Tag Archives: Bearer

Securing an ASP.NET Core MVC application which uses a secure API

February 2, 2018 · by · in .NET, .NET Core, ASP.NET Core, dotnet, MVC, OAuth2, Security, Web · 3 Comments

The article shows how an ASP.NET Core MVC application can implement security when using an API to retrieve data. The OpenID Connect Hybrid flow is used to secure the ASP.NET Core MVC application. The application uses tokens stored in a cookie. This cookie is not used to access the API. The API is protected using […]

Securing an Angular SignalR client using JWT tokens with ASP.NET Core and IdentityServer4

October 16, 2017 · by · in .NET, .NET Core, Angular2, ASP.NET Core, Entity Framework · 9 Comments

This post shows how an Angular SignalR client can send secure messages using JWT bearer tokens with an API and an STS server. The STS server is implemented using IdentityServer4 and the API is implemented using ASP.NET Core. Code: https://github.com/damienbod/AspNetCoreAngularSignalRSecurity Posts in this series Getting started with SignalR using ASP.NET Core and Angular SignalR Group […]

Full Server logout with IdentityServer4 and OpenID Connect Implicit Flow

September 16, 2016 · by · in .NET, Angular2, AngularJS, ASP.NET Core, ASPNET5, dotnet, OAuth2, Security, Typescript · 3 Comments

The article shows how to fully logout from IdentityServer4 using an OpenID Connect Implicit Flow. Per design when using an access token to use protected data from a resource server, even if the client has logged out from the server, the access token can be used so long it is valid (AccessTokenLifetime) as it is […]

Authorization Policies and Data Protection with IdentityServer4 in ASP.NET Core

February 14, 2016 · by · in .NET, ASPNET5, Entity Framework, MVC, OAuth2, Security, SQLite, TopHeaderMenu, Web · 21 Comments

This article shows how authorization policies can be used together with IdentityServer4. The policies are configured on the resource server and the ASP.NET Core IdentityServer4 configures the user claims to match these. The resource server is also setup to encrypt a ‘Description’ field in the SQLite database, so it cannot be read by opening the […]