1. IronPDF
  2. IronPDF Blog
  3. .NET Help
  4. C# OAuth2

Published March 7, 2024

C# OAuth2 (How It Works For Developers)

OAuth2 is a powerful protocol for securing your web applications by handling user authentication and authorization. In the realm of C# development, understanding OAuth2 can greatly enhance the security and functionality of your applications.

This guide is tailored for beginners, with a focus on key concepts, practical examples, and easy-to-understand explanations. We'll also learn a use case to use OAuth2 with the IronPDF library.

Understanding OAuth2 and its Importance

C# OAuth2 (How It Works For Developers): Figure 1 - OAuth2 webpage

OAuth2 is a protocol that allows a client application to request access to resources hosted by an authorization server, on behalf of a user. It's a common method for handling user authentication and authorization in modern web applications.

The primary goal of OAuth2 is to provide secure and effective access to resources without sharing the user's credentials (like username and password) directly with the client application.

Key Concepts in OAuth2

Before diving into the implementation, let's clarify some essential OAuth2 terminology:

  • Client Application: The application requesting access to the user's account.
  • Authorization Server: The server that authenticates the user and issues access tokens to the client application.
  • Access Token: A token that grants the client application access to the user's account for a limited time.
  • Refresh Token: A token used to obtain a new access token when the current one expires without requiring the user's credentials again.
  • Client ID and Client Secret: Credentials that identify the client application to the authorization server.
  • Redirect URI: A URI that the authorization server will send the user after granting or denying access to the client application.
  • Authorization Code Flow: A secure method where the client application receives an authorization code as an intermediate step before exchanging it for an access token.

Implementing OAuth2 in C#: A Basic Example

Let's create a simple C# application that uses OAuth2 for user authentication. This example will guide you through setting up an OAuth2 client, obtaining an access token, and making a request to a protected resource.

Setting Up Your OAuth2 Client

First, you need to register your C# application with the OAuth2 authorization server. This process varies depending on the server, but you'll typically receive a client ID and a client secret, which are crucial for the OAuth2 flow.

Step 1: Define Your Application's Credentials

As the first step, set up your client credentials like client ID and client Secrets. Here is the sample code:

class Program
{
    private static string clientId = "your-client-id";
    private static string clientSecret = "your-client-secret";
    private static string redirectUri = "your-redirect-uri";
    static void Main(string[] args)
    {
        // OAuth2 implementation will go here
    }
}
class Program
{
    private static string clientId = "your-client-id";
    private static string clientSecret = "your-client-secret";
    private static string redirectUri = "your-redirect-uri";
    static void Main(string[] args)
    {
        // OAuth2 implementation will go here
    }
}
Friend Class Program
	Private Shared clientId As String = "your-client-id"
	Private Shared clientSecret As String = "your-client-secret"
	Private Shared redirectUri As String = "your-redirect-uri"
	Shared Sub Main(ByVal args() As String)
		' OAuth2 implementation will go here
	End Sub
End Class
VB   C#

Step 2: Requesting User Authorization

To initiate the OAuth2 flow, redirect the user to the authorization server's authorization endpoint. Here's how to construct the URL for the authorization request:

static void Main(string[] args)
{
    var authorizationEndpoint = "https://authorization-server.com/auth";
    var responseType = "code";
    var scope = "email profile";
    var authorizationUrl = $"{authorizationEndpoint}?response_type={responseType}&client_id={clientId}&redirect_uri={redirectUri}&scope={scope}";
    // Redirect the user to authorizationUrl
}
static void Main(string[] args)
{
    var authorizationEndpoint = "https://authorization-server.com/auth";
    var responseType = "code";
    var scope = "email profile";
    var authorizationUrl = $"{authorizationEndpoint}?response_type={responseType}&client_id={clientId}&redirect_uri={redirectUri}&scope={scope}";
    // Redirect the user to authorizationUrl
}
Shared Sub Main(ByVal args() As String)
	Dim authorizationEndpoint = "https://authorization-server.com/auth"
	Dim responseType = "code"
	Dim scope = "email profile"
	Dim authorizationUrl = $"{authorizationEndpoint}?response_type={responseType}&client_id={clientId}&redirect_uri={redirectUri}&scope={scope}"
	' Redirect the user to authorizationUrl
End Sub
VB   C#

Step 3: Handling the Authorization Response

After the user grants or denies permission, the authorization server redirects them back to your application with an authorization code or an error message. You need to capture this code from the query parameters of the redirect URI.

