I have an asp .net core web api which uses JWT to authenticate the user. I want to allow 2 ways to access it

React web app, I will have a react web app that will be the UI and of course will make requests to the api, in that I will store the jwt as an http only cookie.

Open api, the user can get a token and make requests via postman for example to my api, in that I will use Authorization Bearer token in the headers.

My question is, what is the best practice to do such a thing, I read some solutions like creating a middleware that will transfer the cookie to a header etc. But I really want to know what is the most recommended approach here?

Authenticate JWT from cookie and from Authorization bearer

I'm storing user role in jwt token . the admin can change the roles.

and I have revoke token functionality by jti on redis server.

so if i update the user role . it should refelect the jwt token . but as far i as know jwts cant be changed .

storing refresh token and the token jti in the database. revoke refresh token and token when changing user role .

is this approach fine? or is there any better way to handle this?

jwt

Trending Blogposts on jwt

Popular Discussions on jwt

openAuthenticate JWT from cookie and from Authorization bearer

0

0

0

openstoring roles in jwt revoke on change

1

0

0

PRODUCTS

QUICK LINKS

LEGAL

jwt

Trending Blogposts on jwt

Popular Discussions on jwt

openAuthenticate JWT from cookie and from Authorization bearer

0

0

0

openstoring roles in jwt revoke on change

1

0

0