What problem does it solve? Learners who have built a basic ASP.NET Core TODO API often struggle to understand how to secure it, especially the difference between authentication and authorization. This Skill provides a structured, five-phase build recipe that turns an unsecured EF Core API into a JWT-protected API with per-user data scoping. ## Core Features & Use Cases - JWT Authentication Setup: Guides installing Microsoft.AspNetCore.Authentication.JwtBearer, configuring TokenValidationParameters, and ordering authentication/authorization middleware correctly in Program.cs. - Login Endpoint and Token Issuance: Builds a POST /auth/login controller that validates credentials and returns signed JWTs with claims and expiry. - Endpoint and Data Protection: Applies [Authorize] filters and OwnerId-based data scoping with EF Core migrations so each user only sees their own TODOs, including an explanation of IDOR vulnerabilities. - Use Case: A mentor teaching a learner who finished an EF-backed TODO API uses this recipe to add login, protect endpoints, and run a two-user smoke test proving 401 for anonymous calls and row-level isolation between users. ## Quick Start Ask the mentor to start the cad-todo-api-auth project to add JWT login and per-user TODO authorization to your existing EF Core TODO API.
