Refresh Token Using ASP.NET Core 2.0 And JSON Web Token – ASP.NET Hosting Review Best & Recommnedation

Notice: A non well formed numeric value encountered in C:\ClientSites\bestaspnethostingreview.com\httpdocs\wp-content\plugins\crayon-syntax-highlighter\crayon_formatter.class.php on line 118

Notice: A non well formed numeric value encountered in C:\ClientSites\bestaspnethostingreview.com\httpdocs\wp-content\plugins\crayon-syntax-highlighter\crayon_formatter.class.php on line 119

Notice: A non well formed numeric value encountered in C:\ClientSites\bestaspnethostingreview.com\httpdocs\wp-content\plugins\crayon-syntax-highlighter\crayon_formatter.class.php on line 118

Notice: A non well formed numeric value encountered in C:\ClientSites\bestaspnethostingreview.com\httpdocs\wp-content\plugins\crayon-syntax-highlighter\crayon_formatter.class.php on line 119

Notice: A non well formed numeric value encountered in C:\ClientSites\bestaspnethostingreview.com\httpdocs\wp-content\plugins\crayon-syntax-highlighter\crayon_formatter.class.php on line 118

Notice: A non well formed numeric value encountered in C:\ClientSites\bestaspnethostingreview.com\httpdocs\wp-content\plugins\crayon-syntax-highlighter\crayon_formatter.class.php on line 119

Notice: A non well formed numeric value encountered in C:\ClientSites\bestaspnethostingreview.com\httpdocs\wp-content\plugins\crayon-syntax-highlighter\crayon_formatter.class.php on line 118

Notice: A non well formed numeric value encountered in C:\ClientSites\bestaspnethostingreview.com\httpdocs\wp-content\plugins\crayon-syntax-highlighter\crayon_formatter.class.php on line 119

Notice: A non well formed numeric value encountered in C:\ClientSites\bestaspnethostingreview.com\httpdocs\wp-content\plugins\crayon-syntax-highlighter\crayon_formatter.class.php on line 118

Notice: A non well formed numeric value encountered in C:\ClientSites\bestaspnethostingreview.com\httpdocs\wp-content\plugins\crayon-syntax-highlighter\crayon_formatter.class.php on line 119

Notice: A non well formed numeric value encountered in C:\ClientSites\bestaspnethostingreview.com\httpdocs\wp-content\plugins\crayon-syntax-highlighter\crayon_formatter.class.php on line 118

Notice: A non well formed numeric value encountered in C:\ClientSites\bestaspnethostingreview.com\httpdocs\wp-content\plugins\crayon-syntax-highlighter\crayon_formatter.class.php on line 119

Notice: A non well formed numeric value encountered in C:\ClientSites\bestaspnethostingreview.com\httpdocs\wp-content\plugins\crayon-syntax-highlighter\crayon_formatter.class.php on line 118

Notice: A non well formed numeric value encountered in C:\ClientSites\bestaspnethostingreview.com\httpdocs\wp-content\plugins\crayon-syntax-highlighter\crayon_formatter.class.php on line 119

BestASPNETHostingReview.com | Best and cheap ASP.NET Core 2.0 Hosting. In this article , you will learn how to deal with the refresh token when you use jwt (JSON Web Token) as your access_token.

Many people choose jwt as their access_token when the client sends a request to the Resource Server.

However, before the client sends a request to the Resource Server, the client needs to get the access_token from the Authorization Server. After receiving and storing the access_token, the client uses access_token to send a request to the Resource Server.

But as all we know, the expired time for a jwt is too short. And we do not require the users to pass their name and password once more! At this time, the refresh_token provides a vary convenient way that we can use to exchange a new access_token.

The normal way may be as per the following.

I will use ASP.NET Core 2.0 to show how to do this work.

Requirement first

You need to install the SDK of .NET Core 2.0 preview and the VS 2017 preview.

Now, let’s begin!

First of all, building a Resource Server

Creating an ASP.NET Core Web API project.

