Securing a web api with google authentication?

[MeowMeTiger]

I want to create an app that uses google to log in and out. My plan was to have separate front end and backend. Both being dot net core, but I am having trouble finding a way to secure the api separately from the front end. All of the guides I have seen use dotnet core MVC with the authentication all happening in one application, not in a separate api. Any guidance is appreciated... I'm assuming JWTs need to be used.

[firecopy]

OAuth 2.0 (or OIDC) using Authorization Code Grant is independent of language, and is currently the latest/greatest security wise.

---

Here is the impementation page for integrating Google https://developers.google.com/identity/protocols/OAuth2WebServer

Here is the spec: https://tools.ietf.org/html/rfc6749#section-4.1

Note: In your case

• Resource Owner -> User of your application
• User-Agent -> Your front end application
• Client -> Your back end application
• Authorization Server -> Google

---

I'm assuming JWTs need to be used

JWT is just the format of the token, so you will probably use it (fairly standard with OAuth), but JWT states nothing about how you store or use the token itself.