AppMap surfaces key data missing from the software development process during the moment of code creation and displays it as behavior visualizations and runtime analysis, right in the code editor

AppMap

Autofac ComponentRegistryBuilder in ASP.NET Core

Need To Know Tips for Autofac ContainerBuilder in ASP.NET Core

ASP.NET Core-এ Autofac ContainerBuilder-এর জন্য টিপস জানতে হবে

Wissenswerte Tipps für Autofac ContainerBuilder in ASP.NET Core

Consejos necesarios para Autofac ContainerBuilder en ASP.NET Core

Besoin de connaître les conseils pour Autofac ContainerBuilder dans ASP.NET Core

ASP.NET कोर में ऑटोफैक कंटेनरबिल्डर के लिए जानने योग्य टिप्स

ASP.NET Core の Autofac ContainerBuilder に関する知っておくべきヒント

ASP.NET Core의 Autofac ContainerBuilder에 대한 팁을 알아야 합니다.

Precisa saber dicas para Autofac ContainerBuilder no ASP.NET Core

Необходимо знать советы по использованию Autofac ContainerBuilder в ASP.NET Core

ASP.NET Core'da Autofac ContainerBuilder İçin Bilmeniz Gereken İpuçları

Những điều cần biết về Autofac ContainerBuilder trong ASP.NET Core

需要了解 ASP.NET Core 中 Autofac ContainerBuilder 的技巧

AutofacServiceProviderFactory in ASP.NET Core

How to Master .NET 8 Web API: From Setup to Security - The Best 50 Tips

কিভাবে .NET 8 ওয়েব এপিআই আয়ত্ত করবেন: সেটআপ থেকে নিরাপত্তা - সেরা 50 টি টিপস

.NET 8 Web API meistern: Von der Einrichtung bis zur Sicherheit – Die 50 besten Tipps

Cómo dominar la API web .NET 8: de la configuración a la seguridad: los 50 mejores consejos

Comment maîtriser l'API Web .NET 8 : de la configuration à la sécurité - Les 50 meilleurs conseils

.NET 8 वेब एपीआई में महारत कैसे हासिल करें: सेटअप से सुरक्षा तक - सर्वोत्तम 50 युक्तियाँ

.NET 8 Web API をマスターする方法: セットアップからセキュリティまで - ベスト 50 のヒント

.NET 8 Web API를 마스터하는 방법: 설정부터 보안까지 - 최고의 50가지 팁

Como dominar a API da Web .NET 8: da configuração à segurança - as 50 melhores dicas

Как освоить веб-API .NET 8: от настройки до безопасности — 50 лучших советов

.NET 8 Web API'sinde Uzmanlaşma: Kurulumdan Güvenliğe - En İyi 50 İpucu

Cách làm chủ API Web .NET 8: Từ thiết lập đến bảo mật - 50 mẹo hay nhất

如何掌握 .NET 8 Web API：从设置到安全 - 50 个最佳技巧

Even though we get access to when building .NET web apps, I still want more. One of the very first things that I did was integrate in ASP NET Core applications because of the capabilities and APIs of Autofac. The built-in dependency injection support has come a long way, so I don’t mean to discredit it, but I still prefer to leverage Autofac. IServiceCollection Autofac But there’s a problem — and that very well might be why you ended up at this article in the first place. Setting up Autofac in ASP NET Core is easy but it’s also easy to mess up. I seemingly do this on every ASP NET Core project that I start, and I feel like enough is enough. The next time I go to search for how to solve this problem, I’m going to come across my OWN article and have the “Aha!” moment. So let’s see just how easy it is to get Autofac in ASP NET Core. Example ASP NET Core Project To walk through how to configure Autofac in ASP NET Core, I wanted to get us on the same page for a set of code. What better way than to use the built-in weather app project with minimal APIs?! I know that it’s not that exciting, but it’ll be much more exciting once you have it working with Autofac. Let’s have a look at the code first, paying attention to the TODO that’s mentioned: using Autofac;
using Autofac.Extensions.DependencyInjection;
using Microsoft.AspNetCore.Mvc;
using System.Reflection;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.
// ... TODO: this is where we need to hook up our dependencies!!

var app = builder.Build();

// Configure the HTTP request pipeline.
app.UseHttpsRedirection();

app.MapGet("/weatherforecast", (MyDependency myDependency) =>
{
    var summaries = myDependency.GetSummaries();
    var forecast = Enumerable.Range(1, 5).Select(index =>
        new WeatherForecast
        (
            DateOnly.FromDateTime(DateTime.Now.AddDays(index)),
            Random.Shared.Next(-20, 55),
            summaries[Random.Shared.Next(summaries.Count)]
        ))
        .ToArray();
    return forecast;
});

app.Run();

internal record WeatherForecast(DateOnly Date, int TemperatureC, string? Summary)
{
    public int TemperatureF => 32 + (int)(TemperatureC / 0.5556);
}

