Secure a .NET Core API with Bearer Authentication
HTML-код
- Опубликовано: 24 фев 2020
- In this step by step tutorial, I show you how to secure a .NET Core API with JWT Bearer Authentication, using Azure Active Directory as the Identity and Access Management Layer. I also show you how to write a “secure” API client to call and authenticate to the secured API endpoint.
We use the Microsoft.Identity.Client and Microsoft.AspNetCore.Authentication.JwtBearer packages amongst others.
Level: Intermediate
Code on GitHub: github.com/binarythistle/S03E...
Companion Article: dotnetplaybook.com/secure-a-n...
My Book: www.apress.com/gp/book/978148... 
Наука
I'm going to keep the track on this season, great series of tutorials. Awsome job man, just awsome!
Thank you for putting this video together. This was especially relevant to something I am working on now and helped clarify a topic I was finding otherwise confusing when trying to read through the documentation. This video made is simple and straightforward. I've liked and subscribed, thank you again!
I went through all the steps. Wounderfully explained! Keep up the hard work!
This is really great. I watched about a million videos and blogs and all are talking bits and pieces but couldn’t get a complete picture. This session gave me the whole picture and finally I am able to successfully build a system for my purpose. Great explanations. Really loved !!!!
Love your teaching style, very realistic and practical explanation. Thanks very much for making this video, you have demystified the Bearer Authentication a great deal
By far, the best tutorial on authentication. Thank you so much for this amazing tutorial.
That is a great video tutorial. Thanks for explaining everything in a detailed manner. Looking forward to seeing more videos from you.
After searching for many many hours on this topic, with no luck, I came across this video. You explained things clearly and made a lot of sense out of a confusing topic. Many thanks!!
First time seeing your videos... subscribed to your channel in the middle of watching the video. Great content and great delivery! I'll look through to see some of your other titles and look forward to what you do in the future. Thanks for the great work.
Thank you for explaining everything so clearly. I’ve been wanting to learn this for a long time. Since I started watching your videos it finally starts to make sense to me.
I dont mean to be offtopic but does someone know of a trick to log back into an Instagram account??
I stupidly lost my login password. I would appreciate any tricks you can offer me.
This is honestly the best .NET Core channel out there.
Les Jackson Sir. You save my lot of time. This is exactly what I have assigned to do. Superb!!!
Absolutely love the way you've explained all of this. I've been googling, watched other videos, tutorials, but nothing comes even close to what you've done here. Cannot thank you enough!
Would love for you to have a video on setting up an Azure WebApp running behind an Azure Front Door.
Les Jacson σε ευχαριστούμε που υπάρχεις και μας δίνεις τόσες χρήσιμες συμβουλές!!
46:50 - music got me off the edge of my seat. The suspension was intense. Good video btw Les
Wow! How easily you have explained this complicated topic. Thanks for sharing this video.
Awesome video, best teacher I have ever seen. Now I understand that whole bunch of Azure AD authentication via JWT Bearer Token in only 60 minutes. Thumbs up :-)
Thank you so much. I have taken up learning about securing an Api and this video was a great beginning.
Great video! I'm a Sr Software Engineer (and manager) and found a lot of value in your video. Explained everything very well! Thanks for sharing!
I found a lot of value in this video and the way it is explained is very impressive! Great video. Loved it
Fantastic video - it's nice to follow a video through to the end and everything works! - I added the token to Postman and received a status 200 OK - looking forward to S3 E2 - thanks!
Like your videos and style a lot! Will for sure buy your book in the near future! Thanks for the awesome material!
You are a complete champion my friend, thanks!
Thank you Les for your time. I was getting crazy until I saw your video with the resourceId "/.default" . I missed this part. Thank you.
Thank you so much man, you just tabledout a lot for most of us. Awesome video
Hi Les,
thank you for your time and for sharing with us this video 🤞
Thanks for putting this together! It really helped clarify a lot of things for me.
Watching your video like some rocking movies....Great mate!
Oh wow! Thanks Sandeep!
The best video ever. Very well explained. What is missing is additional video in case you have swagger and you need to be able to test the API using AAD.
The Key things in your Videos are Very well explained, Practical usage and content oriented. Thank you so much for sharing your knowledge.
Fantastic!!
This was a great tutorial coupled with lucid explanation.
Excellent tutorial. Thanks a lot for demonstrating the practical approach.
Great channel! Thank you Les! Keep up the good work
Awesome step by step tutorial for authenticating .Net core API.
Pretty neat explanation in layman terms and been searching for this kind of video...thank you so much.
Awesome! Cheers Lokesh!
You are really fantastic Jackson..Thanks for this wonderful session
Hi Les,
Just wanted to say thank you for making this video. This what i need to figure it out the Authentication flow on Azure Ad.
So beautifully explained and coded. Thank You for making such stuff
It's October 2022 but for me it's still the best free material about a practical approach to learn authentication in .NET on the internet.
Great job. Congratulations and thank you!
Which channel best for paid version?
I really enjoyed the video! Great job and VERY helpful.
Thanks Les, great video as always :)
Thank you so much ... i loved it .. tried the same with Azure CLI since I wasn't having an access to Azure AD ... had a hard time with command line but now i can relate this stuff and search for precise Azure CLI commands ... Thanks again..
Thank you Les. This is really very helpful video and you explained every step very well . I was very much confused regarding this azure active directory steps . Now understand very well. I would love to watch your more videos.Thank you again.
Great video Les....I have been following your videos and found them extremly crisp and to the point without rushing in....It would be great if you did video on a production quality code for a small microservice app which would include Authentication / Authorization, Unit Testing etc. I know it might be a long video, but still it might be of great help...Thanks for your effort mate...
