Adding JWT authentication to the API

In previous versions of ASP.NET Core, configuring authentication was far more cumbersome and not particularly intuitive. However, with the 2.0 release, Microsoft did a lot of work to refactor how authentication works in ASP.NET Core, and it's now a very simple process to add it to an ASP.NET Core web app. 

 

Why JWTs?

For standard server-side web applications built with MVC, we'd most likely use cookies rather than JWTs, which is the default option if we don't specify one. However, as we're building a stateless web API with an SPA frontend, it makes much more sense to use JWTs in order to maintain the stateless nature of the application.

In traditional MVC applications, when a user logs in, a session is created on the server and a cookie is returned to the user's browser, which identifies that session on subsequent HTTP requests. This is a stateful authentication mechanism that doesn't really fit in with modern applications that use JavaScript SPA frameworks...