Słyszeliście o JSON Web Token-ach? Zapewne tak. W sieci pełno jest artykułów o wadach, zaletach, wykorzystaniu w implementacjach  OAuth2 czy OIDC. Czy to znaczy, że napisano o nich wszystko, co się da? Przemilczę odpowiedź i dorzucę własną, mam nadzieje, że przydatną, cegiełkę. Trochę z własnych obserwacji, jednak podejrzewam, że bliskich prawdzie, zakładam, że JWT to dzisiejszy standard zabezpieczania API. Pomimo, iż np. ze specyfikacji PASETO zaczyna powoli wyrastać coś ciekawego, jeszcze długa droga ...

A few days ago I showed you how to combine Nancy with Autofac and ASP.NET Core IoC. Today’s post will be related to the security and more precisely JWT authentication. Before moving further, I’d like to mention that below text is going to be the last Nancy-related one (at least for now). In a next couple weeks, we’ll explore the world of graph databases with Neo4j and .NET Core, so I hope you’re as excited as I do 😉  How does JWT authe...

Authentication The topic looks obviously obvious and generally speaking standard user doesn’t care much about the details. He wants to register, login, and make sure that his password is safe. The more you read and learn, the more sophisticated requirements you have for protection, state management on the server and client side, the more things are getting complicated. The problem with authentication is basically about: how does one prove that he is the guy that he’s pretending to be? In the world of w...

In this article we focus on sample service based on WCF (Windows Communication Foundation), as we will only try to build sample service with claims-based authentication and authorization. All technical aspects connected with security e.g. configuration, certificates, encryption, signature or CRL will be described in details in the next posts.