Updated Published 9 min read
ASP.NET Core JWT Auth: Issuance, Validation, Lifetimes
ASP.NET Core JWT checklist for issuance, validation, and token lifetimes only. Refresh rotation and the Angular interceptor each have their own post.
Blog topic
Article map for JWT, Angular interceptors, refresh rotation, BFF/YARP, and CORS — open the linked guide for each failure mode.
Auth deep dives live on the articles below. Start with JWT checklist, then interceptors, rotation, and BFF as needed.
This page is the article map for JWT and SPA auth. Each failure mode has its own article — open those for deep answers and production code.
| You want… | Open |
|---|---|
| JWT API checklist | JWT auth |
| Angular interceptors | JWT interceptors |
| Concurrent 401 refresh queue | 401 refresh queue |
| 401 vs 403 | 401 vs 403 |
| Refresh rotation | Refresh token rotation |
| BFF / YARP | BFF pattern |
| HttpOnly cookie refresh | Refresh token cookie |
| Auth guards in Angular | Angular auth guard |
| Identity product choice | Identity hub |
| Term | Meaning | Deep dive |
|---|---|---|
| Authentication | Who the user is | JWT auth |
| Authorization | What they may do (403) | 401 vs 403 |
| Refresh | Rotate without re-login | Rotation |
| BFF | Tokens stay server-side | BFF |
JWT authentication on ASP.NET Core is a three-layer stack:
Token issuance. Your identity server (IdentityServer / OpenIddict / Entra ID) issues a JWT access token and a refresh token. The access token is short-lived (15 min). The refresh token is long-lived and stored in an HttpOnly cookie.
Token validation. The API validates the JWT on every request — iss, aud, exp, and the signing key (kid). A misconfigured TokenValidationParameters that accepts expired tokens or any signing key is the most common auth bug in .NET APIs. See JWT signature validation (IDX10503) and kid validation (IDX10501).
Token delivery. SPAs should store access tokens in memory (not localStorage — that's XSS-accessible). Refresh tokens belong in HttpOnly cookies, managed server-side by a BFF. See refresh token in HttpOnly cookie and BFF pattern.
Angular handles JWT through HTTP interceptors. The interceptor pattern attaches the bearer token to outgoing requests and handles 401 responses by queuing concurrent requests while a single refresh fires, then replaying them with the new token.
The most common Angular auth bug is not handling concurrent 401s: two requests expire simultaneously, both fire a refresh, and one gets a invalid_grant error because the refresh token was already consumed. The fix is a refresh queue with a BehaviorSubject. See 401 refresh queue.
The BFF (Backend for Frontend) pattern moves token management entirely to the server. The Angular SPA gets session cookies, not tokens. There is no bearer token in localStorage or even memory — the Angular app never sees a JWT.
Use BFF when:
Skip BFF when:
See BFF vs YARP custom BFF for the trade-off between Duende BFF and rolling your own.
Redirect loop with IdentityServer. Usually a redirect_uri mismatch in the client configuration. The error appears in the browser URL bar but not in the .NET logs. See IdentityServer redirect URI.
HTTP 401 when the token looks valid. Either the aud claim does not match ValidAudiences, or the signing key has rotated and the API has cached the old JWKS. Enable MetadataAddress so the API refreshes the JWKS automatically. See IDX10503.
Angular logging users out under load. Multiple components make API calls simultaneously on page load. All 401 at once. The interceptor fires a refresh for each — the second refresh call gets invalid_grant. Implement the queue. See 401 refresh queue.
For the identity server choice (IdentityServer4 → OpenIddict migration, Entra ID, MapIdentityApi), go to the identity hub. For the security implications of authentication — what an attacker can do with a stolen JWT, BOLA, STRIDE — see the security hub.
Related: Identity · Interview Questions
API checklist: JWT auth. SPA attach/refresh: Angular JWT interceptors. This page only indexes the cluster.
Challenge vs Forbid and Angular logout mistakes: 401 vs 403.
Updated Published 9 min read
ASP.NET Core JWT checklist for issuance, validation, and token lifetimes only. Refresh rotation and the Angular interceptor each have their own post.
6 min read
ASP.NET Core 401 Unauthorized vs 403 Forbidden — Challenge vs Forbid, JWT bearer mapping, Angular interceptor rules, and why logging out on 403 is wrong.
5 min read
Fix IDX10503 JWT signature validation failed in ASP.NET Core — wrong HMAC secret, disposed RSA keys, opaque Identity tokens, and how it differs from IDX10501 kid mismatch.
6 min read
Fix IDX10501 JWT kid mismatch in ASP.NET Core — token header kid not in JWKS, signing cert rotation overlap, Authority mismatch, and OpenIddict key refresh.
7 min read
Angular HTTP interceptors for ASP.NET Core JWT — bearer attach, in-memory access tokens, and single-flight refresh overview. Concurrent 401 queues and 401 vs 403 have dedicated guides.
6 min read
Compare API gateway options for .NET microservices: Azure API Management, YARP, Ocelot, and AWS API Gateway. When to build vs use a managed service.
11 min read
Angular silent token refresh on startup runs one cookie POST before the first secured call and keeps the access token in memory, not localStorage.
13 min read
Angular OIDC PKCE against ASP.NET Core: a public client, the code exchange, and an API that rejects a wrong audience. No client secret in the bundle.
7 min read
Duende BFF vs custom YARP BFF for Angular ASP.NET Core — buy vs build, OIDC session, CSRF, licensing tradeoffs, and failure modes at 2 a.m.
7 min read
HttpOnly cookie refresh tokens for Angular and ASP.NET Core JWT — vs localStorage and BFF, cookie flags, withCredentials, CORS credentials, and CSRF defense.
Updated Published 7 min read
Fix concurrent 401 refresh stampede in Angular against ASP.NET Core JWT rotation — single-flight RxJS queue, shareReplay pitfalls, skip rules, and POST retry safety.
7 min read
Backend-for-Frontend BFF pattern with ASP.NET Core, Angular, and YARP — cookie sessions, server-side tokens, CSRF defense, and when to skip SPA-held JWTs.
9 min read
ASP.NET Core JWT refresh token rotation guide — hashed storage, family revocation, reuse detection, concurrency locks, and the Angular single-flight contract.
6 min read
Angular auth guard and CanActivateFn with ASP.NET Core JWT — route protection, role guards, token expiry checks, returnUrl safety, and why guards are UX not API security.
7 min read
ASP.NET Core RBAC with named role policies, and why a failed policy returns 403 rather than 401. Hiding a button in the UI is not enforcement.
8 min read
Fix CORS between Angular and ASP.NET Core — exact origins, AllowCredentials, OPTIONS preflight, middleware order, Azure App Service, and cookie-based JWT refresh.