{"id":31230167,"url":"https://github.com/fkucukkara/authn-authz-playground","last_synced_at":"2026-05-15T13:31:18.608Z","repository":{"id":314720409,"uuid":"1056512979","full_name":"fkucukkara/authn-authz-playground","owner":"fkucukkara","description":"A comprehensive .NET 9 demonstration project showcasing various authentication and authorization patterns in ASP.NET Core using .NET Aspire for orchestration.","archived":false,"fork":false,"pushed_at":"2025-09-14T12:37:59.000Z","size":66,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2025-09-22T10:03:54.412Z","etag":null,"topics":["agents","ai","api-rest","aspire","authorization","basic-authentication","claude-sonnet-4","csharp","dotnet-core","jwt-authentication","microservice"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fkucukkara.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-09-14T08:52:45.000Z","updated_at":"2025-09-14T19:31:42.000Z","dependencies_parsed_at":"2025-09-14T11:37:04.604Z","dependency_job_id":"4caa5b3d-c5c7-44fb-b778-dc7f00ad6991","html_url":"https://github.com/fkucukkara/authn-authz-playground","commit_stats":null,"previous_names":["fkucukkara/authn-authz-playground"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/fkucukkara/authn-authz-playground","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fkucukkara%2Fauthn-authz-playground","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fkucukkara%2Fauthn-authz-playground/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fkucukkara%2Fauthn-authz-playground/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fkucukkara%2Fauthn-authz-playground/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fkucukkara","download_url":"https://codeload.github.com/fkucukkara/authn-authz-playground/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fkucukkara%2Fauthn-authz-playground/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33068332,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-15T11:35:32.926Z","status":"ssl_error","status_checked_at":"2026-05-15T11:35:31.362Z","response_time":103,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["agents","ai","api-rest","aspire","authorization","basic-authentication","claude-sonnet-4","csharp","dotnet-core","jwt-authentication","microservice"],"created_at":"2025-09-22T09:59:34.481Z","updated_at":"2026-05-15T13:31:18.452Z","avatar_url":"https://github.com/fkucukkara.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Authentication \u0026 Authorization Playground\n\nA comprehensive .NET 9 demonstration project showcasing various authentication and authorization patterns in ASP.NET Core using .NET Aspire for orchestration.\n\n## 🎯 Project Overview\n\nThis repository demonstrates modern authentication and authorization techniques in ASP.NET Core, providing practical examples and best practices for securing web APIs. Each authentication method is implemented as a separate project to show clear separation of concerns and different approaches.\n\n## 🏗️ Project Structure\n\n```\nAuthNAuthZPlayground/\n├── AuthNAuthZPlayground.AppHost/          # .NET Aspire orchestration\n├── AuthNAuthZPlayground.ServiceDefaults/  # Shared service configurations\n├── BasicAuthentication/                   # HTTP Basic Authentication implementation\n└── JwtAuthentication/                     # JWT Bearer Token Authentication implementation\n```\n\n## 🔐 Authentication Types\n\n### ✅ Basic Authentication\n**Project:** `BasicAuthentication/`\n\nImplements HTTP Basic Authentication with in-memory user storage for demonstration purposes.\n\n**Features:**\n- Custom Basic Authentication handler\n- Role-based authorization (Admin, User)\n- Secure credential validation with timing attack prevention\n- Comprehensive API endpoints (public, protected, admin-only)\n- OpenAPI/Swagger integration with security definitions\n- Built-in test users for demonstration\n\n**Test Users:**\n- `admin:admin123` (Admin, User roles)\n- `user:user123` (User role)\n- `test:test123` (User role)\n- `demo:demo123` (User role)\n\n**Endpoints:**\n- `GET /api/public/health` - Public health check\n- `GET /api/public/weather` - Public weather forecast\n- `GET /api/protected/weather` - Protected weather forecast (requires authentication)\n- `GET /api/protected/user-info` - User information (requires authentication)\n- `GET /api/admin/users` - All users list (requires Admin role)\n\n### ✅ JWT Bearer Token Authentication\n**Project:** `JwtAuthentication/`\n\nImplements modern JWT Bearer token authentication with refresh token support and multiple authentication schemes.\n\n**Features:**\n- JWT Bearer token authentication with RS256 signing\n- Refresh token mechanism for secure token renewal\n- Multiple authentication schemes (Application JWT + Development JWT)\n- Policy-based authentication scheme selection\n- Role-based authorization (Admin, User)\n- `dotnet user-jwts` integration for development testing\n- Token blacklisting for secure logout\n- Comprehensive security configuration\n- OpenAPI/Swagger integration with JWT security definitions\n\n**Test Users:**\n- `admin:admin123` (Admin, User roles)\n- `user:user123` (User role)\n- `test:test123` (User role)\n- `demo:demo123` (User role)\n\n**Authentication Endpoints:**\n- `POST /api/auth/login` - Login with username/password (returns access and refresh tokens)\n- `POST /api/auth/refresh` - Refresh access token using refresh token\n- `POST /api/auth/logout` - Logout and invalidate tokens\n\n**API Endpoints:**\n- `GET /api/public/health` - Public health check\n- `GET /api/public/weather` - Public weather forecast\n- `GET /api/protected/weather` - Protected weather forecast (requires authentication)\n- `GET /api/protected/user-info` - User information (requires authentication)\n- `GET /api/admin/users` - All users list (requires Admin role)\n- `GET /api/admin/tokens` - Active tokens management (requires Admin role)\n\n**Development Testing:**\nUse `dotnet user-jwts` to create development tokens:\n```bash\ncd JwtAuthentication\ndotnet user-jwts create --role Admin --role User --name testuser\n```\n\n### 🔄 Planned Authentication Types\n\nThe following authentication methods will be added to demonstrate various approaches:\n\n- **Cookie Authentication** - Session-based authentication with cookies\n- **OAuth 2.0 / OpenID Connect** - Third-party authentication (Google, Microsoft, etc.)