# Securing a Full-Stack App

Users sign in, and the API must know who is calling. You will learn hashing, encryption and JSON Web Tokens, secure a Web API with JWT bearer authentication, and add sign-in, route guards and interceptors to Angular.

Updated: November 3, 2026

## [Security Basics](https://www.ask-codey.com/courses/csharp-full-stack-bootcamp/topics/security-basics)

1. [Hashing and Encryption](https://www.ask-codey.com/lessons/security-basics-hashing-and-encryption) (Journeyman): Hashing is one-way, a fingerprint you can check but never undo, so it's for passwords. Encryption is two-way with a key, so it's for data you need back. A password hash needs a random salt and many rounds, which is what PBKDF2 and ASP.NET Core's PasswordHasher do for you.
2. [JSON Web Tokens](https://www.ask-codey.com/lessons/security-basics-json-web-tokens) (Journeyman): A JSON Web Token is a signed note an API gives you at sign-in: header, payload and signature, joined with dots. Anyone can read the payload, but nobody can change it without the key, so the API can trust the claims in it, such as who you are and your role, until it expires.

## [Securing the Web API](https://www.ask-codey.com/courses/csharp-full-stack-bootcamp/topics/securing-the-web-api)

1. [Securing a Web API with JWT Bearer](https://www.ask-codey.com/lessons/securing-the-web-api-securing-a-web-api-with-jwt-bearer) (Journeyman): Give the categories API users. Register and login endpoints check passwords with PasswordHasher and hand back a signed JSON Web Token; AddJwtBearer checks the token on every request, and \[Authorize\] with roles decides who may add, change and delete. The signing key lives in user secrets.

Source: https://www.ask-codey.com/courses/csharp-full-stack-bootcamp/chapters/securing-a-full-stack-app