All 16 Authentication & Authorization (Identity, JWT, OAuth) questions
More in Authentication & Authorization (Identity, JWT, OAuth)
What is the difference between authentication and authorization in ASP.NET Core? What is ASP.NET Core Identity, and what does it provide out of the box? How do you implement role-based authorization using the [Authorize(Roles = "...")] attribute? How do refresh tokens work alongside short-lived access tokens, and why is this pattern used? What is the OAuth 2.0 Client Credentials flow, and when is it used instead of the Authorization Code flow? What are the security risks of storing JWTs in browser localStorage versus HttpOnly cookies? What is the purpose of the 'scope' parameter in OAuth 2.0, and how does it implement the principle of least privilege? What are JWT claims, and how do you add custom claims when issuing a token? How does the OAuth 2.0 Authorization Code flow work, and why is it preferred over the deprecated Implicit flow for web applications? How do you implement policy-based authorization for more complex, custom access rules beyond simple roles?
Advertisement
.NET › Authentication & Authorization (Identity, JWT, OAuth)

How does JWT (JSON Web Token) authentication work at a high level in ASP.NET Core?

Intermediate

Answer

A client authenticates once (e.g., with credentials) and receives a signed JWT containing claims about the user (identity, roles, expiration) encoded in its payload. For subsequent requests, the client sends this token (typically in the Authorization: Bearer header), and JWT bearer middleware validates the token's signature, expiration, issuer, and audience without needing a server-side session lookup, making it stateless and well-suited for APIs and distributed systems.
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options => {
        options.TokenValidationParameters = new TokenValidationParameters {
            ValidateIssuer = true,
            ValidIssuer = "myapp",
            ValidateAudience = true,
            ValidAudience = "myapp-api",
            IssuerSigningKey = new SymmetricSecurityKey(key)
        };
    });
Real-world example A single-page application logs in once, receives a JWT, and includes it as a Bearer token on every subsequent API call, letting the stateless API validate each request independently without a shared session store.

Common follow-ups: Why is JWT considered stateless compared to cookie-based sessions?;How do you handle token revocation with stateless JWTs?

ASP.NET Core Middleware & Request Pipeline;CORS & Cross-Origin Resource Sharing
All 16 Authentication & Authorization (Identity, JWT, OAuth) questions