JWT, authentication vs authorization, CORS, dan error handling

1. Peta alurnya

Semua bagian lesson ini adalah satu langkah dari peta berikut. Hafalkan petanya dulu, detailnya menyusul.

2. Authentication vs authorization (401 vs 403)

"Authentication is the process of determining a user's identity. Authorization is the process of determining whether a user has access to a resource." ^[1] Keduanya terpisah, "However, authorization relies on an authentication mechanism" ^[2]. Itulah alasan urutan UseAuthentication → UseAuthorization di lesson 0005.

Saat gagal, handler JWT bearer menjawab dengan dua kode yang berbeda:

• Challenge → 401. User belum terautentikasi (token tidak ada, signature salah, kedaluwarsa): "A JWT bearer scheme returning a 401 result with a www-authenticate: bearer header." ^[1]
• Forbid → 403. User sudah dikenal tapi tidak berhak: "A JWT bearer scheme returning a 403 result." ^[1]

[ApiController, Route("api/products")]
public class ProductsController : ControllerBase
{
    [HttpGet]                                   // publik
    public Task<IActionResult> GetAll() => ...

    [HttpPost, Authorize]                       // harus login (selain itu 401)
    public Task<IActionResult> Create(CreateProductDto dto) => ...

    [HttpDelete("{id}"), Authorize(Roles = "Admin")]   // login + role Admin (selain itu 403)
    public Task<IActionResult> Delete(int id) => ...
}

Role adalah bentuk sederhana; aturan yang sama bisa ditulis sebagai policy: AddPolicy("RequireAdminRole", policy => policy.RequireRole("Admin")), lalu [Authorize(Policy = "RequireAdminRole")] ^[3]. Ingat juga: "Configuring authentication doesn't automatically restrict access to endpoints." Tanpa [Authorize] (atau fallback policy), endpoint tetap terbuka ^[1].

3. JWT: apa isinya dan apa yang divalidasi

"JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties." Bentuknya "a sequence of URL-safe parts separated by period ('.') characters. Each part contains a base64url-encoded value" ^[4], yaitu header.payload.signature. Base64url bukan enkripsi: "The payload is only base64url encoded, not encrypted, so anyone who obtains the token can read every claim" ^[5]. Signature hanya menjamin token tidak diubah.

Di API, "The JwtBearerHandler validates the token and extracts the user's identity from its claims." Yang harus divalidasi: "Signature, for trust and integrity", "Issuer claim", "Audience claim", dan "Token expiration"; kalau ada yang salah, "the API should return a 401 response" ^[6].

// Program.cs — JwtSettings dibaca lewat Options Pattern (lesson 0005), Key dari User Secrets
var jwt = builder.Configuration.GetSection("JwtSettings").Get<JwtSettings>()!;

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(o => o.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,           ValidIssuer   = jwt.Issuer,
        ValidateAudience = true,         ValidAudience = jwt.Audience,
        ValidateIssuerSigningKey = true, IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwt.Key)),
        ValidateLifetime = true,         // exp
    });
builder.Services.AddAuthorization();

Jujur saat interview: endpoint login sederhana yang menerbitkan JWT sendiri cukup untuk mini project, tapi Microsoft menulis "Don't generate your own access tokens or ID tokens, except for testing purposes" dan menyarankan OpenID Connect / OAuth untuk production ^[6]. Menyebut ini menunjukkan Anda tahu batasnya.

4. CORS: kenapa Angular di port 4200 "diblokir"

"Browser security prevents a web page from making requests to a different domain than the one that served the web page. This restriction is called the same-origin policy." CORS adalah cara server melonggarkannya, dan CORS "is not a security feature, CORS relaxes security" ^[7]. Beda port saja sudah beda origin. Yang memblokir adalah browser, jadi Postman dan curl tidak pernah terkena CORS.

Preflight. "For some CORS requests, the browser sends an additional OPTIONS request before making the actual request." Browser hanya boleh melewatinya kalau header yang di-set terbatas pada Accept, Accept-Language, Content-Language, Content-Type, atau Last-Event-ID, dan Content-Type hanya form/text ^[7]. Request Angular dengan Authorization: Bearer dan body JSON tidak memenuhi syarat itu, jadi selalu ada preflight.

builder.Services.AddCors(o => o.AddPolicy("angular", p => p
    .WithOrigins("http://localhost:4200")     // tanpa "/" di akhir
    .AllowAnyHeader()                          // termasuk Authorization
    .AllowAnyMethod()));

app.UseExceptionHandler();
app.UseHttpsRedirection();
app.UseRouting();
app.UseCors("angular");          // sesudah routing, sebelum auth (lesson 0005)
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();

Dua jebakan dari dokumentasi: URL origin "must not contain a trailing slash", dan "Specifying AllowAnyOrigin and AllowCredentials is an insecure configuration and can result in cross-site request forgery" ^[7]. Padanan Express: app.use(cors({ origin: 'http://localhost:4200' })), middleware yang "sets CORS response headers" ^[8].

