I am using IdentitySercer4 with my .net application. I have IDS running and dishing out JWT tokens, an API endpoint protected with JWT and a Website.
Q. My website goes to IDS to get the token and can now call the API endpoint. But what do I do next? Surely I don't go back to IDS for another token for every call? Do I save my JWT token - either Db or cookie? and then present it every time. When is the check carried out to see if the JWT token has expired so the client goes back to IDS to get a new token?
Thanks
You cache your token in the client and present it in the Authorization header in every request. The resource server (your API) validates the token during every request. At first, it checks the signature under the token by using the public key (the token is signed by the private key only known to the Identity Server). If the signature is valid, then it checks other stuff like the expiration date. The public key is obtainable from the URI /.well-known/openid-configuration of your IdentityServer. The resource server (your API) shouldn't call this endpoint every request, it should cache the public key instead. If your API is written in .NET, you should consider using the default
authentication middleware implementation and setting Authority to point to your IdentityServer, this way token validation will be working out of the box.
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
{
options.Authority = "<IdentityServerAddress:Port>";
})