CODEWITHSUNDEEP
authenticationvue.jsasp.net-corevuejs2single-page-application
JimmyShoe
JimmyShoe

Reputation: 2259

authentication with vue spa

I have followed a few guides on adding authentication to my vue application (which has a net core api backend).

https://medium.com/dev-bits/a-guide-for-adding-jwt-token-based-authentication-to-your-single-page-nodejs-applications-c403f7cf04f4

and

http://jasonwatmore.com/post/2018/08/14/aspnet-core-21-jwt-authentication-tutorial-with-example-api

I'm a junior programmer with authentication so forgive me if my questions seem dumb.

These involve sending a username and password to my api login method and getting back a jwt token (is this an id_token or an access token?). I then send this token with every api request using the Bearer authorization. Some guides (eg microsoft net core docs) have this jwt token include role information.

Is this just a basic form of jwt authentication. Some things i have read about token authentication indicate that when i login i should get an id token which i then exchange for an api access token. These tutorials don't appear to do that - it looks like there is only one token and that it's used for api access and authentication.

Ideally i would like to implement oidc into my vue application but the many guides out there dont seem to address this.

Upvotes: 1

Views: 1074

Answers (1)

Nan Yu
Nan Yu

Reputation: 27538

The tutorials are talking about the JWT token based authentication , it will issue a JWT token to declare a user and their access permissions in the application.

When a user tries to log in to the application with their username and password, the server/api side will authenticate the user ,generate the token and send token back to client . Next time client could use token to access the server/API which eliminates the need for the app or system to remember or store the user’s credentials. You can involve user's basic profile information(not sensitive) and some custom claim in that token such as claim related to roles . Both client side and server side should check the specific role if you want to check the authorize part .

Id_token was added to the OIDC specification(OpenID Connect) as an optimization so the application can know the identity of the user, without having to make an additional network requests. It contains user profile information (like the user's name, email, and so forth) , and So if you are using OpenID Connect (Implicit Flow is suitable for SPA) to do the authentication and authorization , you will get id token which identity of the user , and access token which could be used to access the protected resource/API .

You are not using OpenID Connect , so no id token is involved in the scenario .

Upvotes: 1

Related Questions