!))
        };
    });

app.UseAuthentication();   // must come before UseAuthorization
app.UseAuthorization();

Middleware order matters: UseAuthentication populates HttpContext.User; UseAuthorization then decides whether the authenticated user is allowed to call the endpoint.

[ApiController]
[Route("api/auth")]
public class AuthController : ControllerBase
{
    private readonly AppDbContext _context;
    private readonly IConfiguration _config;

    public AuthController(AppDbContext context, IConfiguration config)
        => (_context, _config) = (context, config);

    [HttpPost("register")]
    public async Task<IActionResult> Register([FromBody] RegisterRequest req)
    {
        if (await _context.Users.AnyAsync(u => u.Email == req.Email))
            return Conflict(new { message = "Email already in use." });

        var user = new User
        {
            Email = req.Email,
            PasswordHash = BCrypt.Net.BCrypt.HashPassword(req.Password),
            Role = "User"
        };

        _context.Users.Add(user);
        await _context.SaveChangesAsync();
        return Ok(new { message = "Registration successful." });
    }
}

BCrypt.HashPassword handles salt generation automatically. The resulting hash is a self-contained string that includes the algorithm, cost factor, salt, and hash — everything needed to verify the password later.

[HttpPost("login")]
public async Task<IActionResult> Login([FromBody] LoginRequest req)
{
    var user = await _context.Users
        .FirstOrDefaultAsync(u => u.Email == req.Email);

    if (user is null || !BCrypt.Net.BCrypt.Verify(req.Password, user.PasswordHash))
        return Unauthorized(new { message = "Invalid credentials." });

    var token = GenerateToken(user);
    return Ok(new { token });
}

private string GenerateToken(User user)
{
    var claims = new[]
    {
        new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
        new Claim(ClaimTypes.Email, user.Email),
        new Claim(ClaimTypes.Role, user.Role)
    };

    var key = new SymmetricSecurityKey(
        Encoding.UTF8.GetBytes(_config["Jwt:Secret"]!));
    var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

    var token = new JwtSecurityToken(
        issuer: _config["Jwt:Issuer"],
        audience: _config["Jwt:Audience"],
        claims: claims,
        expires: DateTime.UtcNow.AddMinutes(
            int.Parse(_config["Jwt:ExpiryMinutes"]!)),
        signingCredentials: creds
    );

    return new JwtSecurityTokenHandler().WriteToken(token);
}

Claims embedded here (NameIdentifier, Email, Role) are readable inside any [Authorize]-protected action via User.FindFirst(...) without another database query.

[Authorize]
[HttpGet("me")]
public IActionResult GetCurrentUser()
{
    var userId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
    var email  = User.FindFirst(ClaimTypes.Email)?.Value;
    var role   = User.FindFirst(ClaimTypes.Role)?.Value;

    return Ok(new { userId, email, role });
}

The ?. null-conditional operator is important here — if the middleware is misconfigured and FindFirst returns null, the action returns null values rather than throwing a NullReferenceException.

Implement the complete authentication flow and verify the protected endpoint behaviour end-to-end in Postman.

• AddAuthentication / AddJwtBearer wires up token validation — all four parameters (issuer, audience, lifetime, signing key) should be enabled; middleware order matters: UseAuthentication before UseAuthorization
• Passwords are stored as BCrypt hashes, never plain text — BCrypt.HashPassword on register, BCrypt.Verify on login; the secret value is never retrievable from the hash
• [Authorize] enforces authentication at the controller or action level — requests without a valid Bearer token receive 401 before action code runs; use [AllowAnonymous] for public endpoints
• Claims in the token replace database lookups for identity — User.FindFirst(ClaimTypes.NameIdentifier) gives you the user ID inside any protected action without an additional query
• Scope every data query to the authenticated user's ID from the token — never accept a user ID from the request body or URL for ownership decisions

Session 20 — Authorization: Roles & Policies

• Session 19 authenticated the caller — the API now knows who is making the request. Session 20 adds authorization: deciding what they are allowed to do based on their role or other attributes
• You will use the Role claim embedded in the token to restrict endpoints to specific roles with [Authorize(Roles = "Admin")]
• Policy-based authorization allows richer rules beyond roles — for example, "only the owner of a task may delete it" — implemented via custom IAuthorizationRequirement and handler classes
• The UserId claim added in this session becomes the key for ownership-based policies in Session 20

Add full JWT authentication to the Task Manager API and verify the complete authenticated flow.

What to build:

• Implement POST /api/auth/register and POST /api/auth/login with BCrypt password hashing and a GenerateToken helper that embeds the user ID, email, and role as claims
• Configure AddAuthentication / AddJwtBearer with all validation parameters and the correct middleware order in Program.cs
• Protect the entire TasksController with [Authorize] and scope all task queries to the authenticated user's ID read from the token claims

Acceptance criteria:

• Registering with a valid email and password returns 200; registering again with the same email returns 409
• Logging in with correct credentials returns a JWT token; incorrect credentials always return 401 with "Invalid credentials."
• Calling GET /api/tasks without a token returns 401; with a valid token returns 200 with only that user's tasks
• Calling GET /api/tasks with a tampered token (one character changed) returns 401
• Creating a task while authenticated stores the correct UserId from the token, not from the request body