Consume Refresh Token in C# Client

Back to: ASP.NET Web API Tutorials For Beginners and Professionals

Consume Refresh Token in C# Client

In this article, I will discuss how to Consume Refresh Token in C# Client application. Please read the following three articles, before proceeding to this article as we are going to consume the services that we created in our previous articles.

Token Based Authentication in Web API: In this article, we discussed how to implement and use the Token Based Authentication in Web API.

Client Validation in Token Based Authentication: In this article, we discussed how to validate the clients while generating the token in Web API.

Generating Refresh Token in Web API: In this article, we discussed how to Generate Refresh Token in Web API.

Let us discuss the step by step procedure to Consume Refresh Token in C#. But before that let’s modify the Test Controller of our Web API application that we created in our previous application as shown below.

Step1: Modifying the Test Controller

using System.Linq;
using System.Security.Claims;
using System.Web.Http;

namespace TokenAuthenticationInWebAPI.Controllers
{
    public class TestController : ApiController
    {
        //This resource is For all types of role

        [Authorize(Roles = "SuperAdmin, Admin, User")]
        [HttpGet]
        [Route("api/test/resource1")]
        public IHttpActionResult GetResource1()
        {
            var identity = (ClaimsIdentity)User.Identity;
            
            return Ok("Hello: " + identity.Name);
        }
        
        //This resource is only For Admin and SuperAdmin role
        [Authorize(Roles = "SuperAdmin, Admin")]
        [HttpGet]
        [Route("api/test/resource2")]
        public IHttpActionResult GetResource2()
        {
            var identity = (ClaimsIdentity)User.Identity;            
            var Email = identity.Claims
                      .FirstOrDefault(c => c.Type == "Email").Value;

            var UserName = identity.Name;
            
            return Ok("Hello " + UserName + ", Your Email ID is :" + Email);
        }

        //This resource is only For SuperAdmin role
        [Authorize(Roles = "SuperAdmin")]
        [HttpGet]
        [Route("api/test/resource3")]
        public IHttpActionResult GetResource3()
        {
            var identity = (ClaimsIdentity)User.Identity;
            var roles = identity.Claims
                        .Where(c => c.Type == ClaimTypes.Role)
                        .Select(c => c.Value);
            return Ok("Hello " + identity.Name + "Your Role(s) are: " + string.Join(",", roles.ToList()));
        }
    }
}

Step2: Creating the UserTokenMaster table

In the client side, we need to store the token in the UserTokenMaster table as shown below

Please use the below SQL Script to create the required database.

CREATE DATABASE Test_DB
GO

USE Test_DB

CREATE TABLE UserTokenMaster
(
  UserName VARCHAR(50) PRIMARY KEY,
  UserPassword VARCHAR(50),
  AccessToken VARCHAR(500),
  RefreshToken VARCHAR(100),
  TokenExpiredTime DATETIME
)
GO

Step3: Create a new console application with the name RefreshTokenClient1.

Step4: Add ADO.NET Entity Data Model

Here, we need to add ADO.NET Entity Data Model Database First approach against the Test_DB and add the UserTokenMaster to the EDMX that we created in Step2. So once you add the table, the EDMX File should be as shown below

Step5: Add Token class

Now we need to add a class file with the name Token to the project. And then copy and paste the following code.

using Newtonsoft.Json;
using System;
namespace RefreshTokenClient1
{
    // The body of the response from API is a JSON object that 
    // contains the following properties (and a couple of others
    // that we're not capturing).
    public class Token
    {
        [JsonProperty("access_token")]
        public string AccessToken { get; set; }

        [JsonProperty("token_type")]
        public string TokenType { get; set; }

        [JsonProperty("expires_in")]
        public int ExpiresIn { get; set; }

        [JsonProperty("refresh_token")]
        public string RefreshToken { get; set; }
        
        public string Error { get; set; }

        public DateTime ExpiredDateTime { get; set; }
    }
}

Step6: Adding UserTokenRepository

Now we need to add a class with the name UserTokenRepository and within that class we are going to perform the database operations. So once you add the class, copy and paste the following code.