public sealed class MyDependency
{
    public IReadOnlyList<string> GetSummaries()
    {
        var summaries = new[]
        {
            "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
        };
        return summaries;
    }
} This program is almost identical to the sample weather app, but I pulled the “summaries” array into a dedicated class called MyDependency. Not for any good reason except for us to have a class to inject, and we’ll do so by providing it right on the minimal API definition itself. Next, we’ll need to make sure we get the NuGet package, so make sure you get the package. This will by default include Autofac itself, but you’ll need this NuGet package to — a key part of how we make this all work together! Autofac.Extensions.DependencyInjection interface with the IServiceCollection The Wrong Way to Set Up Autofac in ASP NET Core This is an obligatory part of the article even though I know you came here looking for a solution. I need to include this because I know there are other people out there searching for this, and even if there aren’t, I know that I will be guaranteed to search for this in the future. I’d be happy to come across my own article with the example code telling me what’s wrong! I was passionate enough about this problem that I even put this video together about this exact problem and how to set up Autofac in ASP NET Core the *right* way: https://www.youtube.com/watch?v=Pto8w7TbMlg&embedable=true The problem stems from two main points: The Autofac devs have left a method in place that shouldn’t be used anymore (very likely for compatibility purposes) … I apparently can’t seem to read or remember, no matter how many times I do this And I’d like to take full responsibility. So let’s check out this code snippet that shows what looks like the obvious way to hook things up: var builder = WebApplication.CreateBuilder(args);

// Add services to the container.
builder.Services.AddAutofac(containerBuilder =>
{
    containerBuilder.RegisterType<MyDependency>().SingleInstance();
}); We add the lovely onto our IServiceCollection that allows us to configure a ContainerBuilder instance for Autofac. Awesome! extension method Except this doesn’t work. At all. And if you read the details, here’s what it says: ONLY FOR PRE-ASP.NET 3.0 HOSTING. THIS WON’T WORK FOR ASP.NET CORE 3.0+ OR GENERIC HOSTING. Autofac Peeps As I mentioned, apparently I am very bad at reading. I continue to make this mistake. So let’s check out the next section where we can see that the REAL solution to this is very similar… maybe just one extra line of code instead. The Right Way to Set Up Autofac in ASP NET Core This is what you’re after, so I’ll keep it short. You’ll want to switch that AddAutofac() calls instead: extension method to these two method builder.Host.UseServiceProviderFactory(new AutofacServiceProviderFactory());
builder.Host.ConfigureContainer<ContainerBuilder>(containerBuilder =>
{
    containerBuilder.RegisterType<MyDependency>().SingleInstance();
}); Notice now that we’re working with the Host property of the builder instead of the IServiceCollection. But these two methods used instead of the original one we looked at will allow you to configure your Autofac ContainerBuilder instance properly. From here, you can register dependencies individually, scan assemblies, load up modules — whatever you’d like! The dependencies registered onto this container will be available to the classes that are registered on the ContainerBuilder itself AND available to the classes you have as part of the IServiceCollection. Yes, that means your minimal APIs can get all the juicy goodness now from Autofac. Wrapping Up Autofac in ASP NET Core As we got to see, getting Autofac in ASP NET Core is very straightforward — IF you use the right method. After creating a video on it and writing an article, I’m hoping I never have to search for this answer again. But if I do, I know that I got myself covered! Hopefully this helped you get things configured so you can use Autofac for in your ASP NET Core apps! dependency injection If you found this useful and you’re looking for more learning opportunities, consider and check out my ! subscribing to my free weekly software engineering newsletter free videos on YouTube

