JWT Refresh Token in ASP.Net Core (a deep dive)

The volume of the video is a little low, I apologize in advance. Please increase the volume of the device you are listening in. I will fix the issue before the next video recording.
Today in the video I am going to go through what is JWT Refresh Token and how to create them in detail.
JWT Refresh token is used for getting a new JWT token after the first token is expired. Instead of sending the user id and password every time when we renew a JWT token, we can use the refresh token for that purpose.

[@ksdvishnukumar]

It really helped me a lot to understand the JWT concepts and to implement the same... Hats off to you to make such a valuable video for better understanding...

[@DotNetCoreCentral]

VISHNU KUMAR thanks! I’m glad the video helped you.

[@DevKumar-nh6vk]

For Refresh API, "do we need to pass anything in Header". For me evetime refresh API giving 401. Not able to get what is Wrong. As in Body already passing RefreshCred(jwt token & refreshToken).

[@dfytq]

Excellent tutorial boss. Please make a discussion on how to optimize dbcontext and configure connection pooling for entityframework core.

[@birendrasahu5777]

Awesome . Cleared my doubts. Thank you bro 🙏

[@DotNetCoreCentral]

@Birendra Sahu, thanks for watching!

[@eliassal1]

Again, 2 fantastic , helpful and well explained videos (in spite of the fact that I got lost a little bit between the different objects :-) as this is very new to me ). Just to validate my understanding, so once we call the refresh api, to reauthenticate, 1 hour later, we should use the RefreshToken for reauthentificiation, am I correct or it is the original Jwtoken that will be extended by another hour?

[@DotNetCoreCentral]

@Salam Elias, you are correct, you need to provide the refresh token for refreshing and getting a new token.

[@alihaydar3021]

Great job 👍 again)) but I think the expired of refresh token needs to be more than 1 hour this exactly the duty of refresh token but you copy paste the same time if jwt token

[@DotNetCoreCentral]

@Ali Haydar, thanks for watching! Yes, I copied and pasted without changing just for the interest of time, but yes refresh tokens are usually much longer-lived compared to a normal token.

[@koushikdas5122]

System.InvalidOperationException: 'Action 'Auth.Demo.Controllers.NameController.Authenticate (Auth.Demo)' has more than one parameter that was specified or inferred as bound from request body. Only one parameter per action may be bound from body. Inspect the following

[@koushikdas5122]

Pls sir look into this

[@DotNetCoreCentral]

​@@koushikdas5122 can you share your code here, the part where you are getting error

[@boredo7502]

Do you have Git repo for this? it was a nice video thanks!

[@DotNetCoreCentral]

Yes I have. github.com/choudhurynirjhar/auth-demo

[@shreeprasadlohar9564]

@@DotNetCoreCentral This is supposed tobe added in description. Anyways thanks..🙂🙂

[@rahuljadhav6022]

Thank you Brother....!

[@DotNetCoreCentral]

@Rahul jadhav, thanks for watching!

[@manasmalik9133]

After the expiry of the access token, a new access token is not generated even with the Refresh Token. public AuthResponse Refresh(RefreshCredential refreshCredential)
{
SecurityToken validatedToken;
var tokenHandler = new JwtSecurityTokenHandler();
var principal = tokenHandler.ValidateToken(refreshCredential.AccessToken, new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey = new SymmetricSecurityKey(key),
ValidateIssuer = false,
ValidateAudience = false
}, out validatedToken);

[@anshulasati4778]

Hi, why does this code not refresh the expired JWT token.?

[@carecovered1434]

In a realistic world, Will user be sending us both JWTToken and Refresh token and on API we need to first check if JWTToken is valid(not expired too) if expired then to use RefreshToken to validate?

[@DotNetCoreCentral]

@Care Covered, in the real world scenario, ideally the caller should be sending refresh token only when the auth token is expired. And the caller finds it out based on the Auth error response from the service. That is the workflow that is what I have seen normally used.

[@Stuntman5701]

im just kinda confused.
why does a jwt token expire that quickly when i could regenerate a new one with the refreshkey anyways?
if someone steals my cookies im fucked anyways

[@Marv3Lthe1]

Why should I use refresh token instead of increasing the timeout of my original JWT token ?

[@DotNetCoreCentral]

@Marv3Lthe1, the reason you don't want to use a longer timeout is that if your token is stolen you will remain vulnerable for a longer time, hence using a refresh token.

[@nirajdahal5019]

Hello sir!! How do we add external login providers like facebook, google, linkedin etc in .net core web api.. for example: How do i add extra login providera like google facebook in this project that you have taught us?

