Check if user exists in ASP.NET Core WebAPI JWT Authentication

Question

I have succesfully setup JWT authentication/authorization in my WebAPI, but there's one problem: I can create a new user account, generate it's JWT token, then delete the account while the token is still valid. How and where should I check if the user associated with the token actually exists before authorizing?

Here's my code to setup JWT (Startup.cs):

var secretKey = Configuration.GetValue<string>("SecretKey");
            var symmetricKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey));

            services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddJwtBearer(options =>
                {
                    options.TokenValidationParameters = new TokenValidationParameters()
                    {
                        ValidateIssuer = true,
                        ValidateAudience = true,
                        ValidateIssuerSigningKey = true,

                        ValidIssuer = "localhost",
                        ValidAudience = "localhost",
                        IssuerSigningKey = symmetricKey
                    };
                });

I'm using the [Authorize] attribute on my controllers and the user ID is in the JWT token.

Thanks in advance!

Can be helpful: https://stackoverflow.com/questions/21978658/invalidating-json-web-tokens — Mateech, Apr 22 '20 at 18:19
Please use IActionFilter if you want to check before controllers action — CoderSam, Apr 22 '20 at 18:19
@Mateech I've already looked into that, I know I want to check if the user exists, but I don't know where to do that. — kwyntes, Apr 22 '20 at 18:22
Unauthorizing the user before deleting is another approach if you only want to prevent clients to access when their account is deleted — zekeriya kocairi, Apr 22 '20 at 20:18

score 9 · Accepted Answer · answered Apr 23 '20 at 06:46

You can also validate the user in AddJwtBearer events :

options.Events = new JwtBearerEvents()
{
    OnTokenValidated = context =>
    {
        //get userid if type is "userid"
        var userid = context.Principal.Claims.Where(x => x.Type == "userid").FirstOrDefault().Value;
        if (true )
        {
            context.Fail("invaild token");
        }
        return Task.CompletedTask;
    },

};

If you want to check database in that event , you can use dependency inject to get db context like :

var dbcontext = context.HttpContext.RequestServices.GetRequiredService<ApplicationDbContext>();

Thanks! This is exactly what I was looking for! – kwyntes Apr 23 '20 at 09:26 — kwyntes, Apr 23 '20 at 09:26

Check if user exists in ASP.NET Core WebAPI JWT Authentication

1 Answers1