ASP.NET Core 5 MVC web application - Login via xamarin

From api, you can configure the jwt authentication as this.

1. In Startup

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication(x =>
        {
            x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddJwtBearer(o =>
        {
   
            o.TokenValidationParameters = new TokenValidationParameters
            {
                NameClaimType = JwtClaimTypes.Name,
                RoleClaimType = JwtClaimTypes.Role,
   
                //The previous three items are required
                ValidIssuer = "http://localhost:5000",
                ValidAudience = "api",
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes("this is a long key"))
   
                /***********************************default TokenValidationParameters parameter***********************************/
                // RequireSignedTokens = true,
                // SaveSigninToken = false,
                // ValidateActor = false,
   
            };
   
        });
        services.AddControllers();
    }
   
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        //...
        app.UseRouting();
        app.UseAuthentication();
        app.UseAuthorization();
        //...
    }
   

2. Apply for a token, generate a string token in the action.

    public IActionResult Authenticate()
    {
   
        var tokenHandler = new JwtSecurityTokenHandler();
        var key = Encoding.ASCII.GetBytes("this is a long key");
        var authTime = DateTime.UtcNow;
        var expiresAt = authTime.AddDays(7);
        var tokenDescriptor = new SecurityTokenDescriptor
        {
            Subject = new ClaimsIdentity(new Claim[]
            {
                new Claim(JwtClaimTypes.Audience,"api"),
                new Claim(JwtClaimTypes.Issuer,"http://localhost:5000"),
                new Claim(JwtClaimTypes.Id, "10"),
                new Claim(JwtClaimTypes.Name, "my name"),
                new Claim(JwtClaimTypes.Email, "email"),
            }),
            Expires = expiresAt,
            SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
        };
        var token = tokenHandler.CreateToken(tokenDescriptor);
        var tokenString = tokenHandler.WriteToken(token);
   
        return Ok(tokenString);
    }
   

3. Xamarin App receives token and save it. When Xamarin App access the authorized resource, it can carray this token with this header.

        var client = new HttpClient();
        var token = client.GetAsync("[url that get the token] ");
   
        client.DefaultRequestHeaders.Add("Authorization", $"Bearer {token}");
        client.GetAsync("[url that get the authorized resource] ");