[@DotNetCoreCentral]

Niraj Dahal so if I understand your requirement properly, you want to use Facebook or google etc as oauth provider. It should be similar way using a middleware. I can give it a try in a future video. Thanks

[@anushreedesai7505]

Can you tell how can we generate JWT token using azure active directory (using client, tenant id etc) ?

[@DotNetCoreCentral]

@Anushree Desai, generating JWT token is similar, but I have dot done it using azure active directory service before, so I cannot tell for sure what goes into it. Once I try it out I can let you know.

[@MuhammadKamran-xj6jw]

Is this sliding token concept?

[@ayan-qn9or]

If you please post a tutorial video on integration testing using key token, when token is generated in different api would be very helpful. Thanks.

[@DotNetCoreCentral]

@ayanghosh thanks for watching! Sure I will give it a try.

[@ayan-qn9or]

@@DotNetCoreCentral Thanks.

[@ashokkumarnaralasetti4860]

I think without refresh key also we can regenerate token right

[@DotNetCoreCentral]

@AshokKumar Naralasetti, yes.

[@shuhaib864]

Very nice video. Thanks 🙏
Can you please try to do a video about Open ID connect using identity server 4?

[@DotNetCoreCentral]

@Muhammed Shuhaib, I will put it in my queue, thanks!

[@AzZaph]

after receiving the refresh token after jwt expires. Which one should be use in the Authorization?

[@DotNetCoreCentral]

@Flote Fuertes, thanks for watching. You should use a refresh token to get the new token only. For authentication, you should use the new token received with the help of a refresh token.

[@AzZaph]

@@DotNetCoreCentral Thank you very informative content

[@DotNetCoreCentral]

@@AzZaph you are welcome!

[@arslansaleem8629]

please shear the link of other videos you have mention at the start of this video

[@DotNetCoreCentral]

@Arslan Saleem, all the videos are available on my channel.

[@PankajNikam]

Please share the repo in description.

[@DotNetCoreCentral]

It's in here: dotnetcorecentral.com/blog/authentication-handler-in-asp-net-core/
Thanks for watching the video.

[@mrjamiebowman]

Is there a GitHub for this code? Would be helpful.

[@DotNetCoreCentral]

@Jamie Bowman, yes. github.com/choudhurynirjhar/auth-demo

[@sukurullasheikh3301]

hello sir do you have git repo please send the project git repo link we need to undestand

[@DotNetCoreCentral]

@sukurulla sheikh, here is the repo: github.com/choudhurynirjhar/auth-demo

[@unknown3164]

link to the repository github.com/choudhurynirjhar/auth-demo

[@techbuzz3869]

Plz explain .net core project structure and easy to code tips

[@DotNetCoreCentral]

tech buzz I’m not sure I understand completely what are you looking for. Can you please elaborate?

[@techbuzz3869]

@@DotNetCoreCentral .net core basic project folder, which files will use for what

[@DotNetCoreCentral]

@@techbuzz3869 Ok, I will make a video in the future for that. Thanks for the feedback

[@vattikiti]

Can you please give us the link of the source code

[@DotNetCoreCentral]

@V VV, thanks for watching! The source code is available in my GitHub report here: github.com/choudhurynirjhar/auth-demo

[@umasankar9971]

Could you please share the source code for this

[@DotNetCoreCentral]

github.com/choudhurynirjhar/auth-demo

[@Vennix13]

Hey, really good video, but do you have any source code ? like on github pls ?

[@DotNetCoreCentral]

@Vennicks, thanks for watching! Here is the repo link: github.com/choudhurynirjhar/auth-demo

[@Vennix13]

@@DotNetCoreCentral thanks a lot !

[@DotNetCoreCentral]

@@Vennix13 you are welcome!

[@shivaprasadmanchala3955]

I need to destroy jwt token when user logout...can u please let me sir

[@DotNetCoreCentral]

SHIVA PRASAD MANCHALA on your logout API call you can remove the token from the toke store.

[@shivaprasadmanchala3955]

Sir if u have repository....can u please share sir

[@shivaprasadmanchala3955]

Am not saving token in database

[@Engineer_With_A_Life]

@@shivaprasadmanchala3955 you can remove token from the client storage/browser

[@PAJANI1910]

i followed your tutorial, but the token expiry is not working.. i created the token for 2 minutes, but my token is working more than 2 minutes. Then i go through some other videos. x.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(secreteKey)),
ValidateLifetime = true,
ValidateIssuer = false,
ValidateAudience=false,
ClockSkew= TimeSpan.Zero

};, in that they used ClockSkew property for token expiry. after i put ClockSkew , my token is not working more than two minutes.

[@DotNetCoreCentral]

@Pajani Arjunan, I will verify and let you know.