Avoid This Debugging Nightmare Using Autofac In ASP NET Core

For those trying to get into , the question of how to spend your time most efficiently for learning always comes up. There are a seemingly unlimited number of books to choose from, online courses to navigate, YouTube videos to scroll through, and articles to scan. But many developers get stuck in what’s called “Tutorial Hell” where they jump from one tutorial to the next, unable to break the cycle. That’s why I want to share these C# project ideas for beginners that’ll help put an end to that. software development In my opinion, building software is one of the best ways to learn. That doesn’t mean that the other things I mentioned aren’t helpful — I write articles, create videos, and publish courses to help people learn! But I think that these should be supplementary as you focus on building software. Let’s jump into these project ideas for beginners and get you started on building something! C# 1 – Build a Chatbot Building a chatbot is a great way to experiment with AI and ! You’ve probably noticed AI is getting a ton of attention unless you’ve been disconnected from civilization, so that means there’s a steady stream of new interesting things to look into. natural language processing I like working with the Azure OpenAI offering, which you can check out here: . When ChatGPT was getting a lot more attention early on in its launch, I even went ahead and created some C# APIs and videos on using them! Azure OpenAI Service Now, I’m no longer a fresh software developer. I haven’t been for 20 years or so. But I still thought it was a fun and exciting project to work through because it was interesting — and that will be a common theme here. You want to work on things that you find interesting so that they keep you engaged. Even a simple chatbot can be built in a console which allows you to focus on how to follow an API spec and send/receive web requests/responses. If you reduce the problem space to just calling the API properly, you can start to add in more fancy features from there. 2 – Develop a Mobile App With Maui There was a period early on in the C0V1D times where I found myself with some downtime and wanted to learn. I teamed up with a friend and we tried to build a mobile app together for fun using Xamarin (RIP). I purposefully chose different pieces of technology that I didn’t know so that I could learn about them, but I stuck with C# as my programming language. This allowed me to have some level of comfort as I went on to learn other things. This may not be the same situation for you because C# is probably new to you — but that’s okay! Maybe Maui as a tech stack is new, and C# is also new… But you could make an app about something that you really love. Maybe you like cars, or sports, or video games… Make a simple app about those things so you can greatly simplify that part of the creative process. Focus your energy on the technical parts you’re trying to learn about. Mobile app development can get difficult in some situations because of the need for specific platform knowledge. You may need to understand how to build native UI components, how to handle different device resolutions and sizes, and other situations. Maui aims to simplify a lot of this, but depending on what you’re building there could be some fun gotchas. 3 – Create a CRUD Application Many of the applications you’ll go on to build will need to use a database at some point. So instead of building an ENTIRE application that uses a database at one point, why not just focus on building a bit of code that can interact with a database? Creating a CRUD application is a fundamental part of many applications and services, allowing you to Create, Read, Update, and Delete data stored in a database. Using .NET technologies like Entity Framework Core, you can build an application that efficiently interacts with a database — even if it’s just a console application that allows you to do these operations! I even started documenting how I was building a Blazor app backed by Entity Framework Core: https://www.youtube.com/watch?v=LZjQJkDYQ8I&ab_channel=DevLeader&embedable=true To implement CRUD operations in C#, you can start by defining a model for your data object, such as a person or product. You could follow an entity framework tutorial to show you how to set up your connection to the database! See, not all tutorials are bad – Just have a use for them first. Once connected, you could have a console app that lets you perform the CRUD operations. You could build upon this by instead writing a REST API that calls into this same code! … But that sounds like it might be part of the next section. 4 – Design a REST API Creating a RESTful API is a great way to allow other applications to access your data or functionality. This involves designing endpoints that return or manipulate data depending on the HTTP method used. For example, a GET request could be used to retrieve data, while a POST request could be used to create new data. For our learning purposes, you really don’t need to design this for anyone else to use in practice — but you can try it out to prove it works! And these days, it couldn’t be any easier to create a working web app with RESTful functionality in ASP.NET Core. Seriously! Check out this video to see how to get minimal APIs working in under 5 minutes (4 minutes and 19 seconds to be exact): https://www.youtube.com/watch?v=fyBhV9pWRg8&embedable=true Here’s a bit of example code that shows how we could create a REST API for books — especially convenient if you worked on the CRUD example before this one using Entity Framework Core: using Microsoft.AspNetCore.Builder;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.DependencyInjection;
using System.Linq;

var builder = WebApplication.CreateBuilder(args);

// Replace with your actual database configuration
builder.Services.AddDbContext<BookContext>(opt => 
    opt.UseInMemoryDatabase("Books"));
// Add services to the container.
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.MapGet("/books", async (BookContext context) =>
    await context.Books.ToListAsync());

app.MapGet("/books/{id}", async (BookContext context, long id) =>
{
    var book = await context.Books.FindAsync(id);
    return book != null ? Results.Ok(book) : Results.NotFound();
});

app.MapPost("/books", async (BookContext context, Book book) =>
{
    context.Books.Add(book);
    await context.SaveChangesAsync();
    return Results.Created($"/books/{book.Id}", book);
});

app.MapPut("/books/{id}", async (BookContext context, long id, Book updatedBook) =>
{
    var book = await context.Books.FindAsync(id);
    if (book == null) return Results.NotFound();

    book.Title = updatedBook.Title;
    book.Author = updatedBook.Author;
    book.Price = updatedBook.Price;

    await context.SaveChangesAsync();
    return Results.NoContent();
});

app.MapDelete("/books/{id}", async (BookContext context, long id) =>
{
    var book = await context.Books.FindAsync(id);
    if (book == null) return Results.NotFound();

    context.Books.Remove(book);
    await context.SaveChangesAsync();
    return Results.NoContent();
});

app.Run(); 5 – Build a Game This one hits home for me because this is how I started. I’ll start by saying I am awful when it comes to creating anything graphical. It’s just not a thing I’ve ever been great with — so creating games was a bit scary. But the reality is, I was never interested in creating visually appealing games, I was fascinated by building out game mechanics. If you poke around on my blog and even some of my early YouTube videos, you can see that I even used video game creation to try and get more comfortable with content creation — it’s because it’s something I know and have experience with. And that’s only because I used it as a way to about different ways to code, how to refactor, and how to integrate different technologies. practice and learn You can build games in Unity using C# and you can build games in Godot with C# as well. But my first games were completely text-based. You really don’t need to do anything fancy to make a basic game. If you find jumping into the game engines is too difficult right away, dial it back and try making a text-based game. You could build a console trivia game with multiple choice. You could build rock paper scissors. There are probably even some card games that could be done on the console! In my opinion, writing games is an awesome way to learn about different algorithms. You get the opportunity to start thinking about how you’d translate logical rule sets into code! 6 – Integrate with Third-Party Services Integrating with third-party services is a powerful way to extend your .NET application’s capabilities beyond what your team can provide. This can include social media platforms or publicly accessible APIs. These APIs enable this integration, providing a defined interface for your application to interact with, and often they’re well-documented to tell you exactly how to use them. I mentioned earlier in this article that I was using APIs for working with Azure’s OpenAI services — so that’s one such example. But you could search the internet to see if there are public data sources you could connect to maybe for weather information or something else. One of the earlier a REST API, and this is going in the opposite direction! Maybe after you get some practice calling other third-party APIs you can go back and check the REST API you built. How could you improve it and refactor it? projects was about building 7 – Create a Full Website or App! At this point, I’ve provided you with 6 C# project ideas for beginners that you could try to tackle. But what you may not have noticed is that each one of these could be a potential piece of a bigger application, and each of those pieces could come together in some form or another to build something more complex! You could use your knowledge gained from building a simple CRUD app and building a REST API to get started with the basics for a back-end web server. From there, you could consider if you need to integrate with other third-party data to supplement what you have for what your web server can do. You’ll want to decide if you go down the path of using something like Maui for building mobile applications, or perhaps . There are even Maui/Blazor hybrid options to explore! something like Blazor for building the front-end to your website The game concepts you may have learned if you tried out a project like that will help you think about what interesting algorithms you’ll want to provide in your service. And that first AI example with the chatbot? Now you’ll have some ideas for how you can even integrate something cool and shiny like AI into what you’re building! Wrapping Up C# Project Ideas For Beginners The most important parts that you want to keep in mind when working on projects are: You’re learning new things You feel engaged in what you’re learning You’re having fun You’ll mess up along the way. You’re going to have to rewrite and refactor code. Some code you write you’ll be embarrassed about even a week later. But every bit of that is helping you progress forward and learning how to write software. You need to put in the reps to get better, and this is how you do it! This is how you get out of tutorial hell! If you enjoyed this article, for more content like this to your inbox, and to keep up to date. subscribe to Dev Leader Weekly for free check out my YouTube channel

