Aaron Pina

In the previous article we finally turned our demo authorisation server into something that feels like a real OAuth 2.0 implementation.

Although this blog is focused on the role of JWTs in .NET APIs, when you begin to make a concerted study of the subject, you discover that JWTs are actually part of a wider authentication landscape.

If you're like me, whenever you watch a video tutorial about building .NET APIs, the teacher always gives you the minimum information necessary and seldom explains why you should do something.

I originally planned for this article to focus on common JWT attacks in ASP.NET API's.

In the previous article we added the two standard JWKS discovery endpoints to our authentication server.

This article isn't going to be as long as the previous article, but it's going to be just as interesting and powerful.

In the last article, we finished the topic we started in the article before last, which was refreshing tokens.

In the previous article, we built out our authentication server API to include an endpoint to refresh our JWT.

In the previous article, we built an ASP.NET Minimal API in .NET 10 with JWT authentication.

In the previous article, I discussed the structure of a JWT, how to construct one manually in code and the principles behind each step of the process.

In the last post I used an analogy about authentication being like a passport which identifies you to the resource you're trying to access.

The passport analogy What is authentication and why do we need it?