CODEWITHSUNDEEP
asp.net-coreoauth-2.0openid-connectasp.net-core-3.1sts-securitytokenservice
Koref Koref
Koref Koref

Reputation: 330

How do I generate and/or get an access_token and refresh_token from website built in react js that calls API built using .NET Core 3?

I am building a web app using react that calls RESTful API (built using .NET Core 3.1). The web app and soon mobile app access all data through the API. I would like to have an authentication/authorization integrated but would like to know where to start. I am thinking of IdentityServer4 to build a token service but that could be an overkill and especially security not being my speciality. But i also would like something that I can easly integrate/use but also not tied with just only one token provider (eg, MS only) - this will be too restrictive as the target users could potentially prefer to use username/password, or their google/MS/fb....). What do I do? where should I start?

Upvotes: -1

Views: 458

Answers (3)

Houssem Eddine Mereghni
Houssem Eddine Mereghni

Reputation: 81

IdentityServer4 is a good choice, not that hard to incorporate in your project. You may say it may be complicated but it simply provides an authorization API issuing authentication tokens for users requests(it provides a user and password as identity), and it gives you the option of deploying external authentication(FB,Google...). It is not an overkill as when it comes to security the more it is sophisticated the better.

here is a guide if you'r interested: https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity-api-authorization?view=aspnetcore-5.0

Upvotes: 0

Gary Archer
Gary Archer

Reputation: 29291

Well here are the moving parts, and there is quite a big learning curve, since OAuth tech covers many architectural aspects. I would aim to focus primarily on UI and API integration in the early days.

Authorization Server (AS)

This will deal with login screens, standards based messages, issuing tokens, auditing and so on. I'd recommend starting with a free or low cost cloud service, so that you can get started quickly and understand how to manage the system.

APIs

These will verify incoming access tokens and build a claims principal. I would start by understanding which claims you need and how you will authorize requests after validating the token.

Web UIs

These use Authorization Code Flow (PKCE), then handle and verify OAuth responses. A commonly used library is oidc-client, which will deal with a lot of the complexity for you.

Mobile UIs

These use the same flow above but with the use of in app browsers that handle credentials. The most commonly used library is AppAuth, which deals with the mobile plumbing.

Extensibility

Once the above parts are integrated you should then be able to do this without any code changes:

  • Add extra login methods, as discussed in my Federated Logins Blog Post
  • Switch providers once you better understand your AS requirements

Online Code Samples

My blog has a bunch of UI and API Code Samples you can run on your local PC, starting with the Initial Code Sample, then moving on to more advanced ones such as React SPA with .Net Core API.

Upvotes: 0

Karney.
Karney.

Reputation: 5031

I don't know the complexity of your project. Give some suggestions aobut it.

  1. If the complexity of the project is average, you can use jwtbearer authentication and use the built-in authorization. Because you have used the front and rear separation and And authentication and authorization can be well separated according to the httpstatus.

    If you do not use jwt, you can use identity. Because asp.net core has integrated identity well. But jwt is a better suggesion.

  2. If the business you are dealing with is relatively complex, you can consider IdentityServer4. You need to configure authentication and authorization on an another server.

Upvotes: 0

Related Questions