People Who Code | Blog: September 2024

JWT (JSON Web Tokens) in a .NET Framework 4.5 application, you can use the System.IdentityModel.Tokens.Jwt

Install the JWT Library: Use NuGet Package Manager to install the necessary JWT libraries. Open the Package Manager Console and run:
```
Install-Package System.IdentityModel.Tokens.Jwt -Version 5.0.0
```

Create a Token: Here’s an example of how to create a JWT:

c
using System;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Microsoft.IdentityModel.Tokens;

public class TokenGenerator
{
    public string GenerateToken(string secretKey)
    {
        var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey));
        var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);
        
        var claims = new[]
        {
            new Claim(JwtRegisteredClaimNames.Sub, "your_user_id"),
            new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
        };

        var token = new JwtSecurityToken(
            issuer: "yourIssuer",
            audience: "yourAudience",
            claims: claims,
            expires: DateTime.Now.AddMinutes(30),
            signingCredentials: credentials
        );

        return new JwtSecurityTokenHandler().WriteToken(token);
    }
}

Validate a Token: To validate the JWT, use the following method:

csharp
public ClaimsPrincipal ValidateToken(string token, string secretKey)
{
    var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey));
    var tokenHandler = new JwtSecurityTokenHandler();

    try
    {
        tokenHandler.ValidateToken(token, new TokenValidationParameters
        {
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = securityKey,
            ValidateIssuer = false,
            ValidateAudience = false,
            ClockSkew = TimeSpan.Zero
        }, out SecurityToken validatedToken);

        return (ClaimsPrincipal)validatedToken;
    }
    catch
    {
        return null; // Token is invalid
    }
}

Use the Token: Now you can generate and validate JWTs in your application. Call the GenerateToken method when you need to create a token, and ValidateToken to check a token.

Important Notes:

Ensure you keep your secret key safe.
Adjust the issuer, audience, and claims as necessary for your application.
Be aware of security best practices when working with tokens, including expiration and revocation strategies.

This approach allows you to integrate JWT functionality in your .NET 4.5 application efficiently.

Complete Example of JWT Implementation

1. Setup the Project

Create a new ASP.NET Web API project targeting .NET Framework 4.5.

2. Install Necessary Packages

Use the NuGet Package Manager Console to install the following package:

bash
Install-Package System.IdentityModel.Tokens.Jwt -Version 5.0.0

3. Create a Model for User

Create a simple model for the user:

csha
public class User
{
    public string Username { get; set; }
    public string Password { get; set; }
}

4. Token Generation Logic

Create a service to handle token generation:

cs
using System;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Microsoft.IdentityModel.Tokens;

public class TokenService
{
    private readonly string secretKey = "your_secret_key"; // Use a strong secret key

    public string GenerateToken(string username)
    {
        var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey));
        var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);

        var claims = new[]
        {
            new Claim(JwtRegisteredClaimNames.Sub, username),
            new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
        };

        var token = new JwtSecurityToken(
            issuer: "yourIssuer",
            audience: "yourAudience",
            claims: claims,
            expires: DateTime.Now.AddMinutes(30),
            signingCredentials: credentials
        );

        return new JwtSecurityTokenHandler().WriteToken(token);
    }
}

5. Create a Login Endpoint

In your API controller, create a login endpoint that authenticates users and returns a JWT:

csharp
using System.Web.Http;

public class AuthController : ApiController
{
    private readonly TokenService _tokenService = new TokenService();

    [HttpPost]
    [Route("api/auth/login")]
    public IHttpActionResult Login([FromBody] User user)
    {
        // Here, validate the user's credentials. This is just an example.
        if (user.Username == "testuser" && user.Password  "password")
        {
            var token = _tokenService.GenerateToken(user.Username);
            return Ok(new { token });
        }

        return Unauthorized();
    }
}

6. Token Validation Middleware

Create middleware to validate the token on protected routes

public class TokenValidationAttribute : AuthorizeAttribute
{
    protected override bool IsAuthorized(HttpActionContext actionContext)
    {
        var token = actionContext.Request.Headers.Authorization?.Parameter;
        if (token == null)
            return false;

        var tokenService = new TokenService();
        var principal = tokenService.ValidateToken(token);

        if (principal == null)
            return false;

        actionContext.RequestContext.Principal = principal;
        return true;
    }
}

7. Protecting Routes

Use the TokenValidationAttribute to protect specific routes in your API:

csh
public class ValuesController : ApiController
{
    [HttpGet]
    [Route("api/values")]
    [TokenValidation]
    public IHttpActionResult GetValues()
    {
        return Ok(new string[] { "value1", "value2" });
    }
}

8. Token Validation Logic

Implement the ValidateToken method in TokenService:

csh
public ClaimsPrincipal ValidateToken(string token)
{
    var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey));
    var tokenHandler = new JwtSecurityTokenHandler();

    try
    {
        tokenHandler.ValidateToken(token, new TokenValidationParameters
        {
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = securityKey,
            ValidateIssuer = false,
            ValidateAudience = false,
            ClockSkew = TimeSpan.Zero
        }, out SecurityToken validatedToken);

        return (ClaimsPrincipal)validatedToken;
    }
    catch
    {
        return null; // Token is invalid
    }
}

Running the Application

Login Request: Send a POST request to api/auth/login with the following JSON bo
```
{
    "Username": "testuser",
    "Password": "password"
}
```
If successful, you will receive a token.
Access Protected Resource: Use the token received from the login response to access the protected route api/values. Include the token in the Authorization header as a Bearer token:
```
makefile
Authorization: Bearer your_jwt_token
```

Conclusion

This example demonstrates how to create a simple JWT authentication mechanism in a .NET Framework 4.5 Web API. Adjust the code as necessary for your authentication logic and ensure your secret keys are securely managed.

People Who Code | Blog

How can use jwt lowest dot net version 4.5