auth-jwt

Implement JWT refresh token rotation in a .NET web API by using short-lived access tokens and a refresh token repository that invalidates used tokens upon each refresh cycle. This approach minimizes the blast radius of token theft by ensuring stolen refresh tokens cannot be reused.

The best way to validate JWT issuer and audience in .NET bearer authentication is binding JwtOptions to your configuration and enforcing full validation of issuer, audience, lifetime, and signing key. You should also reduce clock skew to approximately 30 seconds to prevent token drift issues.

Securely store JWT signing keys in .NET by binding your authentication configuration to user secrets during development or Azure Key Vault in production. This prevents leaking secrets in source code while exposing validated signing keys to the token generation service.

You can expose current user claims to authorization handlers in a .NET Minimal API by implementing a dedicated ICurrentUserService. This service reads claims from the bearer token context, allowing handlers and authorization policies to make claim-based access decisions.

You need short-lived access tokens with rotating refresh tokens to minimize the security impact of token theft. Short lifetimes limit the validity window of a compromised access token, while rotation ensures each refresh token is single-use, immediately revoking it after a new token is issued.

Yes, this JWT authentication approach works directly with existing .NET Minimal APIs by providing token generation, refresh flows, and login endpoints specifically designed for the Minimal API architecture, allowing you to add compliant bearer authentication without restructuring your endpoints.