JWT Navigator for .NET APIs

Lazy JWT Key Rotation in .NET: Redis-Powered JWKS That Just Works

In the previous article we added the two standard JWKS discovery endpoints to our authentication server. As part of the OpenId Connect (OIDC) protocol, the first of these endpoints enables an API to discover where the other relevant endpoints are and the second endpoint publishes the public keys that clients

The Ultimate JWKS Setup for Robust JWT Validation in ASP.NET 10

This article isn't going to be as long as the previous article, but it's going to be just as interesting and powerful. I'm going to be covering JWKS, that is, a JSON Web Key Set. Why JWKS matters for scalable API's In

Revoke JWTs in .NET: Stop Stolen Tokens Dead with Simple Code

In the last article, we finished the topic we started in the article before last, which was refreshing tokens. We're developing API's that use JWT (JSON Web Tokens) as access tokens to provide a secure, self-contained way of authenticating using a compact URL-friendly format. All the

JWT Refresh Tokens Done Right: Proactive Background Refresh + Rotation + Sliding Expiry in ASP.NET Core

In the previous article, we built out our authentication server API to include an endpoint to refresh our JWT. We created a SQLite database to store them and we implemented a rotation policy based on the OAuth 2.1 specification. Then we built a client API to call the authentication

Refresh Tokens Done Right: Avoid Common JWT Pitfalls in .NET

In the previous article, we built an ASP.NET Minimal API in .NET 10 with JWT authentication. In this article, we're going to take the code we wrote last time and extend it to include refresh tokens, so we in effect have our own authentication server. That means

Build a Secure .NET Minimal API with JWT Authentication – Step by Step

In the previous article, I discussed the structure of a JWT, how to construct one manually in code and the principles behind each step of the process. In this article I'm going to take that knowledge and show you how to build a working ASP.NET Minimal API

Inside a JWT: Build Your Own Token from Scratch in .NET

In the last post I used an analogy about authentication being like a passport which identifies you to the resource you're trying to access. In this post I'm going to show you how to make a JWT from scratch without using the standard .NET libraries, so

Why Authentication Matters: The Passport Every .NET API Needs

The passport analogy What is authentication and why do we need it? A good analogy is to think about the concept of authentication as a passport. If you want to get into a country, you have to show them your passport. It proves who you are. How does it prove