Escape Tutorial Hell - 7 C# Project Ideas For Beginners

JWT stands for , and it is an authorization mechanism, not authentication. So let’s figure out what the difference between those two. JSON Web Token is the mechanism that allows verifying that the user is exactly the one he claims to be. It is a login process where a user provides a username and password, and the system verifies them. So authentication answers the question: who is the user? Authentication is the mechanism that allows verification of which access rights the user has to a certain resource.  It is a process of granting users some roles and a set of permissions a particular role has. So, authorization answers that question: what rights does the user have in the system? Authorization It is important to understand that Authentication always comes first and Authorization is second. In other words, you can’t get permission before you verify your identity. But what are the most popular authorization methods? There are two main approaches to handling authorization for the web application. Sessions A traditional approach on the web for authorization users is a cookie-based server-side session. The process starts when a user logs in and a server authenticates him. After that, the server creates a session with a Session ID and stores it somewhere in the server’s memory. The server sends back Session ID to the client and the client stores the Session ID in cookies. For every request, the client sends a Session ID as a part of the request, and the server verifies the Session ID in its memory and the user’s permissions related to this session. Tokens Another popular approach is using tokens for authorization. The process starts similarly when a user enters login, and passwords and a client sends a login request to a server. Instead of creating a session, the server generates a token signed with the secret token. Then, the server sends the token back to the client, and the client has to store it in a local storage. Similar to the session-based approach, the client has to send a token to the server for every request. However, the server does not store any additional information about the user session. The server has to validate that the token has not changed since it was created and signed with the secret key. Session vs Token Session-based authorization approach can be vulnerable to an attack known as Cross-Site Request Forgery (CSRF). It is a kind of attack when the attacker points to a site they are logged into to perform actions they didn’t intend to, like submitting a payment or changing a password. Another thing is that when using a session-based authorization approach creates a stateful session between a client and server. The problem is if a client wants to access different servers in the scope of the same application, those servers have to share a session state. In another case, the client will need to be authorized on each server since the session is going to be different. On the other hand, the token-based authorization approach does not require storing session data on the server side and may simplify authorization between multiple servers. However, tokens can still be stolen by an attacker and it also can be difficult to invalidate tokens. We will see the details and how to handle invalidation further in this article. JWT JSON Web Token (JWT) is an open standard that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the algorithm) or a public/private key pair using or . HMAC RSA ECDSA JWT structure JSON Web Tokens consist of three parts separated by dots . Header {
  "alg": "HS256",
  "typ": "JWT"
} The header usually consists of two parts: the type of token, and the signing algorithm being used. Payload {
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true
} The payload contains the claims, which are statements about the user. The payload is then encoded to form the second part of the JSON Web Token. You can find a description of standard fields that are used as claims . Base64Url here Signature HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret) To create the signature part, you have to take the encoded header, the encoded payload, a secret, and the algorithm specified in the header and sign that. The token typically looks like the following: xxxxx.yyyyy.zzzzz You can navigate to and debug a sample token or your own. Just paste your token into the field and select the of the token signature. jwt.io Encoded Algorithm .NET project Now that we have theoretical knowledge of how JWT works, we can apply it to the real-life project. Let’s assume we have a simple API that represents CRUD operations for the coffee entity. We are going to create an ASP.NET Core API project that represents Coffee API. After that, we will create another ASP.NET Core API project that would represent an Identity API that could generate JWT. In real life, you would probably use or , or for Authentication/Authorization purposes. However, we would create our own Identity API to demonstrate how to generate JWT. When Identity API is done, we can call its controller and generate JWT based on the user’s data. Also, we can protect the Coffee API with an authorization configuration that requires passing JWT with each request. Identity Server Okta Auth0 Coffee API First, we are going to create a simple ASP.NET Core API project that represents Coffee API. Here is the structure of this project: Let’s start with the in the folder. It is a simple entity with an and a properties. Coffee.cs Model Id Name namespace Hackernoon.Coffee.API.Model;

public class Coffee
{
    public int Id { get; set; }
    public string Name { get; set; }
} We need to store our entities while working with the API. So, let’s introduce a simple in-memory storage. It is located in the file in the folder. Storage.cs Data namespace Hackernoon.Coffee.API.Data;

public static class Storage
{
    private static readonly List<Model.Coffee> Data = new();

    public static List<Model.Coffee> GetAll()
    {
        return Data;
    }
    
    public static bool Create(Model.Coffee model)
    {
        if (Data.Any(c => c.Id == model.Id || c.Name == model.Name))
            return false;
        
