Using JSON Web Tokens (JWT) with Azure Functions (WITHOUT using Active Directory) : <p>I am sure someone out there has already done this, but I have yet to find any documentation with regard to the Microsoft implementation of JWT.  The official documentation from Microsoft for their JWT library is basically an empty page, see:</p>

<p><a href="https://docs.microsoft.com/en-us/dotnet/framework/security/json-web-token-handler-api-reference" rel="noreferrer">https://docs.microsoft.com/en-us/dotnet/framework/security/json-web-token-handler-api-reference</a></p>

<p>So, here is what I (and I am sure many others) would like to accomplish:</p>

<p><strong>Definition:</strong> User ID = The username or email address used to log into a system.</p>

<p><strong>AUTHENTICATION:</strong></p>

<ol>
<li><p>A user logs in.  The user fills in web form and the system sends (via HTTPS POST) the users ID and password (hashed) to the server in order to authenticate / validate the user.</p></li>
<li><p>Server Authenticates user.  The users ID and password are checked against the values saved in the database and if NOT valid, an invalid login response is returned to the caller.</p></li>
<li><p>Create a JWT Token - ???? No documentation available!</p></li>
<li><p>Return the JWT token to the caller - ???? - I assume in a header? via JSON, not sure -- again - no documentation.</p></li>
</ol>

<p>Given the code below, can anyone provide a code example for steps 3 and 4?</p>

<pre><code>  [FunctionName( "authenticate" )]
  public static async Task&lt;HttpResponseMessage&gt; Run( [HttpTrigger( AuthorizationLevel.Anonymous, "get", "post", Route = null )]HttpRequestMessage req, TraceWriter log )
  {

   // Step 1 - Get user ID and password from POST data

   /*
   * Step 2 - Verify user ID and password (compare against DB values)
   * If user ID or password is not valid, return Invalid User response
   */

   // Step 3 - Create JWT token - ????

   // Step 4 - Return JWT token - ????

  }
</code></pre>

<p><strong>AUTHORIZATION</strong>:</p>

<p>Assuming the user was authenticated and now has a JWT token (I am assuming the JWT token is saved in the users session; if someone wants to provide more info, please do):</p>

<ol>
<li><p>A POST request is made to an Azure Function to do something (like get a users birth date).  The JWT token obtained above is loaded (from the POST data or a header - does it matter?) along with any other data required by the function.</p></li>
<li><p>The JWT token is validated - ???? No documentation available!</p></li>
<li><p>If the JWT token is NOT valid, a BadRequest response is returned by the function.</p></li>
<li><p>If the JWT token is valid, the function uses the data passed to it to process and issue a response.</p></li>
</ol>

<p>Given the code below, can anyone provide a code example for steps 1 and 2?</p>

<pre><code>  [FunctionName( "do_something" )]
  public static async Task&lt;HttpResponseMessage&gt; Run( [HttpTrigger( AuthorizationLevel.Anonymous, "get", "post", Route = null )]HttpRequestMessage req, TraceWriter log )
  {

   // Step 1 - Get JWT token (from POST data or headers?)

   // Step 2 - Validate the JWT token - ???

   // Step 3 - If JWT token is not valid, return BadRequest response

   // Step 4 - Process the request and return data as JSON

  }
</code></pre>

<p>Any and all information would really help those of us (me) understand how to use JWT with Azure (anonymous) functions in order to build a "secure" REST API.</p>

<p>Thanks in advance.</p>
