While forms normally use username and password pairs to enforce authentication, that is not normally the case with APIs. However, the concepts of both authentication and authorization apply, too; authorization is ensured by means of roles, claims, or custom rules, but authentication is usually achieved through JSON Web Tokens(JWTs). JWTs are similar to cookies, but cookies are stored in the browser and web APIs are not usually called by a browser but by an API client. ASP.NET Core offers a mechanism for checking both the authentication of a request and for checking that the requester is entitled to do what it wants to do. Explaining how to do this is the purpose of this chapter.
Using JWTs
JWTs are open-standard—defined in RFC 7519—securely representing claims betweentwo connectingpartiesusing HTTP for communication. The spec is available athttps://tools.ietf.org/html/rfc7519.
Using JWTs is similar to using...
