CODEWITHSUNDEEP
identityserver4asp.net-core-webapi
Jonas
Jonas

Reputation: 3283

How to protect Web API called by IdentityServer4

I make multiple calls to a Web API during login operations in IdentityServer4. Same applies during password reset operations which is custom code I have added to the IdentityServer4 project.

So how should I protect my ASP.NET Core Web API when the user isn't yet authenticated via OIDC which implies that there also isn't exist any access token at that stage. I would like to only allow IdentityServer4 to call these Web API methods instead of running unprotected Web API's.

Any suggestions?

Upvotes: 1

Views: 1346

Answers (1)

leastprivilege
leastprivilege

Reputation: 18482

You can use this

https://identityserver4.readthedocs.io/en/release/topics/tools.html

to generate your own tokens to call the APIs.

Upvotes: 2

Related Questions