\n- **API Key Authentication** - Simple API key-based authentication\n- **Certificate Authentication** - Client certificate-based authentication\n- **Multi-Factor Authentication (MFA)** - TOTP/SMS-based additional security\n- **Custom Token Authentication** - Custom token schemes\n\n## 🚀 Getting Started\n\n### Prerequisites\n\n- [.NET 9 SDK](https://dotnet.microsoft.com/download/dotnet/9.0)\n- [Visual Studio 2022](https://visualstudio.microsoft.com/) or [Visual Studio Code](https://code.visualstudio.com/)\n- [Docker Desktop](https://www.docker.com/products/docker-desktop) (for Aspire dashboard)\n\n### Running the Projects\n\n#### Option 1: Using .NET Aspire (Recommended)\n\n1. **Start the Aspire AppHost:**\n   ```bash\n   cd AuthNAuthZPlayground.AppHost\n   dotnet run\n   ```\n\n2. **Access the Aspire Dashboard:**\n   - Open your browser to `http://localhost:15888` (URL will be displayed in console)\n   - Monitor all services from the centralized dashboard\n\n#### Option 2: Running Individual Projects\n\n1. **Basic Authentication Demo:**\n   ```bash\n   cd BasicAuthentication\n   dotnet run\n   ```\n   - API: `https://localhost:7082` or `http://localhost:5082`\n   - Swagger UI: Available at the root URL\n\n2. **JWT Authentication Demo:**\n   ```bash\n   cd JwtAuthentication\n   dotnet run\n   ```\n   - API: `https://localhost:7158` or `http://localhost:5182`\n   - Swagger UI: Available at the root URL\n\n### Testing the APIs\n\nEach project includes a `.http` file with pre-configured requests for testing:\n\n- **BasicAuthentication.http** - Contains all endpoint examples with proper authentication headers\n- **JwtAuthentication.http** - Contains JWT authentication flow examples including login, token refresh, and protected endpoints\n\nUse these files with:\n- Visual Studio 2022 (built-in support)\n- Visual Studio Code with REST Client extension\n- JetBrains Rider (built-in support)\n\n## 📚 Learning Resources\n\n### Security Best Practices Demonstrated\n\n1. **Secure Authentication Handling**\n   - Proper credential validation\n   - Timing attack prevention\n   - Secure password comparison\n\n2. **Authorization Patterns**\n   - Role-based access control (RBAC)\n   - Policy-based authorization\n   - Endpoint-specific security requirements\n\n3. **API Security**\n   - Security headers middleware\n   - HTTPS redirection\n   - Proper error handling\n   - OpenAPI security documentation\n\n4. **Modern .NET Practices**\n   - Minimal APIs\n   - Dependency injection\n   - Configuration patterns\n   - Structured logging\n   - Health checks\n\n### Architecture Highlights\n\n- **Clean Architecture** - Separation of concerns with services and handlers\n- **Dependency Injection** - Proper IoC container usage\n- **Configuration Management** - Environment-specific settings\n- **Observability** - Logging and monitoring with .NET Aspire\n- **API Documentation** - Comprehensive OpenAPI/Swagger integration\n\n## 🛠️ Development\n\n### Project Standards\n\n- **C# 13** with latest language features\n- **File-scoped namespaces** for cleaner code\n- **Nullable reference types** for better null safety\n- **Minimal APIs** for lightweight endpoints\n- **Record types** for DTOs and responses\n- **Modern async patterns** with proper cancellation support\n\n### Code Quality\n\n- Comprehensive XML documentation\n- Structured logging with Serilog patterns\n- Proper exception handling\n- Input validation and sanitization\n- Security-first approach\n\n## 🤝 Contributing\n\nThis is an educational project designed to demonstrate authentication patterns. Feel free to:\n\n1. **Fork the repository**\n2. **Add new authentication types** following the established patterns\n3. **Improve existing implementations** with better practices\n4. **Enhance documentation** and examples\n5. **Submit pull requests** with clear descriptions\n\n### Adding New Authentication Types\n\nWhen adding new authentication methods:\n\n1. Create a new project following the naming convention\n2. Implement the authentication handler and required services\n3. Add comprehensive endpoint examples\n4. Create a corresponding `.http` file for testing\n5. Update this README with the new authentication type\n6. Add the project to the Aspire AppHost for orchestration\n\n## 📝 License\n\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.\n\n## 🔗 Additional Resources\n\n- [ASP.NET Core Security Documentation](https://docs.microsoft.com/en-us/aspnet/core/security/)\n- [.NET Aspire Documentation](https://learn.microsoft.com/en-us/dotnet/aspire/)\n- [OpenAPI/Swagger Documentation](https://swagger.io/docs/)\n- [OWASP Security Guidelines](https://owasp.org/www-project-top-ten/)\n\n---\n\n**Happy Learning!** 🎓\n\n*This project is designed for educational purposes to demonstrate various authentication and authorization patterns in modern .NET applications.*","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffkucukkara%2Fauthn-authz-playground","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffkucukkara%2Fauthn-authz-playground","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffkucukkara%2Fauthn-authz-playground/lists"}