ASP.NET Core Interview Question #142

What is JWT bearer authentication?

Authentication, Authorization & Security Mid-Level Intermediate

Quick Interview Answer

JWT bearer authentication is commonly used by APIs to authenticate requests carrying a bearer token in the Authorization header. A JWT can contain claims and is cryptographically signed so the API can validate its integrity and issuer information.

Detailed Explanation

The API should validate the token's signature, issuer, audience, and lifetime according to its trust model. A JWT is normally encoded, not encrypted, so sensitive secrets should not be placed in its payload.

Code Example

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true
        };
    });