title: Implementing authentication and authorization with React hooks, .NET Core Web API, and SQL Server
body: <p>I have an application that I have built using React hooks, a SQL Server database, and a .NET Core 3.1 Web API.  I'm really struggling to understand the relationships of the all the moving parts.  I want to avoid reinventing the wheel and leverage existing libraries and frameworks.  JWT seems like the way to go here from what I've learned and it just gets a bit confusing.  Here are my requirements:</p>
  <ol>
  <li>Create account and log in/out with a custom site account OR use Google/Facebook/Microsoft/etc. (I can start with one or the other but don't want to box myself in and rewrite a ton of stuff to add the other)</li>
  <li>Leverage .NET Core Identity in the existing project to handle users, roles, etc. in the SQL Server database.</li>
  <li>Use React hooks pattern (I can limp my way through translating class components if I must)</li>
  </ol>
  <p>I think I'm getting lost in all of the decoupling (which normally is a good thing!)  I see articles about React with dummy back ends and I get lost.  I see posts about .NET Core and can't figure out how to use it with React.  Conceptually most of it makes sense, but I haven't found a place that helps me understand what the code should look like start to finish.</p>
  <p>SO HERE ARE MY QUESTIONS!</p>
  <ol>
  <li>Are the React front end application and the React auth service the same thing?  Can they be?  Must they be?</li>
  <li>Is the JWT string generated on the React side or the .NET side?  Best library for that?</li>
  <li>How (or does?) MS Identity Server fit into this equation?</li>
  <li>I don't full understand the concept of the refresh token despite looking at about 100 articles.  Is a refresh token 100% necessary?  Benefits/drawbacks to using/not using them?</li>
  </ol>
  <p>It's a lot to sort through and I'm just hoping someone can help me simplify.</p>