Edit the Program class to specify the url when we visit the API.

public class Program  
{  
    public static void Main(string[] args)  
    {  
        BuildWebHost(args).Run();  
    }  
  
    public static IWebHost BuildWebHost(string[] args) =>  
        WebHost.CreateDefaultBuilder(args)  
            .UseStartup<Startup>()  
            .UseUrls("http://localhost:5002")  
            .Build();  
}

public class Program

{

public static void Main(string[] args)

{

BuildWebHost(args).Run();

}

public static IWebHost BuildWebHost(string[] args) =>

WebHost.CreateDefaultBuilder(args)

.UseStartup<Startup>()

.UseUrls("http://localhost:5002")

.Build();

}

Add a private method in Startup class which configures the jwt authorization. There are some differences when we use the lower version of .NET Core SDK.

public void ConfigureJwtAuthService(IServiceCollection services)  
{  
    var audienceConfig = Configuration.GetSection("Audience");  
    var symmetricKeyAsBase64 = audienceConfig["Secret"];  
    var keyByteArray = Encoding.ASCII.GetBytes(symmetricKeyAsBase64);  
    var signingKey = new SymmetricSecurityKey(keyByteArray);  
  
    var tokenValidationParameters = new TokenValidationParameters  
    {  
        // The signing key must match!  
        ValidateIssuerSigningKey = true,  
        IssuerSigningKey = signingKey,  
  
        // Validate the JWT Issuer (iss) claim  
        ValidateIssuer = true,  
        ValidIssuer = audienceConfig["Iss"],  
  
        // Validate the JWT Audience (aud) claim  
        ValidateAudience = true,  
        ValidAudience = audienceConfig["Aud"],  
  
        // Validate the token expiry  
        ValidateLifetime = true,  
  
        ClockSkew = TimeSpan.Zero  
    };  
     
    services.AddAuthentication(options =>  
    {  
        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;  
        options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;  
    })  
    .AddJwtBearerAuthentication(o =>  
    {  
        o.TokenValidationParameters = tokenValidationParameters;  
    });  
}

public void ConfigureJwtAuthService(IServiceCollection services)

{

var audienceConfig = Configuration.GetSection("Audience");

var symmetricKeyAsBase64 = audienceConfig["Secret"];

var keyByteArray = Encoding.ASCII.GetBytes(symmetricKeyAsBase64);

var signingKey = new SymmetricSecurityKey(keyByteArray);

var tokenValidationParameters = new TokenValidationParameters

{

// The signing key must match!

ValidateIssuerSigningKey = true,

IssuerSigningKey = signingKey,

// Validate the JWT Issuer (iss) claim

ValidateIssuer = true,

ValidIssuer = audienceConfig["Iss"],

// Validate the JWT Audience (aud) claim

ValidateAudience = true,

ValidAudience = audienceConfig["Aud"],

// Validate the token expiry

ValidateLifetime = true,

ClockSkew = TimeSpan.Zero

};

services.AddAuthentication(options =>

{

options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;

options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;

})

.AddJwtBearerAuthentication(o =>

{

o.TokenValidationParameters = tokenValidationParameters;

});

}

And, we need to use this method in the ConfigureServices method.

public void ConfigureServices(IServiceCollection services)  
{  
    //configure the jwt   
    ConfigureJwtAuthService(services);  
  
    services.AddMvc();  
}

public void ConfigureServices(IServiceCollection services)

{

//configure the jwt

ConfigureJwtAuthService(services);

services.AddMvc();

}

Do not forget touse the authentication in the Configure method.

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)  
{  
    loggerFactory.AddConsole(Configuration.GetSection("Logging"));  
    loggerFactory.AddDebug();  
  
    //use the authentication  
    app.UseAuthentication();  
  
    app.UseMvc();  
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)

{

loggerFactory.AddConsole(Configuration.GetSection("Logging"));

loggerFactory.AddDebug();

//use the authentication

app.UseAuthentication();

app.UseMvc();

}

The last step of our Resource Server is to edit the ValueController so that we can use the authentication when we visit this API.

[Route("api/[controller]")]  
public class ValuesController : Controller  
{  
    // GET api/values/5  
    [HttpGet("{id}")]  
    [Authorize]  
    public string Get(int id)  
    {  
        return "visit by jwt auth";  
    }          
}

[Route("api/[controller]")]

public class ValuesController : Controller

{

// GET api/values/5

[HttpGet("{id}")]

[Authorize]

public string Get(int id)

{

return "visit by jwt auth";

}

Turn to the Authentication Server

How to design the authentication?

Here is my point of view,

When the client uses the parameter