...
- API receives request with token
- Authentication middleware examines the token
- Checks who issued the token (Azure ADEntra ID)
- Validates token is authentic:
- Signature is valid (proves token came from Azure AD)
- Issuer matches (correct Azure AD tenant)
- Audience matches (token is for this specific API)
- Not expired (within 1-hour lifetime)
- If all checks pass → Request continues to controller
- If any check fails → Return 401 Unauthorized
...
- Token signature: Proves it's authentic and not forged
- Issuer: Confirms it came from Azure ADEntra ID
- Audience: Ensures it's for the correct API
- Expiration: Checks it hasn't expired
...
- After 1 hour, developer must click "Authorize" again
- No automatic refresh (unlike the Web app)
- Lock icons change back to open (grayed out)
...
Security Mechanisms
PKCE (Proof Key for Code Exchange)
What it does: Protects the authorization code during the OAuth2 flow Why it matters: Prevents attackers from stealing and using authorization codes How it works: Swagger UI automatically generates a secret code that only it knows, making stolen authorization codes useless
...
Token Signature Validation
What it does: Verifies each token was actually issued by Microsoft Why it matters: Prevents forged or tampered tokens How it works: Azure AD signs tokens with a private key, and the API verifies the signature using Azure AD's public key
...
Token Expiration
What it does: Tokens automatically expire after 1 hour Why it matters: Limits damage if a token is stolen What happens: Developer must re-authorize in Swagger to get a new token
...
Audience Validation
What it does: Ensures tokens are used for the intended API only Why it matters: Prevents using an ApiService token for IntegrationServiceAPI (and vice versa) How it works: Each API only accepts tokens specifically issued for it
...
Issuer Validation
What it does: Verifies tokens come from the correct Azure AD tenant Why it matters: Prevents tokens from other organizations' Azure AD How it works: API only accepts tokens from the configured tenant ID
...
Quick Reference
ApiService
| Property | Value |
|---|---|
| Swagger URL (Local) | http://localhost:7532/swagger |
| API Client ID | 4dad5d62-dc8c-4378-8bd0-ae736a4d73fe |
| Swagger Client ID | 84c38b43-12e4-4c26-8292-8910d79aa532 |
...
IntegrationServiceAPI
| Property | Value |
|---|---|
| Swagger URL (Local) | http://localhost:7098/swagger |
| API Client ID | bd5100ee-af63-4880-8c60-47d4207d60c1 |
| Swagger Client ID | 84c38b43-12e4-4c26-8292-8910d79aa532 |
...
Common Values
| Property | Value |
|---|---|
| Tenant ID | 6073ce8b-73f3-4df4-9b80-5e40cdc6965f |
| Token Lifetime | 1 hour |
| MFA Required | Yes |
...