Module 13: Authentication & Authorization

In the world of software development, a feature isn’t “done” until it is secure. Module 13 covers the “Who are you?” and “What are you allowed to do?” of a .NET application.

1. Identity Basics: AuthN vs. AuthO

It is easy to confuse these two, but they are distinct steps in the security chain:

• Authentication (AuthN): The process of verifying who a user is. (e.g., “I am John Doe, and here is my password.”)
• Authorization (AuthO): The process of verifying what a user is allowed to do. (e.g., “John Doe is logged in, but is he allowed to delete this database?”)

2. ASP.NET Core Identity

This is a complete membership system built by Microsoft. It handles:

• User Management: Registering users, hashing passwords, and storing profiles.
• Account Recovery: Password resets and email confirmation.
• Two-Factor Authentication (2FA): Support for SMS or Authenticator apps.
• Stores: It uses EF Core to automatically create tables (like AspNetUsers and AspNetRoles) in your database.

3. JWT Authentication (JSON Web Tokens)

While standard Web Apps use Cookies, modern APIs use JWTs. When a user logs in, the server sends back a “Token”—a signed string that the browser or mobile app stores.

• Header: Contains the algorithm used (e.g., HMAC SHA256).
• Payload: Contains “Claims” (User ID, Email, Expiration date).
• Signature: A secret code that proves the token hasn’t been tampered with.

Why JWT? It’s stateless. The server doesn’t need to store a session; it just validates the signature of the token the client sends in every request header.

4. Role-Based vs. Policy-Based Authorization

Role-Based (Simple)

Checks if a user belongs to a specific group.

C#

[Authorize(Roles = "Admin")]
public IActionResult DeleteUser() { ... }

Policy-Based (Advanced)

Modern and flexible. You define a “Requirement” (e.g., “Must be over 18” or “Must have a specific Employee ID”) and group them into a Policy.

• Benefit: You can change the logic of “Who is a VIP” in one central file without touching 50 controllers.

5. OAuth 2.0 & OpenID Connect (OIDC) Overview

You’ve seen this whenever you click “Log in with Google” or “Log in with GitHub.”

• OAuth 2.0: A protocol for Authorization. It lets an app access your data on another service (like reading your Google Calendar) without knowing your password.
• OpenID Connect: A layer on top of OAuth that adds Authentication (identity) info.

6. Securing APIs: The “Defense in Depth”

When building production-grade APIs, you apply security at multiple layers:

1. HTTPS: Encrypting data in transit.
2. CORS (Cross-Origin Resource Sharing): Restricting which websites are allowed to talk to your API.
3. Data Protection: Masking sensitive data in logs.
4. Rate Limiting: Preventing “Brute Force” attacks by limiting how many times someone can try to log in per minute.

Outcome: Build Secure Applications

By the end of this module, your applications will no longer be “open doors.” You will be able to:

1. Protect specific endpoints so only logged-in users can reach them.
2. Generate secure JWT tokens for mobile and web clients.
3. Restrict high-level features (like “Delete”) to Admin users only.
4. Understand how to integrate third-party logins like Google or Microsoft.