Designing Secure REST APIs with C# and JSON Web Tokens

Abstract

The security of contemporary distributed systems relies heavily on effective authentication practices, particularly as organizations expand their use of cloud-native and service-oriented architectures. JSON Web Tokens (JWT) have become a widely adopted solution for stateless authentication due to their portability, scalability, and cross-platform flexibility. However, empirical studies and industry reports consistently reveal that JWT implementations remain vulnerable when misconfigured, exposed to weak cryptographic practices, or integrated without adequate lifecycle controls. This study examines the secure design of REST APIs implemented in C# using ASP.NET Core, focusing on the correct application of JWT for authentication and authorization. Through a structured review of peer-reviewed literature and established security standards, the research identifies prevailing challenges in token signing, storage, revocation, and mitigation of token-based attacks. A prototype REST API is developed to evaluate the performance and security behaviour of alternative cryptographic algorithms and revocation methods within the .NET environment. The findings indicate that secure JWT usage requires not only the selection of robust algorithms but also the consistent enforcement of token governance policies and defensive implementation techniques. The study contributes a practical and evidence-based design framework for developers seeking to implement secure authentication in C# environments. The research concludes by outlining emerging gaps and recommending future directions, including improved revocation mechanisms and exploration of alternative token formats.