        Data.Add(new Model.Coffee
        {
            Id = model.Id, 
            Name = model.Name
        });

        return true;
    }
    
    public static bool Delete(int id)
    {
        if (Data.All(c => c.Id != id))
            return false;
        
        Data.Remove(Storage.Data.First(c => c.Id == id));
        return true;
    }
    
    public static bool Update(Model.Coffee model)
    {
        if (Data.All(c => c.Id != model.Id))
            return false;
        
        Data.First(c => c.Id == model.Id).Name = model.Name;
        return true;
    }
} We need a class that would represent requests to the Coffee API. So, let’s create in the folder. CoffeeRequest.cs Contracts namespace Hackernoon.Coffee.API.Contracts;

public class CoffeeRequest
{
    public int Id { get; set; }
    public string Name { get; set; }
} When it is done, we can implement in the folder that represents CRUD operations for the coffee entity. CoffeeController.cs Controller using Hackernoon.Coffee.API.Contracts;
using Hackernoon.Coffee.API.Data;
using Microsoft.AspNetCore.Mvc;

namespace Hackernoon.Coffee.API.Controllers;

[Route("coffee")]
[ApiController]
public class CoffeeController : ControllerBase
{
    [HttpGet]
    public IList<Model.Coffee> GetAll()
    {
        return Storage.GetAll();
    }
    
    [HttpPost]
    public IActionResult Create([FromBody]CoffeeRequest request)
    {
        var model = new Model.Coffee
        {
            Id = request.Id,
            Name = request.Name
        };

        if (!Storage.Create(model))
            return new BadRequestResult();

        return new OkResult();
    }

    [HttpDelete]
    public IActionResult Delete(int id)
    {
        if (!Storage.Delete(id))
            return new BadRequestResult();

        return new OkResult();
    }

    [HttpPut]
    public IActionResult Update([FromBody] CoffeeRequest request)
    {
        var model = new Model.Coffee()
        {
            Id = request.Id,
            Name = request.Name
        };
        
        if (!Storage.Update(model))
            return new BadRequestResult();

        return new OkResult();
    }
} Coffee API is done, and we can run the project and see Swagger UI as follows: Identity API Let’s create another ASP.NET Core API project that represents Identity API. Here is the structure of this project: Let’s start with the in folder, which represents the request for the generation of a new JWT with and properties. TokenGenerationRequest.cs Contracts Email Password namespace Hackernoon.Identity.API.Contracts;

public class TokenGenerationRequest
{
    public string Email { get; set; }
    public string Password { get; set; }
} We need to implement only that represents the logic of generation JWT. But before we do that NuGet package needs to be installed. TokenController.cs Microsoft.AspNetCore.Authentication.JwtBearer using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Hackernoon.Identity.API.Contracts;
using Microsoft.AspNetCore.Mvc;
using Microsoft.IdentityModel.Tokens;

namespace Hackernoon.Identity.API.Controllers;

[Route("token")]
public class TokenController : ControllerBase
{
    private const string SecretKey = "VerySecretAndLongKey-NeedMoreSymbolsHere-123";
    private const string Issuer = "IdentityServerIssuer";
    private const string Audience = "IdentityServerClient";
    private static readonly TimeSpan Lifetime = TimeSpan.FromMinutes(20); 
        
    [HttpPost]
    public string Create([FromBody]TokenGenerationRequest request)
    {
        var claims = new List<Claim> {new Claim(ClaimTypes.Email, request.Email) };

        var jwt = new JwtSecurityToken(
            issuer: Issuer,
            audience: Audience,
            claims: claims,
            expires: DateTime.UtcNow.Add(Lifetime),
            signingCredentials: CreateSigningCredentials());
            