Step 4: Exchanging the Authorization Code

Now, you'll exchange the authorization code for an access token. This requires a POST request to the authorization server's token endpoint.

public static async Task<string> ExchangeAuthorizationCodeForAccessToken(string authorizationCode)
{
    var tokenEndpoint = "https://authorization-server.com/token";
    var postData = $"grant_type=authorization_code&code={authorizationCode}&redirect_uri={redirectUri}&client_id={clientId}&client_secret={clientSecret}";
    var data = Encoding.ASCII.GetBytes(postData);
    var request = WebRequest.Create(tokenEndpoint);
    request.Method = "POST";
    request.ContentType = "application/x-www-form-urlencoded";
    request.ContentLength = data.Length;
    using (var stream = request.GetRequestStream())
    {
        stream.Write(data, 0, data.Length);
    }
    var response = (HttpWebResponse)request.GetResponse();
    var responseString = new StreamReader(response.GetResponseStream()).ReadToEnd();
    // Extract the access token from the response
    var token = ExtractAccessTokenFromResponse(responseString);
    return token;
}
public static async Task<string> ExchangeAuthorizationCodeForAccessToken(string authorizationCode)
{
    var tokenEndpoint = "https://authorization-server.com/token";
    var postData = $"grant_type=authorization_code&code={authorizationCode}&redirect_uri={redirectUri}&client_id={clientId}&client_secret={clientSecret}";
    var data = Encoding.ASCII.GetBytes(postData);
    var request = WebRequest.Create(tokenEndpoint);
    request.Method = "POST";
    request.ContentType = "application/x-www-form-urlencoded";
    request.ContentLength = data.Length;
    using (var stream = request.GetRequestStream())
    {
        stream.Write(data, 0, data.Length);
    }
    var response = (HttpWebResponse)request.GetResponse();
    var responseString = new StreamReader(response.GetResponseStream()).ReadToEnd();
    // Extract the access token from the response
    var token = ExtractAccessTokenFromResponse(responseString);
    return token;
}
Public Shared Async Function ExchangeAuthorizationCodeForAccessToken(ByVal authorizationCode As String) As Task(Of String)
	Dim tokenEndpoint = "https://authorization-server.com/token"
	Dim postData = $"grant_type=authorization_code&code={authorizationCode}&redirect_uri={redirectUri}&client_id={clientId}&client_secret={clientSecret}"
	Dim data = Encoding.ASCII.GetBytes(postData)
	Dim request = WebRequest.Create(tokenEndpoint)
	request.Method = "POST"
	request.ContentType = "application/x-www-form-urlencoded"
	request.ContentLength = data.Length
	Using stream = request.GetRequestStream()
		stream.Write(data, 0, data.Length)
	End Using
	Dim response = CType(request.GetResponse(), HttpWebResponse)
	Dim responseString = (New StreamReader(response.GetResponseStream())).ReadToEnd()
	' Extract the access token from the response
	Dim token = ExtractAccessTokenFromResponse(responseString)
	Return token
End Function
VB   C#

This function sends a POST request to the token endpoint with the necessary data and returns the access token extracted from the response.

Step 5: Making Authorized Requests

With the access token, you can now make requests to resources that require authentication. Attach the access token to your requests in the authorization header as a Bearer token.

public static async Task<string> MakeAuthorizedRequest(string accessToken, string apiUrl)
{
    var request = WebRequest.Create(apiUrl);
    request.Headers.Add("Authorization", $"Bearer {accessToken}");
    var response = (HttpWebResponse)request.GetResponse();
    var responseString = new StreamReader(response.GetResponseStream()).ReadToEnd();
    return responseString;
}
public static async Task<string> MakeAuthorizedRequest(string accessToken, string apiUrl)
{
    var request = WebRequest.Create(apiUrl);
    request.Headers.Add("Authorization", $"Bearer {accessToken}");
    var response = (HttpWebResponse)request.GetResponse();
    var responseString = new StreamReader(response.GetResponseStream()).ReadToEnd();
    return responseString;
}
Public Shared Async Function MakeAuthorizedRequest(ByVal accessToken As String, ByVal apiUrl As String) As Task(Of String)
	Dim request = WebRequest.Create(apiUrl)
	request.Headers.Add("Authorization", $"Bearer {accessToken}")
	Dim response = CType(request.GetResponse(), HttpWebResponse)
	Dim responseString = (New StreamReader(response.GetResponseStream())).ReadToEnd()
	Return responseString
End Function
VB   C#

Introduction to IronPDF

C# OAuth2 (How It Works For Developers): Figure 2 - IronPDF webpage

IronPDF is a versatile library for C# developers that enables the generation, manipulation, and rendering of PDF documents directly within .NET applications. This powerful tool simplifies working with PDF files, making it easy to create complex documents, convert HTML to PDF, extract text from PDFs, and much more. Its straightforward API allows developers to integrate PDF functionalities into their applications quickly, without needing deep knowledge of PDF specifications.

