title: Using JWT to implement Authentication on Asp.net web API
body: <p>I have been reading about JWT.</p>
  
  <p>But from what I read it is not an authentication mechanism but more like a crucial component in a Authentication mechanism.</p>
  
  <p>I have currently implemented a solution which works,  but it was just to try out JWT and see how it works. But what I am after now is how one should make use of it. From my experience of it its basically just an encryption mechanism that gives you a unique encrypted key. You are also able to put information inside of this token.</p>
  
  <p>I am wanting to implement it in terms on a ASP.NET web api 2 to be consumed by a mobile application.</p>
  
  <p>So step 1:</p>
  
  <ol>
  <li>app => Server : Login (user, pasword)</li>
  <li>Server => app : Login OK, heres your JWT</li>
  <li>app => server : Get my profile (sends JWT with request)
   Server then decrypts JWT and determines the requests Identity.</li>
  </ol>
  
  <p>Now this is just my understanding of it, Look I could be on the totally wrong path.</p>
  
  <p>Is the Ideal of JWT so that you dont have to authenticate on every request? I just authenticate the users credentials once (on the initial login) and there on after the server can simply use JWT and no have to lookup the users pw and user in the DB?</p>
  
  <p>I just want to use the JWT to Identity who the user is. I will then authorize then after i have authenticated them. As I know there is a big confused with the new MVC and Authentication and Authorization.</p>
  
  <p>So what my question comes down to.</p>
  
  <p>How can I safely and effectively Implement a Authentication Mechanism Using JWT?
  I don't want to just cough something up that seems to work and not have any Idea of the security implications. I am sure that there exists a source some where that has possibly designed a secure mechanism that would suit my requirements.</p>
  
  <p>My requirements are:</p>
  
  <ul>
  <li>Must only have to check db for users credentials once off per session? Due to the use of bcrypt using a lot of resources to compare passwords.</li>
  <li>Must be able to identify the user from their request. (I.e who they are, userId will be sufficient) and preferably without accessing the DB as well</li>
  <li>Should be as low overhead as possible, with regards to resources on the server side processing the request. </li>
  <li>If an intruder had to copy a devices previous request, then he should not be able to access the real users data. (obviously)</li>
  </ul>
  
  <p>Thanks</p>