        return new JwtSecurityTokenHandler().WriteToken(jwt);
    }

    private static SigningCredentials CreateSigningCredentials()
    {
        return new SigningCredentials(
            new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SecretKey)), 
            SecurityAlgorithms.HmacSha256);
    }
} Note that sensitive const such as , , and have to be put somewhere in the configuration. They are hardcoded just for simplifying this test project. The field is set to 20 minutes, which means that the token will be valid for that time. You also might configure this parameter. SecretKey Issuer Audience Lifetime Now we can run the project and see Swagger UI as follows: Let’s make a call to the endpoint and generate a new JWT. Try the following payload: /token {
  "email": "john.doe@gmail.com",
  "password": "password"
} Identity API will generate the corresponding JWT: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9lbWFpbGFkZHJlc3MiOiJqb2huLmRvZUBnbWFpbC5jb20iLCJJc0dvdXJtZXQiOiJmYWxzZSIsImV4cCI6MTcwNzc4Mzk4MCwiaXNzIjoiSWRlbnRpdHlTZXJ2ZXJJc3N1ZXIiLCJhdWQiOiJJZGVudGl0eVNlcnZlckNsaWVudCJ9.4odXsbWak1C0uK3Ux-n7f58icYQQwlHjM54OjgMCVPM Enabling Authorization in Coffee API Now, when Identity API is ready and provides us with tokens, we can guard Coffee API with authorization. Again NuGet package needs to be installed. Microsoft.AspNetCore.Authentication.JwtBearer We need to register the required services by authentication services. Add the following code to the file right after creating a builder. Program.cs var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidIssuer = "IdentityServerIssuer",
            ValidateAudience = true,
            ValidAudience = "IdentityServerClient",
            ValidateLifetime = true,
            IssuerSigningKey = 
                new SymmetricSecurityKey(
                    Encoding.UTF8.GetBytes("VerySecretAndLongKey-NeedMoreSymbolsHere-123")),
            ValidateIssuerSigningKey = true,
        };
    });

builder.Services.AddAuthorization(); It is important to remember that order in middleware is important. We enable authentication by calling method and specifying as an authentication schema. It is a constant that contains a value. AddAuthentication() JwtBearerDefaults.AuthenticationScheme Bearer namespace Microsoft.AspNetCore.Authentication.JwtBearer
{
  /// <summary>Default values used by bearer authentication.</summary>
  public static class JwtBearerDefaults
  {
    /// <summary>
    /// Default value for AuthenticationScheme property in the JwtBearerAuthenticationOptions
    /// </summary>
    public const string AuthenticationScheme = "Bearer";
  }
} We need to specify that describes which parameters of JWT will be validated during the authorization. We also specify similar to the in Identity API to verify the JWT signature. Check more details about . TokenValidationParameters IssuerSigningKey signingCredentials TokenValidationParameters here The next piece of code adds middleware to the builder that enables authentication and authorization capabilities. It should be added between the and methods. UseHttpsRedirection() MapControllers() app.UseHttpsRedirection();

app.UseAuthentication();
app.UseAuthorization();

app.MapControllers(); Now, we can use the attribute over the controller or its actions. By applying this code, now all the actions in are protected with an authorization mechanism, and JWT has to be sent as a part of the request. Authorize CoffeeController [Route("coffee")]
[ApiController]
[Authorize]
public class CoffeeController : ControllerBase
{
  .. If we make a call to any endpoint of the Coffee API, we can debug and see that it is populated and has an with claims we have specified in JWT. It is an important thing in understanding how ASP.NET Core handles Authorization under the hood. HttpContext.User Identity Add Authorization to Swagger UI We did great work to protect Coffee API with the authorization. But if you run the Coffee API project and open Swagger UI, you won’t be able to send JWT as a part of the request. To fix that, we need to update the file with the following code: Program.cs builder.Services.AddSwaggerGen(option =>
{
    option.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
    {
        In = ParameterLocation.Header,
        Description = "Please enter a valid token",
        Name = "Authorization",
        Type = SecuritySchemeType.Http,
        BearerFormat = "JWT",
        Scheme = "Bearer"
    });
    option.AddSecurityRequirement(new OpenApiSecurityRequirement
    {
        {
            new OpenApiSecurityScheme
            {
                Reference = new OpenApiReference
                {
                    Type=ReferenceType.SecurityScheme,
                    Id="Bearer"
                }
            },
            new string[]{}
        }
    });
}); After that, we will be able to see the button at the right top corner: Authorize When you click on the button you will be able to enter JWT as follows: Authorize Use Postman for testing You can not limit yourself to using Swagger UI and can perform testing of the API through the Postman tool. Let’s call endpoint of the Identity API first. We need to specify header with the value in the section since we are going to use JSON as a payload. /token Content-Type application/json Headers After that, we can call endpoint and get a new JWT. /token Now, we can copy JWT and use it to call Coffee API. We need to specify header similar to the Identity API if we want to test, create, and update endpoints. header also has to be set with the value . After that, just hit button and see the result. Content-Type Authorization Bearer [your JWT value] Send Role-based authorization As you remember, the payload part of JWT is a set of claims with values that are exactly key-value pairs. Role-based authorization allows you to differentiate access to application resources depending on the role to which the user belongs. If we update the method in the file in Identity API with the code that adds a new claim for the role; we can handle role-based authentication in the Coffee API. is a predefined name of the role claim. Create() TokenController.cs ClaimTypes.Role var claims = new List<Claim>
{
    new Claim(ClaimTypes.Email, request.Email),
    new Claim(ClaimTypes.Role, "Barista")
}; Update the attribute in the file specifying the role name: Authorize CoffeeController.cs [Authorize(Roles = "Barista")] Now, all users who make a call to Coffee API have to have the role claim with the value. Otherwise, they will get status code. Barista 403 Forbidden Claim-based authorization An attribute can easily handle role-based authentication. But what if it is not enough, and we want to differentiate access based on some user properties like age or any other? You have probably already guessed that you can add your claims to JWT and use them to build authorization logic. Role-based authorization itself is a special case of claims-based authorization, just as a role is the same claim object of a predefined type. Authorize Let’s update the method in the file in Identity API with the code that adds a new claim . Create() TokenController.cs IsGourmet var claims = new List<Claim>
{
    new Claim(ClaimTypes.Email, request.Email),
    new Claim("IsGourmet", "true")
}; In the Program.cs file in Coffee API, we need to create a policy that verifies a claim and can be used in the attribute. The following code has to be added right after the method call. Authorize AddAuthentication() builder.Services.AddAuthorization(opts => {
    opts.AddPolicy("OnlyForGourmet", policy => {
        policy.RequireClaim("IsGourmet", "true");
    });
}); Update the attribute in the file specifying the policy name: Authorize CoffeeController.cs [Authorize(Policy = "OnlyForGourmet")] Summary Congratulations! You made a great effort in learning JWT in .NET. Now, you have to have a solid understanding of JWT principles and why it is important to use it to perform authorization in .NET applications. But we just scratched the surface in the area of authentication and authorization in ASP.NET Core applications. I suggest looking into Microsoft documentation regarding the topics we discussed in this article. There are also a lot of built-in capabilities for authorization and role management in the .NET platform. A good addition to this article could be Microsoft about authorization. documentation

