Autoplay
Autocomplete
Previous Lesson
Complete and Continue
Secure Your APIs: JWT, Roles & Policies in ASP.NET Core
Important Introduction
About This Course
Telegram Group for This Course
🟦 Introduction - Course Orientation (Continuation Mode)
📖 How This Course Continues From Course #1 -Introduction to RESTFul API's? (16:52)
📖 Running & Verifying the Existing Student API (21:14)
📖 Security Upgrade Roadmap (25:15)
🟦 Module 1 — Security Audit (Why the Current API Is Unsafe)
📖 Security Audit — Attacking the Existing Student API (39:22)
❓ Quiz — Security Audit: Attacking the Existing Student API
📖 Defining Security Boundaries for Student Endpoints (24:35)
❓ Quiz — Defining Security Boundaries for Student Endpoints
🧱 Security Maturity Levels (Self-Read)
📖 Security Maturity Levels
❓ Quiz - Security Maturity Levels
🧠 Common API Security Myths (That Break Real Systems)
📖 Common API Security Myths (That Break Real Systems)
❓ Quiz - Common API Security Myths
🟦 Module 2 -📦🔐🧬 Encoding vs Encryption vs Hashing — Explained
📖 Encoding vs Encryption vs Hashing (13:19)
📖 Encoding (28:29)
🧪 Encoding Demo (.NET) — Encoding ≠ Security
📖 Encryption (25:52)
🧪 Encryption Demo (.NET) — Protecting data that must be read again
📖 Hashing (27:25)
❓ Quiz — Encoding vs Encryption vs Hashing
📖 🔐 Salting & Slow Hashing (Defending Against Real Attacks) (25:03)
🧪 Hashing Demo (.NET) — Protecting secrets that must never be revealed
❓ Quiz — 🔐 Salting & Slow Hashing (Defending Against Real Attacks)
🟦 Module 3 — Basic Shield (HTTPS + CORS)
📖 HTTPS for Beginners (32:12)
❓ Quiz - HTTPS for Beginners
📖 Enforcing HTTPS (22:55)
❓ Quiz - Enforcing HTTPS in ASP.NET Core
📖 CORS for Beginners (32:14)
❓ Quiz — CORS for Beginners
📖 🛠️ ASP.NET Core CORS Configuration (31:54)
❓ Quiz — 🛠️ ASP.NET Core CORS Configuration
📌 Where We Are Now — And Why We Must Continue
🟦 Module 4 — Authentication with JWT (Core Module)
📖 Why Authentication Is Needed Now? (20:25)
❓ Quiz — Why Authentication Is Needed Now?
📖 JWT Explained (Student Identity Analogy) (10:48)
❓ Quiz — JWT Explained (Student Identity Analogy)
📖 JWT Structure - Header, Payload & Signature Explained (9:00)
❓ Quiz — JWT Structure: Header, Payload & Signature
📖 Preparing Student Data for Login (In-Memory DB) (21:55)
📖🔐 Login Endpoint — Verifying Passwords & Issuing JWT (39:24)
📖🛠️ Protecting Student Endpoints with JWT Authentication Middleware (14:47)
🧪 📖 Testing Secured APIs with Swagger (JWT Authorization) (6:13)
🧪 📖 Testing Secured Student API Using a C# Console Client (7:42)
📌 Where You Are Now — And What Comes Next (7:21)
🟦 Module 5 — Authorization with Roles (Admin vs Student)
📖 Role-Based Authorization — What Can Students and Admins Do? (13:02)
📖🛠️ Implementing Role-Based Authorization in the Student API (13:07)
🟦 Module 6 - Ownership Rules (Policies)
📖 🧭 Ownership-Based Authorization — Is This Your Data? (15:26)
📖 🛠️ Implementing Ownership Checks in the Student API (12:16)
❓ Quiz — Ownership-Based Authorization
Answering: What is middleware?
Answering : Can i save a lot of permissions in the token? is it Safe? (7:35)
📖 🛡️ Policy-Based Authorization & Advanced Rules (26:16)
📖 🧱 Applying Policies Across the Student API (Self Read)
❓ Quiz — Policy-Based Authorization & Advanced Rules
🟦🧱 Module 7 - Production Hardening
🧱 Production Hardening - Making the API Survive Reality (Self-Read)
🔹 7.1 - Token Expiration & Refresh Tokens
📖 Token Expiration & Refresh Tokens (42:47)
❓ Quiz — Token Expiration & Refresh Tokens
📖 Implementing Refresh Tokens (25:52)
📖 Implement Refresh Tokens in Client Side (10:38)
🔹7.2 - Brute-Force & Abuse
📖 What Brute-Force Attacks Look Like? (10:45)
📖 How Attackers Abuse Login Endpoints? (8:30)
📖 Why Authentication Without Limits Is Dangerous? (11:18)
❓ Quiz — Preventing Brute-Force & Abuse
🔹7.3 - Abuse Protection (Rate Limiting)
📖 Rate Limiting — Protecting Login & Refresh Endpoints from Abuse (18:12)
❓ Quiz — Rate Limiting: Protecting Login & Refresh Endpoints from Abuse
📖 Implement Rate Limiting in Student API (10:54)
📖 Testing Rate Limiting in Student API (Fixed Window + Per IP + 429) (8:38)
🧪 C# Console Rate Limit Tester (Self Read)
📖 Advanced Rate Limiting Strategies (Self Read)
🔹 7.4 - Logging & Auditing (Security Visibility)
📖 Logging, Auditing & Monitoring (Making Your API See, Trace, and Defend Itself) (32:14)
❓ Quiz — Logging, Auditing & Monitoring
📖 Logging & Auditing — Seeing and Tracing Security Events
📖 Logs as a Security Feature
📖 Logging Failed Logins
📖 Auditing Admin Actions
📖 Avoiding Sensitive Data Leaks in Logs
📖 Security Alerts & Monitoring
📖 Implementing Secure Logging & Auditing in the Student API (27:11)
🔐🗄️ 7.5 - Secret Protection - Storing the Security Key (Secrets Management)
📖 Why the JWT Security Key Must Never Leave the Server?
📖 What If the Server Gets Hacked?
📖 Storing the Security Key — Where Is the Safest Place?
📖 Storing the JWT Security Key Using Environment Variables
📖 Storing the JWT Security Key Using Azure Key Vault
📖 Using Azure Key Vault to Store the JWT Security Key (Step-by-Step)
🔹 7.6 — Thinking Like an Attacker (Reality Check)
Thinking Like an Attacker (Reality Check)
Why frameworks don’t save you from logic flaws
Real-world authorization mistakes
Why “works as designed” can still be insecure
🟦 Module 8 — Final Review (Production-Ready API)
📖 Final Review — From Open API to Production-Ready Security
📖 What Comes Next (Advanced Security Courses)
📖 Security Audit — Attacking the Existing Student API
Lesson content locked
If you're already enrolled,
you'll need to login
.
Enroll in Course to Unlock