JwtAuth

A JWT authentication demo app available in three fully supported implementations:

Implementation	Backend	Frontend	Database	Folder
.NET + Angular	ASP.NET Core 8 Web API	Angular (standalone + signals)	SQL Server	JwtAuth/ + Front-end/
Node.js	Express.js	Next.js	MongoDB	Node/
Python	FastAPI	Next.js	PostgreSQL	Python/

Historical live demos from the original project docs:

• http://jwtauth.codecraftbox.com
• https://auth-demo.niludigital.com/

Features

• Account registration, sign-in, refresh-token based auth, and sign-out
• Profile update including avatar upload
• Password change and admin password reset
• Claim/role based admin actions (manage users)
• Session lock after inactivity and unlock with password

---

Node.js Stack

Tech

• Node.js (LTS recommended), Express.js, Next.js, MongoDB + Mongoose
• JWT access tokens + HTTP-only refresh-token cookies

Project structure

Node/
  backend/   # Express API
  frontend/  # Next.js app

Setup

Backend (Express + MongoDB)

cd Node/backend
cp .env.example .env     # fill in MONGODB_URI, JWT_SECRET, etc.
npm install
npm run dev

API runs at http://localhost:4000 by default.

Key env vars in Node/backend/.env:

Variable	Description
MONGODB_URI	MongoDB connection string
JWT_SECRET	Signing secret for JWTs
JWT_ISSUER	JWT issuer claim
JWT_AUDIENCE	JWT audience claim
FRONTEND_ORIGIN	CORS allowed origin
ADMIN_EMAIL	Seeded admin email
ADMIN_PASSWORD	Seeded admin password

Frontend (Next.js)

cd Node/frontend
cp .env.local.example .env.local    # set NEXT_PUBLIC_API_ROOT
npm install
npm run dev

App runs at http://localhost:3000 by default.

Build for production

# Backend
cd Node/backend && npm start

# Frontend
cd Node/frontend && npm run build && npm start

---

Python Stack

Tech

• Python 3.11+, FastAPI, SQLAlchemy, PostgreSQL
• Next.js 14 frontend
• JWT access tokens + HTTP-only refresh-token cookies

Project structure

Python/
  backend/   # FastAPI API
  frontend/  # Next.js app

Setup

Backend (FastAPI + PostgreSQL)

cd Python/backend
python -m venv .venv
.venv\Scripts\activate
pip install -r requirements.txt
copy .env.example .env
uvicorn app.main:app --reload --port 8000

API runs at http://localhost:8000 by default.

Key env vars in Python/backend/.env:

Variable	Description
DATABASE_URL	PostgreSQL connection string
JWT_SECRET	Signing secret for JWTs
JWT_ISSUER	JWT issuer claim
JWT_AUDIENCE	JWT audience claim
FRONTEND_ORIGIN	CORS allowed origin
ADMIN_EMAIL	Seeded admin email
ADMIN_PASSWORD	Seeded admin password

Frontend (Next.js)

cd Python/frontend
copy .env.local.example .env.local    # set NEXT_PUBLIC_API_ROOT
npm install
npm run dev

App runs at http://localhost:3000 by default.

Build for production

# Backend
cd Python/backend && uvicorn app.main:app --host 0.0.0.0 --port 8000

# Frontend
cd Python/frontend && npm run build && npm start

---

.NET + Angular Stack

Tech

• C#, ASP.NET Core 8 Web API, Entity Framework Core, SQL Server
• Angular 18+, standalone components, signal queries, Angular Material, Bootstrap 5

Project structure

JwtAuth/      # ASP.NET Web API backend
Front-end/    # Angular frontend

Setup

Backend

• Copy JwtAuth/appsettings.Demo.json to JwtAuth/appsettings.json and fill in the database connection string, JWT secret, admin seed data, and CORS origins.
• Run EF Core migrations from the Package Manager Console:

  Add-Migration initial
  Update-Database
  

• Build and run via Visual Studio or the .NET CLI.

Frontend

cd Front-end
npm install

Set API_ROOT in src/environments/environment.ts (and environment.prod.ts) to your backend URL, then run:

ng serve

For HTTPS with a self-signed certificate:

ng serve --ssl true --ssl-key path/to/privateKey.key --ssl-cert path/to/certificate.crt

OpenSSL example from the original setup notes:

req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.key -out certificate.crt

If API and frontend are hosted on different domains during testing, enable withCredentials in Angular HTTP interceptors so refresh-token cookies are sent cross-site.

Deploy in IIS

1. Publish the Web API project (Folder publish) and copy the output to your site root.
2. Build the Angular app:

   ng build -c production --output-path dist/wwwroot --base-href /

   For Node.js v17+ environments that require legacy OpenSSL provider:

   set NODE_OPTIONS=--openssl-legacy-provider
   ng build -c production --output-path dist/wwwroot --base-href /

3. Copy dist/wwwroot to your site root alongside the API.
4. Add URL rewrite rules to web.config so Angular routes fall through to index.html while /api/* and static files are served directly. See JwtAuth/example_for_shared_iis_hosting_web.config for a full example.
5. If HTTP DELETE calls fail on IIS, remove WebDAV module/handler entries in web.config as in the original deployment notes.

---

Notes

• The Node.js, Python, and .NET stacks are independent — you can run any one without the others.
• For Node.js, if the backend exits with a MongoDB connection error, ensure MongoDB is running locally or update MONGODB_URI to a remote instance.
• For Python, if startup fails, verify PostgreSQL is reachable from DATABASE_URL.