JWT with authorization client side

Question

JWT with authorization client side

DsLond 1

Hello,
I have created web api server with jwt auth. In jwt I can get role claims for users. Roles are user, manager and admin.

My client is asp.net core MVC. So I have a layout page with menu items. We can use "@if(User.IsInRole("Admin"))" to hide/show menu items in web app without consuming api.. My question is how can I make menu items show and hide based on user role from jwt consuming api and what is the best practice for this (action or auth filters, middle ware etc.).

AgaveJoe 31,706 Reputation points

2021-10-03T11:16:49.907+00:00

MVC applications are browser based application and do not use a JWT authorization they use an authentication cookie. A JWT is used when the client is code. See the docs for how to configure and create an authorization cookie.

Use cookie authentication without ASP.NET Core Identity
DsLond 1 Reputation point

2021-10-03T23:00:48.167+00:00

I am saving jwt in session. Angular and react are also using Jwt as clients. I want to use MVC instead. Views and controllers and serialize JSON responses to models.
AgaveJoe 31,706 Reputation points

2021-10-03T23:50:07.273+00:00

Again, browser based applications like MVC use an authentication cookie to authorize requests. Storing a JWT in Session is fine but the approach has nothing to do with authorization in MVC unless you wrote custom code. I would simply implement cookie authentication as illustrated in the link I provided in my first response.
DsLond 1 Reputation point

2021-10-04T06:15:18.077+00:00

So I will get JWT from api server, then store it in a session, then decode it and get user and role claims and sign in with cookie authentication. When showing or hiding menu items based on role I will use cookie auth and for api calls will use jwt from session?

1 answer

Your answer

AgaveJoe 31,706 Reputation points

2021-10-03T11:16:49.907+00:00

MVC applications are browser based application and do not use a JWT authorization they use an authentication cookie. A JWT is used when the client is code. See the docs for how to configure and create an authorization cookie.

Use cookie authentication without ASP.NET Core Identity
DsLond 1 Reputation point

2021-10-03T23:00:48.167+00:00

I am saving jwt in session. Angular and react are also using Jwt as clients. I want to use MVC instead. Views and controllers and serialize JSON responses to models.
AgaveJoe 31,706 Reputation points

2021-10-03T23:50:07.273+00:00

Again, browser based applications like MVC use an authentication cookie to authorize requests. Storing a JWT in Session is fine but the approach has nothing to do with authorization in MVC unless you wrote custom code. I would simply implement cookie authentication as illustrated in the link I provided in my first response.
DsLond 1 Reputation point

2021-10-04T06:15:18.077+00:00

So I will get JWT from api server, then store it in a session, then decode it and get user and role claims and sign in with cookie authentication. When showing or hiding menu items based on role I will use cookie auth and for api calls will use jwt from session?

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more