Authentication & Authorization with JWT

By the end of this lesson you'll understand exactly what a JSON Web Token is made of, be able to read a token apart in plain C#, check whether it has expired, and issue and validate real tokens in ASP.NET Core with JwtSecurityTokenHandler and AddJwtBearer — the foundation of stateless API security.

1. Reading a Token Apart

Before you reach for any library, it helps to see that a JWT really is just a string. Splitting it on the . character gives you the three Base64Url segments. The header and payload are only encoded, so you can read them — which is exactly why you must never put a password or secret in the payload. Read this worked example, run it, then you'll split a token yourself.

using System;

class Program
{
    static void Main()
    {
        // A JWT is just a STRING with three parts joined by dots:
        //     header . payload . signature
        // Each part is Base64Url text — readable, but NOT secret.
        string token = "eyJhbGciOiJIUzI1NiJ9" +              // header
                       ".eyJzdWIiOiJ1c2VyLTEyMyJ9" +         // payload
                       ".3Tj8kKqHs2_signature_here";         // signature

        // Split on the '.' to see the three
...

Your turn. The program below is almost complete — fill in the two ___ blanks using the hints in the comments, then run it and check your output against the expected lines.

using System;

class Program
{
    static void Main()
    {
        // 🎯 YOUR TURN — split a token into its three parts, then print them.
        string token = "header123.payload456.signature789";

        // 1) Split the token string on the '.' character.
        string[] parts = token.Split(___);   // 👉 the dot character in 'single quotes': '.'

        // 2) Print how many parts you got (a valid JWT always has 3).
        Console.WriteLine($"Parts: {parts.Length}");

        // 3) Print ea
...

2. Claims and Signing

The payload carries claims — statements about the user such as "subject is user-123" and "role is Admin". The signature is what makes the token trustworthy: the server runs the header and payload through a one-way function together with a secret, and attaches the result. Change a single character of the payload and the signature no longer matches, so the token is rejected.

There are two families of signing. HMAC (e.g. HS256) uses one shared secret to both sign and verify — simple, fast, and ideal when the same service issues and checks tokens. RSA/ECDSA (e.g. RS256) uses a private key to sign and a separate public key to verify — so many services can validate tokens without ever holding the secret that creates them. That's the right choice for microservices and third-party APIs.

HMAC  HS256:  sign(secret)        verify(secret)        // same key
RSA   RS256:  sign(privateKey)    verify(publicKey)     // key pair

3. Issuing & Validating with JwtSecurityTokenHandler

In .NET, the type that builds and checks tokens is JwtSecurityTokenHandler. To issue a token you wrap your secret in a SymmetricSecurityKey, list your claims, set an expiry, and call WriteToken. To validate one you pass it through ValidateToken with a set of TokenValidationParameters describing what "valid" means — the right issuer, the right audience, an unexpired lifetime, and a signature that matches your key. This worked example does both in one run.

using System;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Microsoft.IdentityModel.Tokens;

class Program
{
    // The signing key must be SECRET and at least 32 bytes for HMAC-SHA256.
    // In real apps this lives in configuration, never hard-coded.
    private const string SecretKey = "ThisKeyMustBeAtLeast32BytesLong!!";
    private const string Issuer = "LearnCodingFast";
    private const string Audience = "LearnCodingFastAPI";

    static vo
...

4. Checking Expiry Yourself

The exp claim is stored as a Unix timestamp — the number of seconds since 1 January 1970. The library checks expiry for you, but knowing how to do it by hand makes the concept concrete and is useful when you decode a token outside ASP.NET. DateTimeOffset.FromUnixTimeSeconds(...) turns those seconds into a real date you can compare against DateTimeOffset.UtcNow.

Your turn. Fill in the two ___ blanks below to convert the timestamp and decide whether it's in the past:

using System;

class Program
{
    static void Main()
    {
        // 🎯 YOUR TURN — a JWT's "exp" claim is a Unix timestamp in SECONDS.
        // Work out whether the token has already expired.

        // This token claims to expire at this Unix time (seconds since 1970):
        long expUnixSeconds = 1000000000;   // that's the year 2001 — long gone!

        // 1) Turn the Unix seconds into a DateTimeOffset.
        DateTimeOffset expiry = DateTimeOffset.FromUnixTimeSeconds(___);  // 👉 pa
...

5. JWT Bearer Authentication in ASP.NET Core

In a real API you rarely call JwtSecurityTokenHandler by hand on every request. Instead you register JWT Bearer authentication once with AddAuthentication(...).AddJwtBearer(...) and the framework validates the Authorization: Bearer ... header automatically. Add app.UseAuthentication() before app.UseAuthorization(), then protect any endpoint with RequireAuthorization() (or the [Authorize] attribute on a controller).

// Program.cs — wire up JWT Bearer authentication in ASP.NET Core.
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Text;

var builder = WebApplication.CreateBuilder(args);

// AddAuthentication(...).AddJwtBearer(...) tells the framework:
// "Read the Bearer token from the Authorization header and validate it."
builder.Services
    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.T
...

This snippet is a complete ASP.NET Core minimal API — paste it into a web project's Program.cs. The validation rules mirror the ones from section 3; the difference is the framework now applies them to every incoming request for you.

using System;

class Program
{
    static void Main()
    {
        // 🎯 MINI-CHALLENGE: validate a fake token with plain logic (no libraries).
        // A token is VALID here only if ALL THREE checks pass:
        //   1. It splits into exactly 3 parts on '.'
        //   2. Its expiry (a Unix-seconds long below) is NOT in the past
        //   3. Its issuer string matches the one you expect
        //
        // Steps:
        //   - Split the token on '.' and check parts.Length == 3
       
...