Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to apply custom validation to JWT token on each request for ASP.NET WebApi?

Is it possible to add custom validation to each request when authenticating web api calls using a bearer token?

I'm using the following configuration and the application already validates the JWT tokens correctly.

app.UseOAuthAuthorizationServer(new OAuthAuthorizationServerOptions
{
    AuthenticationType = "jwt",
    TokenEndpointPath = new PathString("/api/token"),
    AccessTokenFormat = new CustomJwtFormat(),
    Provider = new CustomOAuthProvider(),
});

app.UseJwtBearerAuthentication(new JwtBearerAuthenticationOptions
{
    AllowedAudiences = new[] { "all" },
    IssuerSecurityTokenProviders = new[] { new SymmetricKeyIssuerSecurityTokenProvider(Config.JWT_Issuer, Config.JWT_Key) },,

});

Now, because tokens are set to never expire, I'd like to add an additional custom validation step to each request made with a bearer token, so I can validate some additional information per request and deny access if needed.

Where is the right place to add this validation for each request?

like image 673
Natan Avatar asked Feb 23 '16 19:02

Natan


People also ask

What is ValidateIssuer in JWT token?

ValidateIssuer, validates that the iss claim inside the access token matches the issuer(authority) that the API trusts (Ie, your token service). Verifies that the issuer of the token is what this API expects. ValidateAudience, validates that the aud claim inside the access token matches the audience parameter.

How do I add authentication to JWT?

Specify a secret key in the appsettings.Next, create a section in the appsettings. json file for the Issuer, Audience, and Key information. This information will be used later to generate a JSON Web Token. Note that you can give any name to this section you want; I'll use the name “Jwt” for convenience.


1 Answers

To add additional logic to authenticate or validate incoming tokens:

1) Using an Authentication Provider

  1. Write a custom provider inherit from OAuthBearerAuthenticationProvider or implement IOAuthBearerAuthenticationProvider

  2. in your custom authentication provider, override/implement ValidateIdentity(...) and/or RequestToken(...) to check the incoming token with each request

  3. Use your custom provider by assigning it to the JwtBearerAuthenticationOptions.Provider property

Example:

app.UseJwtBearerAuthentication(new JwtBearerAuthenticationOptions
{
    // ... other properties here
    Provider = new MyCustomTokenAuthenticationProvider()
    // ... other properties here
});

2) Using A Token Handler

  1. Write a custom token handler inherit from JwtSecurityTokenHandler

  2. override any relevant method you like to extend (there are many!)

  3. Use your custom token handler by assigning it to the JwtBearerAuthenticationOptions.TokenHandler property

Example:

app.UseJwtBearerAuthentication(new JwtBearerAuthenticationOptions
{
    // ... other properties here
    TokenHandler = new MyCustomTokenHandler()
    // ... other properties here
});
like image 163
Bishoy Avatar answered Sep 19 '22 06:09

Bishoy