Why do you need JWT in your ASP.NET Core project?

কেন আপনার ASP.NET কোর প্রকল্পে JWT দরকার?

Warum benötigen Sie JWT in Ihrem ASP.NET Core-Projekt?

¿Por qué necesita JWT en su proyecto ASP.NET Core?

Pourquoi avez-vous besoin de JWT dans votre projet ASP.NET Core ?

आपको अपने ASP.NET कोर प्रोजेक्ट में JWT की आवश्यकता क्यों है?

ASP.NET Core プロジェクトに JWT が必要なのはなぜですか?

ASP.NET Core 프로젝트에 JWT가 필요한 이유는 무엇입니까?

Por que você precisa do JWT em seu projeto ASP.NET Core?

Зачем вам нужен JWT в вашем проекте ASP.NET Core?

ASP.NET Core projenizde neden JWT'ye ihtiyacınız var?

Tại sao bạn cần JWT trong dự án ASP.NET Core của mình?

为什么 ASP.NET Core 项目中需要 JWT？

Feature Flags let you remotely control the activation of features without code changes. They help you to test, release, and manage features safely and quickly by driving changes using centralized configurations. In a previous article, we learned . Also, a while ago, we learned . how to integrate Feature Flags in ASP.NET Core applications how to integrate Azure App Configuration in an ASP.NET Core application In this article, we are going to join the two streams in a single article: in fact, we will learn how to manage Feature Flags using Azure App Configuration to centralize our configurations. It’s a sort of evolution from the previous article. Instead of changing the static configurations and redeploying the whole application, we are going to move the Feature Flags to Azure so that you can enable or disable those flags in . just one click A recap of Feature Flags read from the appsettings file Let’s reuse the example shown in the previous article. We have an ASP.NET Core application (in that case, we were building a Razor application, but it’s not important for the sake of this article) with some configurations defined in the file under the key: appsettings Feature {
  "FeatureManagement": {
    "Header": true,
    "Footer": true,
    "PrivacyPage": false,
    "ShowPicture": {
      "EnabledFor": [
        {
          "Name": "Percentage",
          "Parameters": { "Value": 60 }
        }
      ]
    }
  }
} We have already dove deep into Feature Flags in an ASP.NET Core application in . However, let me summarize it. the previous article First of all, you have to using the structure we saw before. define your flags in the file appsettings.json To use Feature Flags in ASP.NET Core, you have to install the NuGet package. Microsoft.FeatureManagement.AspNetCore Then, you have to by calling: tell ASP.NET to use Feature Flags builder.Services.AddFeatureManagement(); Finally, you are able to : consume those flags in three ways inject the interface and call or ; IFeatureManager IsEnabled IsEnabledAsync use the attribute on a Controller class or a Razor model; FeatureGate use the tag in a Razor page to show or hide a portion of HTML <feature> How to create Feature Flags on Azure App Configuration We are ready to move our Feature Flags to Azure App Configuration. Needless to say, you need an Azure subscription 😉 Log in to the Azure Portal, head to “Create a resource”, and create a new App Configuration: I’m going to reuse the same instance I created in the previous article - you can see the full details in the section. How to create an Azure App Configuration instance Now we have to configure the same keys defined in the appsettings file: , , and . Header Footer PrivacyPage Open the App Configuration instance and in the left panel. This is the central place for creating, removing, and managing your Feature Flags. Here, you can see that I have already added the and , and you can see their current state: “Footer” is enabled, while “Header” is not. locate the “Feature Manager” menu item Header Footer How can I add the flag? It’s elementary: click the “Create” button and fill in the fields. PrivacyPage You have to (they can also be different), and if you want, you can add a Label and a Description. You can also define whether the flag should be active by checking the “Enable feature flag” checkbox. define a Name and a Key Read Feature Flags from Azure App Configuration in an ASP.NET Core application It’s time to integrate Azure App Configuration with our ASP.NET Core application. Before moving to the code, we have to and store it somewhere. locate the connection string Head back to the App Configuration resource and locate the “Access keys” menu item under the “Settings” section. From here, copy the connection string ( ) and store it somewhere. I suggest that you use the Read-only Keys Before proceeding, you have to install the NuGet package. Microsoft.Azure.AppConfiguration.AspNetCore Now, we can by connecting to the connection string and by declaring that we are going to use Feature Flags: add Azure App Configuration as a source for our configurations builder.Configuration.AddAzureAppConfiguration(options =>
    options.Connect(connectionString).UseFeatureFlags()
); That’s not enough. We need to by adding such functionalities to the property. tell ASP.NET that we are going to these configurations consume Services builder.Services.AddAzureAppConfiguration();

