Apache Kafka Implementation in .NET – A Practical Microservices Guide

Modern enterprise applications demand high throughput, fault tolerance, and real-time data processing . Traditional synchronous APIs struggle at scale. This is where Apache Kafka becomes a backbone for event-driven microservices. In this article, we will explore Kafka implementation using .NET with real-world architecture, producer & consumer examples, and best practices. Why Kafka for Microservices? High-throughput event streaming Loose coupling between services Fault tolerance and durability Replayable event history Horizontal scalability Kafka Architecture – Core Concepts Kafka Components Producer – Publishes events Topic – Logical event stream Partition – Parallelism unit Broker – Kafka server Consumer Group – Scalable consumers Offset – Message position Kafka Microservices Architecture +-------------------+ | Web / API Layer | +-------------------+ | v +-------------------+ | Kafka Produce...
Post a Comment

How I Learned to Secure My APIs with RS256 JWT Tokens in C#

A few weeks ago, I was working on a project where we needed secure API authentication. We were using JWT (JSON Web Tokens), and I realized that using RS256 for signing tokens was the best approach. Unlike HS256, which uses a shared secret, RS256 uses asymmetric keys — one private key for signing and a public key for verification. This was perfect for our microservices architecture.

Step 1: Generating an RSA Key Pair

First, we need an RSA key pair:


using var rsa = RSA.Create(2048);

var privateKey = rsa.ExportRSAPrivateKey(); // Keep secret
var publicKey = rsa.ExportRSAPublicKey();   // Can share

I learned that storing keys securely is critical. For production, I’d use something like Azure Key Vault or AWS KMS instead of local files.

Step 2: Generating the JWT Token

Next, I used the private key to sign my token:


var rsa = RSA.Create();
rsa.ImportRSAPrivateKey(Convert.FromBase64String("YOUR_PRIVATE_KEY_BASE64"), out _);

var signingCredentials = new SigningCredentials(
    new RsaSecurityKey(rsa),
    SecurityAlgorithms.RsaSha256
);

var claims = new[]
{
    new Claim(JwtRegisteredClaimNames.Sub, "user123"),
    new Claim(JwtRegisteredClaimNames.Email, "user@example.com"),
    new Claim("role", "admin")
};

var token = new JwtSecurityToken(
    issuer: "my-api",
    audience: "my-audience",
    claims: claims,
    expires: DateTime.UtcNow.AddHours(1),
    signingCredentials: signingCredentials
);

var tokenString = new JwtSecurityTokenHandler().WriteToken(token);
Console.WriteLine(tokenString);

The moment I ran this, I had a signed JWT token ready to use. The RS256 signature ensured that only someone with the private key could generate valid tokens.

Step 3: Validating the JWT Token

Validation is just as important as generation. I used the public key to verify incoming tokens:


var rsa = RSA.Create();
rsa.ImportRSAPublicKey(Convert.FromBase64String("YOUR_PUBLIC_KEY_BASE64"), out _);

var validationParameters = new TokenValidationParameters
{
    ValidateIssuer = true,
    ValidIssuer = "my-api",
    ValidateAudience = true,
    ValidAudience = "my-audience",
    ValidateLifetime = true,
    IssuerSigningKey = new RsaSecurityKey(rsa)
};

try
{
    var principal = new JwtSecurityTokenHandler().ValidateToken(tokenString, validationParameters, out _);
    Console.WriteLine("Token is valid!");
}
catch (Exception ex)
{
    Console.WriteLine("Token validation failed: " + ex.Message);
}

This gave me peace of mind that any token without a valid signature would be rejected.

Step 4: Extracting Claims

Once the token is validated, I could access claims like this:


var email = principal.FindFirst(JwtRegisteredClaimNames.Email)?.Value;
var role = principal.FindFirst("role")?.Value;

Console.WriteLine($"Email: {email}, Role: {role}");

It was neat to see how easy it was to get user information directly from the token. This makes authorization in APIs straightforward.

Key Lessons Learned

  • RS256 uses asymmetric encryption, which is safer for distributed systems.
  • Always keep your private key secret and share only the public key.
  • Always validate expiration (`exp`) claims.
  • Using JWT claims makes it easy to handle roles and permissions in APIs.
  • Libraries like Microsoft.AspNetCore.Authentication.JwtBearer make integrating JWT in ASP.NET Core a breeze.

RS256 JWT tokens gave me strong security and flexibility. After implementing this, I felt much more confident exposing my APIs to clients while keeping them secure.

Tip: For a complete working example, I also created a small ASP.NET Core Web API demo with JWT token generation, validation, and role-based claims. Stay tuned for my next post where I’ll walk you through the code end-to-end.

Comments

Post a Comment

Popular posts from this blog

How I Solved a Real Entity Framework Deadlock Caused by Different Table Order in High-Transaction Systems

The Day a Deadlock Brought Down My High-Transaction System: My Real Experience with Entity Framework Every developer has one story that sticks with them forever. For me, it was the night my high-transaction system started throwing Entity Framework deadlock errors faster than I could refresh my logs. Everything was running perfectly earlier that day. But by evening, users started reporting issues, transactions were halting, and logs began filling with the dreaded message: “Transaction (Process ID xx) was deadlocked on lock resources…” I knew this wasn’t going to be a normal night. 🔍 It All Started With a Simple Deadlock Error It was late when I saw the first error. In one part of the system, customers were generating PINs. The balance was deducted successfully — but the transaction report wasn’t updating. Instead, the application threw a deadlock exception. Minutes later, more deadlocks appeared. Something was wrong. 🧩 Debugging the Issue: The Unexpected Discovery I be...
Read more

How I Built a JWT Refresh Token Middleware in ASP.NET Core

A few months ago, I was working on a project where our APIs were protected using JWT tokens . Everything was running smoothly… until we realized that our tokens were expiring too quickly . Users were getting logged out, and every client request needed re-authentication. That’s when I decided to implement a refresh token mechanism directly in middleware, and it turned out to be a neat solution. Understanding the Problem JWT tokens are stateless and self-contained , which is great for scalability, but the downside is that once they expire, the user needs a new token. Traditionally, developers handle this on the client side with a separate refresh endpoint. But I wanted a more transparent approach : Whenever a valid token was nearing expiration, the server would automatically issue a new token. This would reduce friction for the user. The new token would be added to the response headers so clients could pick it up without changing the response payload. Step 1: Creating Midd...
Read more

Azure Service Bus vs Apache Kafka in .NET Microservices

A Practical Comparison Guide

When I started building .NET microservices , everything looked clean on architecture diagrams. But as traffic increased, synchronous HTTP calls quickly became a bottleneck. That’s when asynchronous messaging in .NET microservices became unavoidable. The real question then was: Azure Service Bus vs Apache Kafka in .NET microservices , which messaging system is the right choice for scalability, performance, and real-world production workloads? Why Messaging Is Critical in Microservices Loose coupling between services Fault isolation Independent scalability Event-driven workflows Two technologies dominate in .NET microservices: Azure Service Bus and Apache Kafka . Azure Service Bus – Enterprise Messaging Azure Service Bus is ideal for business workflows where reliability, ordering, and security are non-negotiable. Azure Service Bus Architecture font-size="14" x="70" y="115">Order Service font-size="1...
Read more