Code Example: Generating a PDF from Protected Content

Imagine you have an endpoint that returns HTML content only accessible to authenticated users. You could use IronPDF to convert this HTML content into a PDF document, leveraging the access token obtained via OAuth2.

First, let's define a method to fetch protected HTML content using an access token:

public static async Task<string> FetchProtectedContent(string accessToken, string apiUrl)
{
    var httpClient = new HttpClient();
    httpClient.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", accessToken);
    var response = await httpClient.GetAsync(apiUrl);
    response.EnsureSuccessStatusCode();
    return await response.Content.ReadAsStringAsync();
}
public static async Task<string> FetchProtectedContent(string accessToken, string apiUrl)
{
    var httpClient = new HttpClient();
    httpClient.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", accessToken);
    var response = await httpClient.GetAsync(apiUrl);
    response.EnsureSuccessStatusCode();
    return await response.Content.ReadAsStringAsync();
}
Public Shared Async Function FetchProtectedContent(ByVal accessToken As String, ByVal apiUrl As String) As Task(Of String)
	Dim httpClient As New HttpClient()
	httpClient.DefaultRequestHeaders.Authorization = New System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", accessToken)
	Dim response = Await httpClient.GetAsync(apiUrl)
	response.EnsureSuccessStatusCode()
	Return Await response.Content.ReadAsStringAsync()
End Function
VB   C#

Now, let's use IronPDF to convert the fetched HTML content into a PDF document:

public static async Task ConvertHtmlToPdf(string accessToken, string apiUrl, string outputPdfPath)
{
    // Fetch protected content using the access token
    string htmlContent = await FetchProtectedContent(accessToken, apiUrl);
    // Use IronPDF to convert the HTML content to a PDF document
    var renderer = new IronPdf.HtmlToPdf();
    var pdf = renderer.RenderHtmlAsPdf(htmlContent);
    // Save the generated PDF to a file
    pdf.SaveAs(outputPdfPath);
}
public static async Task ConvertHtmlToPdf(string accessToken, string apiUrl, string outputPdfPath)
{
    // Fetch protected content using the access token
    string htmlContent = await FetchProtectedContent(accessToken, apiUrl);
    // Use IronPDF to convert the HTML content to a PDF document
    var renderer = new IronPdf.HtmlToPdf();
    var pdf = renderer.RenderHtmlAsPdf(htmlContent);
    // Save the generated PDF to a file
    pdf.SaveAs(outputPdfPath);
}
Public Shared Async Function ConvertHtmlToPdf(ByVal accessToken As String, ByVal apiUrl As String, ByVal outputPdfPath As String) As Task
	' Fetch protected content using the access token
	Dim htmlContent As String = Await FetchProtectedContent(accessToken, apiUrl)
	' Use IronPDF to convert the HTML content to a PDF document
	Dim renderer = New IronPdf.HtmlToPdf()
	Dim pdf = renderer.RenderHtmlAsPdf(htmlContent)
	' Save the generated PDF to a file
	pdf.SaveAs(outputPdfPath)
End Function
VB   C#

In the above code, FetchProtectedContent is responsible for retrieving HTML content from a protected resource using an OAuth2 access token. Once the HTML content is fetched, it's passed to IronPDF's HtmlToPdf renderer to generate a PDF document, which is then saved to the specified path.

Conclusion

C# OAuth2 (How It Works For Developers): Figure 3 - IronPDF licensing page

This guide introduced the basics of using OAuth2 in C# applications, covering key concepts, terminology, and a straightforward implementation example. OAuth2 plays a vital role in securing web applications by handling user authentication and authorization efficiently. While this example demonstrates the Authorization Code Flow, OAuth2 supports other flows suitable for different types of applications.

By integrating IronPDF, C# developers can extend their applications' capabilities to include PDF generation and manipulation, enriching the features available to authenticated users. IronPDF's ease of use and comprehensive PDF manipulation capabilities make it an excellent tool for .NET developers looking to work with PDF files in their projects. It offers a free trial to test out all features. And it's license starts from $749.