diff --git a/blazor/common/authentication/blazor-jwt-authentication.md b/blazor/common/authentication/blazor-jwt-authentication.md index 64c94b6291..96597cf2b7 100644 --- a/blazor/common/authentication/blazor-jwt-authentication.md +++ b/blazor/common/authentication/blazor-jwt-authentication.md @@ -13,7 +13,7 @@ This guide shows how to secure the [Syncfusion® Blazor DataGrid](https://www.sy ## Create a Blazor project -If you already have a Blazor project configured, you can skip this section and proceed to **Install required packages**. +If you already have a Blazor project configured, you can skip this section and proceed to [Install required packages](./blazor-jwt-authentication#install-required-packages). Otherwise, create a new Blazor application by following the [Syncfusion® getting started guide](https://blazor.syncfusion.com/documentation/getting-started/blazor-web-app) for a **Blazor Web App (Interactive Server)**. @@ -93,6 +93,7 @@ The **JWT** configuration specifies how the server signs and validates authentic { "Jwt": { + // Secret key used to create and validate JWT tokens; you can set your own random string with at least 32 characters. "Key": "REPLACE_WITH_A_LONG_RANDOM_SECRET_32+_CHARS", "Issuer": "BlazorJWT", "Audience": "BlazorJWTClient" @@ -176,6 +177,8 @@ public class AuthController : ControllerBase private readonly TokenService _tokenService; public AuthController(TokenService tokenService) => _tokenService = tokenService; + // This endpoint is intended for demonstration purposes only. + // For production, you can use validation mechanisms such as verifying user credentials before issuing tokens. [HttpPost("token")] public IActionResult Token([FromQuery] string user = "user123") { @@ -192,7 +195,7 @@ public class AuthController : ControllerBase Register **JWT** authentication and authorization middleware to validate incoming API requests. Add these configurations in `Program.cs`. {% tabs %} -{% highlight razor tabtitle="~/Program.cs" %} +{% highlight csharp tabtitle="~/Program.cs" %} using System.Text; using YourProjectName.Components; @@ -212,6 +215,13 @@ builder.Services.AddHttpClient(); builder.Services.AddSyncfusionBlazor(); var jwtKey = builder.Configuration["Jwt:Key"] ?? throw new InvalidOperationException("Jwt:Key missing"); +var jwtIssuer = builder.Configuration["Jwt:Issuer"] ?? throw new InvalidOperationException("Jwt:Issuer missing"); +var jwtAudience = builder.Configuration["Jwt:Audience"] ?? throw new InvalidOperationException("Jwt:Audience missing"); + +if (jwtKey.Length < 32) +{ + throw new InvalidOperationException("Jwt:Key must be at least 32 characters for HS256 algorithm"); +} builder.Services .AddAuthentication(JwtBearerDefaults.AuthenticationScheme) @@ -224,8 +234,8 @@ builder.Services ValidateIssuerSigningKey = true, ValidateLifetime = true, ClockSkew = TimeSpan.FromMinutes(5), - ValidIssuer = builder.Configuration["Jwt:Issuer"], - ValidAudience = builder.Configuration["Jwt:Audience"], + ValidIssuer = jwtIssuer, + ValidAudience = jwtAudience, IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtKey)) }; }); @@ -272,8 +282,8 @@ public class OrdersDetails { OrderID = i, CustomerID = $"CUST-{i:000}", - ShipCity = i % 2 == 0 ? "Chennai" : "Bengaluru", - ShipCountry = "India" + ShipCity = i % 2 == 0 ? "New York" : "Los Angeles", + ShipCountry = "USA" }).ToList(); } return _data; @@ -335,6 +345,13 @@ This example demonstrates how a **JWT** token is retrieved from the server and a +@if (!string.IsNullOrEmpty(error)) +{ +