OAuth implementation in web api

Hello,

To implement a self-hosted OAuth solution for your Web API, you need to create your own central identity provider. This server will handle user logins and issue security tokens that your API will trust.

The professional standard for building this in .NET is Duende IdentityServer. It's a security-hardened framework that correctly implements the necessary protocols (OAuth 2.0 and OpenID Connect), saving you from the extreme risk of trying to build it yourself.

Here’s a breakdown of the architecture:

1. The IdentityServer Project

This is a dedicated ASP.NET Core application you create. Its responsibilities are:

• User Authentication: It hosts the login, registration, and logout pages. It connects to your user database (typically using ASP.NET Core Identity).
• Token Issuance: After a user successfully logs in, it creates and signs a secure JSON Web Token (JWT).
• Client & API Configuration: You define which client applications are allowed to request tokens and which APIs are protected.

2. The Web API Project (Your "Resource Server")

This is your existing API. You add and configure authentication middleware:

• Token Validation: It inspects the JWT on every incoming request to ensure it was issued by your IdentityServer and hasn't expired.
• Authorization: The [Authorize] attribute on your controllers or endpoints will grant or deny access based on the validated token. Your API doesn't need to know the user's password; it just needs to trust the token.

3. The Client Project (e.g., a Web App, SPA, or Mobile App)

This is the user-facing application:

• Login Redirection: When a user needs to access a protected resource, the client redirects them to your IdentityServer's login page.
• Token Handling: After a successful login, the IdentityServer redirects the user back to the client, providing the JWT.
• API Requests: The client stores this token and includes it in the Authorization header of every request it makes to your Web API.

This setup decouples authentication from your APIs, creating a more secure and maintainable system. To get started, you would follow the Duende IdentityServer quick-start guides to build the IdentityServer project first, then configure your API to use it.

Hope this helps!

you need a on perm oauth server. While no longer free you might be interested in identity server.

https://duendesoftware.com/products/identityserver

you can google for webapi jwt samples, but most are not very secure.