integration with Frontend-React, Kinde and .Net
As far as I know, in integration with Frontend-React, Kinde manages user sessions, generates and verifies JWT. Frontend application receives this JWT and sends it to the backend with every request. The backend checks the JWT validity of incoming requests and authenticates the user. Okay, but my backend application does not communicate directly with Kinde. This communication is established with Kinde independently of the Frontend and Backend. So, in this case, how will backend enpoints be protected with jwt tokens produced in Kinde? I request you to inform me about this.
1 Reply
@Khanim , @quacksire is correct if you want to have your app to have everything in one place, using a full stack framework solve this for you.
Otherwise if you using two different frameworks, you can follow these steps:
Frontend Application Receives JWT: When a user logs in or registers through your frontend application using Kinde's React SDK, Kinde handles the user session and authentication, generating a JWT. This JWT is then available in your frontend application through the getToken method provided by the React SDK.
Send JWT to Backend with Requests: Your frontend application should send this JWT to your backend with every request that requires authentication. This is typically done by including the JWT in the Authorization header of the request as a Bearer token.
Backend Verifies JWT: On the backend, you will need to verify the JWT with each incoming request to authenticate the user. Even though your backend does not communicate directly with Kinde, you can still verify the JWT using a library that supports JWT verification.
Use a Library for JWT Verification: For Node.js/Express applications, you can use Kinde's Express SDK to easily verify the JWT and protect your routes. If you are using a different backend technology, or if you prefer not to use the Express SDK, you can use any JWT verification library compatible with your backend's language and framework. The JWT verification process typically involves checking the token's signature against the public key provided by Kinde, ensuring the token has not expired, and validating other claims as necessary.
Configure Your Backend with Kinde's Public Key: To verify the JWTs, your backend will need Kinde's public key. This can be obtained from your Kinde domain's JSON Web Key Set (JWKS) endpoint, which is located at https://<your_subdomain>.kinde.com/.well-known/jwks. The library you use for JWT verification will likely have a way to configure it with this JWKS endpoint.
Protect Backend Endpoints: After setting up JWT verification, you can protect your backend endpoints by verifying the JWT on each request. Only requests with a valid JWT should be allowed to access protected resources.
By following these steps, your backend application can securely authenticate requests using JWT tokens generated by Kinde, even without direct communication between your backend and Kinde.