builder.Services.AddFeatureManagement(); Finally, once we have built our application with the usual , we have to : builder.Build() add the Azure App Configuration middleware app.UseAzureAppConfiguration(); To try it out, run the application and validate that the flags are being applied. You can enable or disable those flags on Azure, the application, and check that the changes to the flags are being applied. Otherwise, you can and see the changes applied to your application. restart wait 30 seconds to have the flag values refreshed Using the Percentage filter on Azure App Configuration Suppose you want to enable a functionality only to a percentage of sessions ( ). In that case, you can use the Percentage filter. sessions, not users! The previous article had a specific section dedicated to the , so you might want to check it out. PercentageFilter As a recap, we defined the flag as: {
  "ShowPicture": {
    "EnabledFor": [
      {
        "Name": "Percentage",
        "Parameters": {
          "Value": 60
        }
      }
    ]
  }
} And added the filter to ASP.NET with: PercentageFilter builder.Services.AddFeatureManagement()
    .AddFeatureFilter<PercentageFilter>(); Clearly, we can define such flags on Azure as well. Head back to the Azure Portal and add a new Feature Flag. This time, you have to to any existing flag. add a new Feature Filter Even though the PercentageFilter is out-of-the-box in the FeatureManagement NuGet package, it is not available on the Azure portal. You have to define the filter with the following values: must be “Custom”; Filter Type must be “Percentage” Custom filter name You must add a new key, “Value,” and set its value to “60”. The configuration we just added reflects the JSON value we previously had in the file: 60% of the requests will activate the flag, while the remaining 40% will not. appsettings Define the cache expiration interval for Feature Flags By default, . Feature Flags are stored in an internal cache for 30 seconds Sometimes, it’s not the best choice for your project; you may prefer a longer duration to avoid additional calls to the App Configuration platform; other times, you’d like to have the changes immediately available. You can then define the cache expiration interval you need by configuring the options for the Feature Flags: builder.Configuration.AddAzureAppConfiguration(options =>
    options.Connect(connectionString).UseFeatureFlags(featureFlagOptions =>
    {
        featureFlagOptions.CacheExpirationInterval = TimeSpan.FromSeconds(10);
    })
); This way, Feature Flag values are stored in the internal cache for 10 seconds. Then, when you reload the page, the configurations are reread from Azure App Configuration, and the flags are applied with the new values. Further readings I built during these months to explore how to use configurations in ASP.NET Core. This is the final article of a path We started by learning how to set configuration values in an ASP.NET Core application, as explained here: 🔗 3 (and more) ways to set configuration values in ASP.NET Core Then, we learned how to read and use them with the family: IOptions 🔗 Understanding IOptions, IOptionsMonitor, and IOptionsSnapshot in ASP.NET Core From here, we learned how to read the same configurations from Azure App Configuration, to centralize our settings: 🔗 Azure App Configuration and ASP.NET Core API: a smart and secure way to manage configurations | Code4IT Then, we configured our applications to automatically refresh the configurations using a Sentinel value: 🔗 How to automatically refresh configurations with Azure App Configuration in ASP.NET Core Finally, we introduced Feature Flags in our apps: 🔗 Feature Flags 101: A Guide for ASP.NET Core Developers | Code4IT And then we got to this article! This article first appeared on Code4IT 🐧 Wrapping up In this article, we have configured an ASP.NET Core application to read the Feature Flags stored on Azure App Configuration. Here’s the minimal code you need to add Feature Flags for ASP.NET Core API Controllers: var builder = WebApplication.CreateBuilder(args);

string connectionString = "my connection string";

builder.Services.AddControllers();

builder.Configuration.AddAzureAppConfiguration(options =>
    options.Connect(connectionString)
    .UseFeatureFlags(featureFlagOptions =>
        {
            featureFlagOptions.CacheExpirationInterval = TimeSpan.FromSeconds(10);
        }
    )
);

builder.Services.AddAzureAppConfiguration();

builder.Services.AddFeatureManagement()
    .AddFeatureFilter<PercentageFilter>();

var app = builder.Build();

app.UseRouting();
app.UseAzureAppConfiguration();
app.MapControllers();
app.Run(); I hope you enjoyed this article! Let’s keep in touch on or ! 🤜🤛 Twitter LinkedIn Happy coding! 🐧 Also published . here

Azure App Configuration for Advanced Feature Flag Management in ASP.NET Core

APPMAP

appmap.io

-- employees

Since n.d.

COMPANY RANKING

APPMAP

EVERGREEN INDEX #1082

Representing this company? Click here to claim and customize this page!

AppMap WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

APPMAP

appmap.io

-- employees

Since n.d.

COMPANY RANKING

APPMAP

EVERGREEN INDEX #1082

RELATED COMPANIESRANK

STORIES ABOUT APPMAP

Representing this company? Click here to claim and customize this page!

AppMap WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!