Session, cookie, JWT, token, SSO, and OAuth 2.0 – what are they?

These terms are all related to user identity management. When you log into a website, you declare who you are (identification). Your identity is verified (authentication), and you are granted the necessary permissions (authorization).

Here is my understanding of user identity management.

• Session: A session is a mechanism used to maintain stateful information about a user across multiple requests. In web development, a session is typically created when a user logs in and is assigned a unique session ID. This session ID is then used to associate subsequent requests from the same user with their session data stored on the server.

// Storing value in session
HttpContext.Current.Session["Key"] = "Value";

// Retrieving value from session
string value = HttpContext.Current.Session["Key"] as string;

// Checking if session value exists
if (HttpContext.Current.Session["Key"] != null)
{
    // Session value exists, do something
}

// Removing value from session
HttpContext.Current.Session.Remove("Key");

// Clearing all session values
HttpContext.Current.Session.Clear();

• Cookie: A cookie is a small piece of data that is stored on the client-side (typically in the user’s browser) and is sent to the server with each request. Cookies are commonly used to store user preferences, session identifiers, and other information related to the user’s browsing experience.

// Setting a cookie
var cookie = new HttpCookie("CookieName");
cookie.Value = "CookieValue";
cookie.Expires = DateTime.Now.AddDays(1); // Set cookie expiration
cookie.Path = "/"; // Set cookie path
HttpContext.Current.Response.Cookies.Add(cookie);

// Retrieving a cookie
var cookieValue = HttpContext.Current.Request.Cookies["CookieName"]?.Value;

// Checking if a cookie exists
if (HttpContext.Current.Request.Cookies["CookieName"] != null)
{
    // Cookie exists, do something
}

// Removing a cookie
var existingCookie = HttpContext.Current.Request.Cookies["CookieName"];
if (existingCookie != null)
{
    existingCookie.Expires = DateTime.Now.AddDays(-1); // Set expiration date in the past to remove the cookie
    HttpContext.Current.Response.Cookies.Add(existingCookie);
}

• JWT (JSON Web Token): JWT is a compact, URL-safe means of representing claims securely between two parties. It is typically used for authentication and authorization purposes. A JWT consists of three parts: a header, a payload, and a signature. The payload contains the claims or information about the user, and the signature is used to verify the integrity of the token.

using System;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Microsoft.IdentityModel.Tokens;

// Generate JWT token
public string GenerateJwtToken(string secretKey, string issuer, string audience, int expirationMinutes)
{
    var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey));
    var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);

    var claims = new[]
    {
        new Claim(ClaimTypes.Name, "Rakesh"),
        new Claim(ClaimTypes.Email, "xyz@example.com"),
        // Add additional claims as needed
    };

    var token = new JwtSecurityToken(
        issuer: issuer,
        audience: audience,
        claims: claims,
        expires: DateTime.Now.AddMinutes(expirationMinutes),
        signingCredentials: credentials
    );

    return new JwtSecurityTokenHandler().WriteToken(token);
}

// Validate JWT token
public bool ValidateJwtToken(string token, string secretKey, string issuer, string audience)
{
    var tokenHandler = new JwtSecurityTokenHandler();
    var validationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateIssuerSigningKey = true,
        ValidIssuer = issuer,
        ValidAudience = audience,
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey))
    };

    try
    {
        SecurityToken validatedToken;
        tokenHandler.ValidateToken(token, validationParameters, out validatedToken);
        return true;
    }
    catch (Exception)
    {
        return false;
    }
}

• SSO (Single Sign-On): SSO is an authentication mechanism that allows users to log in once and access multiple applications or services without needing to authenticate again for each application. With SSO, a user’s authentication credentials are verified by a central identity provider, and then a token or session is issued, which can be used to access multiple resources without re-entering credentials.
• OAuth 2.0: OAuth 2.0 is an authorization framework that enables secure third-party access to protected resources on behalf of a resource owner (typically a user). It allows users to grant limited access to their resources (such as social media accounts or online services) to other applications without sharing their credentials. OAuth 2.0 defines different roles, such as the resource owner, client, authorization server, and resource server, and utilizes tokens for authorization.

using System;
using System.Net.Http;
using System.Threading.Tasks;

public class OAuth2Client
{
    private readonly HttpClient httpClient;
    private readonly string tokenEndpoint;
    private readonly string clientId;
    private readonly string clientSecret;

    public OAuth2Client(string tokenEndpoint, string clientId, string clientSecret)
    {
        this.tokenEndpoint = tokenEndpoint;
        this.clientId = clientId;
        this.clientSecret = clientSecret;
        this.httpClient = new HttpClient();
    }

    public async Task<string> GetAccessTokenAsync(string username, string password, string scope)
    {
        var requestBody = new FormUrlEncodedContent(new[]
        {
            new KeyValuePair<string, string>("grant_type", "password"),
            new KeyValuePair<string, string>("username", username),
            new KeyValuePair<string, string>("password", password),
            new KeyValuePair<string, string>("client_id", clientId),
            new KeyValuePair<string, string>("client_secret", clientSecret),
            new KeyValuePair<string, string>("scope", scope)
        });

        var response = await httpClient.PostAsync(tokenEndpoint, requestBody);

        if (response.IsSuccessStatusCode)
        {
            var responseBody = await response.Content.ReadAsStringAsync();
            var accessToken = JObject.Parse(responseBody)["access_token"].ToString();
            return accessToken;
        }
        else
        {
            throw new Exception("Failed to obtain access token: " + response.ReasonPhrase);
        }
    }
}

• These concepts are commonly used in web development for authentication, authorization, and maintaining user state. Each has its own purpose and use cases, and understanding them is important when implementing secure and user-friendly applications.