authentication

JWT bearer authentication in ASP.NET Core validates issuer, audience, lifetime, and signing keys so clients can safely call protected endpoints. You configure token validation parameters and secure secret handling to enforce access rules across endpoint groups.

Use cookies for web apps like Blazor or MVC, and use JWT bearer tokens for REST APIs. This separation ensures appropriate session management and token validation parameters based on the application type.

Policy-based authorization replaces fragile role strings with composable policies supporting roles, claims, and custom requirements. You define authorization policies or custom authorization handlers to enforce role- or claim-based access rules across endpoint groups.

OpenID Connect integrates external identity providers for code-based sign-in flows in ASP.NET Core. It works alongside ASP.NET Identity for user management, handling password hashing, lockout, two-factor, and email confirmation without a custom user store.

JWT validation fails when issuer, audience, lifetime, or signing keys are configured incorrectly or secrets are mishandled. Correct token validation parameters and secure secret handling are required to properly protect ASP.NET Core endpoints.