jwt-auth-setup

JWT Auth Setup (ASP.NET Core)

Wire up JWT bearer authentication and authorization in an ASP.NET Core API with secure defaults: token issuing, validation, refresh tokens, and policy-based authorization.

Input — point it at your project

If they point at a project or repo, inspect the existing auth setup before changing anything:

• A project or repo root — find the auth wiring and review it.
• A GitHub URL — clone first, then inspect: git clone --depth 1 <url> /tmp/repo && cd /tmp/repo

Discover current state yourself, e.g.:

grep -rn "AddAuthentication\|AddJwtBearer\|TokenValidationParameters\|AddAuthorization\|RequireAuthorization\|RequireHttpsMetadata" --include=*.cs <target> | grep -vi "/obj/\|/bin/"

If auth already exists, review and harden it (validation flags, HTTPS metadata, ClockSkew, refresh-token handling, where the signing key lives) rather than re-adding from scratch, and flag any access-control gaps (endpoints without RequireAuthorization / no fallback policy).

When this runs

The user wants to secure an API with JWTs, or wants their existing auth reviewed. If new: confirm whether they're issuing tokens themselves (own login) or validating tokens from an external IdP (Azure AD / Auth0 / Keycloak). Defaults below cover self-issued; for external IdP, the validation half is the same and issuing is delegated.

Packages

dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer
dotnet add package System.IdentityModel.Tokens.Jwt

Validation wiring (Program.cs)

var jwt = builder.Configuration.GetSection("Jwt");

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = jwt["Issuer"],
            ValidAudience = jwt["Audience"],
            IssuerSigningKey = new SymmetricSecurityKey(
                Encoding.UTF8.GetBytes(jwt["Key"]!)),
            ClockSkew = TimeSpan.FromSeconds(30) // tighten the default 5 min
        };
    });

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("AdminOnly", p => p.RequireRole("Admin"));
    options.AddPolicy("CanManageOrders", p => p.RequireClaim("permission", "orders:manage"));
});

// ... after build:
app.UseAuthentication();
app.UseAuthorization();