Super informational video. Followed it along in VSCode and although I had some issues in Azure (Granting API access was greyed out), it all worked and I can say I learned something very useful! Thanks for sharing!
Ok, Les, you got me! I spent 2 days on your 3 hr. API video and transferred all that knowledge to my big project, works Great! Now adding the tokens. Lots of little bumps that force a good developer to understand their environments, like sometimes VS Code just gets lost and you have to restart it, all good. I love your stuff is CURRENT! 2017 is ancient times in technology;-) Enjoy the wine, wish I could deliver it personally and share a bottle to thank you. I think that would be a riot! Keep going and good luck! Oh yes, you should get yourself a green screen;-)
I immediately hit subscribe just by looking at the shelf in the background :) my kinda guy. Pluss, ofcourse, the content seems spot on for me (after 5 minutes in)
Superb Video Les!! Thank you soo much for explaining in detail.
Fantastic! As always.
Jack, it was nice explanation,and cool to understand , thanks for the video.
It's a very excellent video to explain such complicated topic and used the easiest way to demo how to achieve most of requests as we have to make sure them running in demon mode! thanks!
Thank you so much for sharing your knowledge on this channel.
You made me a wise man :-)
Great video again Les.
Wow this is awesome.. it'd be really helpful if you could make a series on this topic with other types of clients too. Loved it Les. Thank you so much
Thank for nicely explaining the concept step by step, It was crystal clear :-).
Thank you so much for this tutorial, very well explained it helped me a lot.
Greatest .net core tutorial out there!
Very Satisfying video! content cleared laid out! I enjoyed and learned thoroughly! Best tutorial better than Udemy and Plural sight content! Thank you, Subscribed!!
Thank you so much Les!!. Excellent!1 Real world problem and you covered it perfect. Easy to understand.
Cool glad it helped you out! Cheers, Les
Thanks Les for amazing video !!!!!!!!
This is fantastic. Cheers mate!
My pleasure mate! Cheers, Les
Excellent and well explained one of the complicated topic, great work!!
Thanks!
Great job! very well explained, bit by bit..
great tutorial! man, thanks so much!
Very well done, sir! Thank you!
Les thanks for the video. It was helpful.
Great job you just got a new sub
Covered a good amount in a video while making it simple
Congratulations with the great vídeo!
Man that was cool - I just happened to be working on exactly these implementations, great clarity, fun music.
Glad it was helpful!
@@binarythistle 25:56 you missed the "/" between the values in authority....man i was so confused for an hour that why this is not working just for me
This video is amazing. It really helped me a alot - thanks a bunch :)
Wonderful video, very nicely explained, This was really helpful to me. Thank you.
Great tutorial, thanks!
Nice job, thanks for sharing your knowledge! From now on "Les is more for sure".
Great video! Thanks man.
Great Video. Thanks for creating such a wonder video which is easily understandable.
Awesome video Les :)
I just finish :-)!! thank you a lot for all the tips, I really enjoy and learn with your way of teaching
Hi Carolina! I'm so happy to hear that - great work! And thank you for your kind feedback. Take care, Les
Hie, for me Grant permission button at 36:30 time , the button is disabled its not working can you tell me the reason
Watch out on minute 31. Azure added an extra field when creating a client secret. Make sure you copie the value and not the ID!!
Super video thank you so much.
Great Video. It saves me. I see a lot of implementation but they are quite complicated and not complete.
well explained, even if im not azur developer, the concepts are well explained. keep going with the good work
Thanks for such a great video
This is extremely usefull! thanks!
Another great video from Les. I enjoy his teaching style and clear explanations. But I had to ditch this approach for securing the API I'm building because I cannot see how to set up user roles with this approach. I'm probably missing something simple, but it's throwing me for a loop. I would love to see a video showing how to set up user login and adding user role claims to the JWT token in Azure.
Thank you for nice explanation , it helped a lot...
Excellent video. Thanks
Thank you so much. You saved me.
[EDIT] - I forgot to say thank you for the video, extremely useful indeed!
17:25 Regarding your advice not to use appsettings.json for production use. I can appreciate that there is a need to be careful with this during development: the application is on your local machine along with the appsettings.json file which reveals security critical information. And you certainly wouldn't want to commit that to git or any other version control.
But once you've deployed to your production environment I feel like it's pretty safe to use appsettings.json. This is because the file is then on the server (be it Azure or somewhere else). Nobody else has access to it. And, if they do, it means they already have control of your server and therefore the security has already been compromised.
So on local machine: be careful with appsettings.json as it contains secure information.
On production (deployed to server): appsettings.json is OK.
Do you disagree?
Thank you very much for the amount of information that you made easy for us and that saved a lot of time, but frankly I was looking forward to seeing an illustrative example of a safe verification method for user authorization as full stack example :). We all very grateful for your efforts.
Best Regards
This is awesome!
fantastic sir,huge fan of you
I like your other videos that have broken the parts of your video, it's easy to follow because I will know what topic you're talking to that point. It's hard to watch the video for more than 15 minutes.
Greate video, thanks a lot, you have really good teaching skill
Thanks for this video!
Great video!
Thank you so much for the crystal clear explanation. I was able to follow without any problem. Thanks once again for the great videos. Could you please do some videos on Microsoft Azure Services for Developers.
Les(s) is More, actullay ! .. Thanks again for the great video !! :)
I am at 5:28, and I had no any info earlier, how this works, just what you show on your diagram, and scenario. Just for fun, from your diagram, I guess, the way it works is, that the JSON token is signed by one of Azure's private keys and the dot net core tool kit has the Azure's public key(s). This is how I'd implement this. I am looking for the end of the story, if I was right. Your videos are tremendously entertaining.
Good stuff again from Les
Wonderful session @Les
The best thank you for the great job that youre doing