using System;
using System.Linq;

namespace RefreshTokenClient1
{
    class UserTokenRepository : IDisposable
    {
        // Test_DBEntities it is your context class
        Test_DBEntities context = new Test_DBEntities();

        public Token GetTokenFromDB(string username, string password)
        {
            UserTokenMaster userMaster = context.UserTokenMasters.FirstOrDefault(user =>
            user.UserName.Equals(username, StringComparison.OrdinalIgnoreCase)
            && user.UserPassword == password);
            Token token = null;

            if (userMaster != null)
            {
                token = new Token()
                {
                    AccessToken = userMaster.AccessToken,
                    RefreshToken = userMaster.RefreshToken,
                    ExpiredDateTime = (DateTime)userMaster.TokenExpiredTime
                };
            }

            return token;
        }

        //Adding Token into the DB
        public bool AddUserTokenIntoDB(UserTokenMaster userTokenMaster)
        {
            //First Check the existance of the Token in the DB
            var tokenMaster = context.UserTokenMasters.FirstOrDefault(x => x.UserName == userTokenMaster.UserName
                            && x.UserPassword == userTokenMaster.UserPassword);
            if (tokenMaster != null)
            {
                context.UserTokenMasters.Remove(tokenMaster);
            }

            context.UserTokenMasters.Add(userTokenMaster);

            bool isAdded = context.SaveChanges() > 0;
            return isAdded;
        }
        
        public void Dispose()
        {
            context.Dispose();
        }
    }
}

Step7: Modify the Program class

Here, we need to implement the logic to get the access token, refresh it from the token API, and then store the Token in our database.

using System;
using System.Collections.Generic;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;
using Newtonsoft.Json;

namespace RefreshTokenClient1
{
    class Program
    {
        // When your application is registered you will get 
        // the client id and secret from the API
        private static string _clientId = "DOTNET";
        private static string _clientSecret = "EEF47D9A-DBA9-4D02-B7B0-04F4279A6D20";

        private static string Username = "";
        private static string Password = "";

        //Store the base address of the web api
        //You need to change the PORT number where your WEB API service is running
        private static string baseAddress = "http://localhost:65061/";

        static void Main(string[] args)
        {
            Token token = null;
            Username = "Anurag";
            Password = "123456";

            // First get the token from the persistent storage based
            // on the username and password
            token = (new UserTokenRepository()).GetTokenFromDB(Username, Password);

            //Then check the existing token and its expiration datetime
            if (token != null && DateTime.Now < token.ExpiredDateTime)
            {
                //use the existing token
            }
            else if (token != null && !string.IsNullOrEmpty(token.RefreshToken))
            {
                //Get a new access token based on the Refresh Token
                token = GetTokens(_clientId, _clientSecret, token.RefreshToken);
            }
            else
            {
                //Get a brand new access token
                token = GetTokens(_clientId, _clientSecret, null);
            }

            //If you get the access token, then call the authorized resource 
            if (!string.IsNullOrEmpty(token.AccessToken))
            {
                CallAPIResource1(token.AccessToken);
            }
            else
            {
                Console.WriteLine(token.Error);
            }

            Console.ReadLine();
        }

        //Here we implment the logic to call the authorized resource
        private static void CallAPIResource1(string AccessToken)
        {
            HttpClientHandler handler = new HttpClientHandler();
            HttpClient client = new HttpClient(handler);

            // Need to set the Access Token in the Authorization Header as shown below
            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", AccessToken);

            // Make a Get request for the authorized resource by invoking 
            // the PostAsync method on the client object as shown below
            var APIResponse = client.GetAsync(baseAddress + "api/test/resource1").Result;

            if (APIResponse.IsSuccessStatusCode)
            {
                var JsonContent = APIResponse.Content.ReadAsStringAsync().Result;
                string Message = JsonConvert.DeserializeObject<string>(JsonContent);
                Console.WriteLine("APIResponse : " + Message);
            }
            else
            {
                Console.WriteLine("APIResponse, Error : " + APIResponse.StatusCode);
            }
        }

        //In this method we need to implement the logic whether we need get a brand new access token
        // or we need the access token based on the Refresh Token
        private static Token GetTokens(string clientId, string clientSecret, string RefreshToken)
        {
            Token token = null;
            if (string.IsNullOrEmpty(RefreshToken))
            {
                token = GetAccessToken(clientId, clientSecret, Username, Password);
            }
            else
            {
                token = GetAccessTokenByRefreshToken(clientId, clientSecret, RefreshToken);
                // The Refresh token can become invalid for several reasons
                // such as invalid cliendid and secret or the user's password has changed.
                // In Such cases issue a brand new access token
                if (!string.IsNullOrEmpty(token.Error))
                {
                    token = GetAccessToken(clientId, clientSecret, Username, Password);
                }
            }

            if (!string.IsNullOrEmpty(token.Error))
            {
                throw new Exception(token.Error);
            }
            else
            {
                //Need to store the token in any presistent storage
                token.ExpiredDateTime = DateTime.Now.AddSeconds(token.ExpiresIn);