5. Global error handling: exception → ProblemDetails

IExceptionHandler "gives the developer a callback for handling known exceptions in a central location". Implementasinya didaftarkan dengan AddExceptionHandler<T>, lifetime-nya Singleton, dan return true dari TryHandleAsync berarti exception sudah ditangani ^[9]. Format response-nya ProblemDetails, standar untuk membawa "machine-readable details of errors in HTTP response content" ^[10] (RFC 9457, pengganti RFC 7807). Dengan AddProblemDetails(), UseExceptionHandler juga menghasilkan ProblemDetails untuk exception yang tidak ditangani handler Anda ^[11].

public class GlobalExceptionHandler(ILogger<GlobalExceptionHandler> logger) : IExceptionHandler
{
    public async ValueTask<bool> TryHandleAsync(HttpContext ctx, Exception ex, CancellationToken ct)
    {
        var (status, title) = ex switch
        {
            ValidationException => (400, "Validation failed"),
            NotFoundException   => (404, "Not found"),
            _                   => (500, "Server error"),
        };
        if (status == 500) logger.LogError(ex, "Unhandled exception");
        ctx.Response.StatusCode = status;
        await ctx.Response.WriteAsJsonAsync(new ProblemDetails
            { Status = status, Title = title, Detail = status == 500 ? null : ex.Message }, ct);
        return true;
    }
}
// Program.cs
builder.Services.AddExceptionHandler<GlobalExceptionHandler>();
builder.Services.AddProblemDetails();
app.UseExceptionHandler();      // paling awal di pipeline

// Response yang diterima Angular (contoh)
{ "status": 400, "title": "Validation failed", "detail": "Price must be greater than 0." }

Di Angular, body ProblemDetails ada di HttpErrorResponse.error, jadi interceptor dari lesson 0016 bisa mengarahkan 401 ke /login dan menampilkan error.title untuk status lain. Jangan kirim stack trace ke client di production: "Don't share detailed exception information publicly when the app runs in production" ^[11]. Padanan Express: error middleware empat argumen (err, req, res, next) yang dipasang paling akhir ^[12]; di .NET justru paling awal, karena membungkus pipeline.

6. Menyimpan JWT: localStorage vs httpOnly cookie

Tidak ada pilihan yang bebas risiko; "Cross-Site Scripting (XSS) can defeat all CSRF mitigation techniques!" ^[14]. Microsoft cenderung ke cookie: "storing access tokens directly in the browser by using local storage, session storage, or web workers" adalah contoh penyimpanan yang rentan, dan untuk web app yang aman "Only a secure HTTP only cookie is shared on the client browser" (pola backend-for-frontend) ^[6]. Jawaban interview yang baik: sebut trade-off keduanya, lalu sebut pilihan Anda beserta alasannya.

Ringkasan untuk dicetak: Reference: JWT, authn/authz, CORS, dan error handling · Pipeline: Reference: Middleware dan Options · Istilah: GLOSSARY.md

Ada yang belum jelas? Tanyakan ke saya (agent) di terminal, misalnya: "bagaimana refresh token bekerja bersama access token yang berumur pendek?" atau "bagaimana menulis integration test untuk endpoint [Authorize] dengan WebApplicationFactory?"

Sumber: [1] Overview of ASP.NET Core Authentication · [2] Introduction to authorization · [3] Role-based authorization · [4] RFC 7519 JWT · [5] OWASP JWT Cheat Sheet · [6] Configure JWT bearer authentication · [7] Enable CORS in ASP.NET Core · [8] Express cors middleware · [9] Handle errors in ASP.NET Core · [10] RFC 9457 Problem Details · [11] Handle errors in ASP.NET Core APIs · [12] Express error handling · [13] OWASP HTML5 Security Cheat Sheet · [14] OWASP CSRF Prevention Cheat Sheet · [15] Angular v16: XSRF protection