                //Create an object of type UserTokenMaster
                UserTokenMaster userTokenMaster = new UserTokenMaster()
                {
                    UserName = Username,
                    UserPassword = Password,
                    AccessToken = token.AccessToken,
                    RefreshToken = token.RefreshToken,
                    TokenExpiredTime = token.ExpiredDateTime
                };

                bool IsAddeded = (new UserTokenRepository()).AddUserTokenIntoDB(userTokenMaster);
                if (IsAddeded)
                {
                    token.Error = "Error Occurred while saving the Token into the DB";
                }
            }

            return token;
        }

        //This method is used to get a new access token
        public static Token GetAccessToken(string clientId, string clientSecret, string username, string password)
        {
            Token token = new Token();

            HttpClientHandler handler = new HttpClientHandler();
            HttpClient client = new HttpClient(handler);

            // Need to set the Client ID and Client Secret in the Authorization Header
            // in Base64 Encoded Format using the Basic Authentication as shown below
            string ClientIDandSecret = clientId + ":" + clientSecret;
            var authorizationHeader = Convert.ToBase64String(Encoding.UTF8.GetBytes(ClientIDandSecret));
            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", authorizationHeader);

            // Create a dictionary which contains the request form data, here we need to set
            // the username, password and grant_type as shown below
            var RequestBody = new Dictionary<string, string>
               {
                   {"grant_type", "password"},
                   {"username", username},
                   {"password", password},
               };

            //Make a Post request by invoking the PostAsync method on the client object as shown below
            var tokenResponse = client.PostAsync(baseAddress + "token", new FormUrlEncodedContent(RequestBody)).Result;

            if (tokenResponse.IsSuccessStatusCode)
            {
                var JsonContent = tokenResponse.Content.ReadAsStringAsync().Result;
                token = JsonConvert.DeserializeObject<Token>(JsonContent);
                token.Error = null;
            }
            else
            {
                token.Error = "GetAccessToken failed likely due to an invalid client ID, client secret, or invalid usrename and password";
            }

            return token;
        }

        //This method is used to get a new access token based on the Refresh Token
        public static Token GetAccessTokenByRefreshToken(string clientId, string clientSecret, string refreshToken)
        {
            Token token = new Token();

            HttpClientHandler handler = new HttpClientHandler();
            HttpClient client = new HttpClient(handler);

            // Need to set the Client ID and Client Secret in the Authorization Header
            // in Base64 Encoded Format using Basic Authentication as shown below

            string ClientIDandSecret = clientId + ":" + clientSecret;
            var authorizationHeader = Convert.ToBase64String(Encoding.UTF8.GetBytes(ClientIDandSecret));
            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", authorizationHeader);

            // Create a dictionary which contains the refresh token, here we need to set
            // the grant_type as refresh_token as shown below
            var RequestBody = new Dictionary<string, string>
               {
                   {"grant_type", "refresh_token"},
                   {"refresh_token", refreshToken}
               };

            //Make a Post request by invoking the PostAsync method on the client object as shown below
            var tokenResponse = client.PostAsync(baseAddress + "token", new FormUrlEncodedContent(RequestBody)).Result;

            if (tokenResponse.IsSuccessStatusCode)
            {
                var JsonContent = tokenResponse.Content.ReadAsStringAsync().Result;
                token = JsonConvert.DeserializeObject<Token>(JsonContent);
                token.Error = null;
            }
            else
            {
                token.Error = "GetAccessToken by Refresh Token failed likely due to an invalid client ID, client secret, or it has been revoked by the system admin";
            }

            return token;
        }
    }
}

That’s it. Run the application and see everything is working as expected. In the next article, I will discuss how to consume Refresh Token using JavaScript.

In this article, I try to explain how to Consume Refresh Token in C# Client Application with an example. I hope this article will help you with your need. I would like to have your feedback. Please post your feedback, question, or comments about this article.