title: What to do with JWT client_id on Javascript backend with ASP.NET Web API
body: <p>I'm trying to implement JWT authorization in a project. However in order to successfully get the token I have to pass client_id from AngularJS frontend to ASP.NET Web API backend and as far as I know it is not secure at all. So could someone please give me a hint about what should I be doing in my situation.</p>
  
  <p>On JS side - </p>
  
  <pre><code>var data = 'grant_type=password&amp;username='
                      + loginData.Email + '&amp;password=' + loginData.Password + '&amp;client_id=' + client_id;
  $http.post('/oauth2/token', data); //Code omitted
  </code></pre>
  
  <p>I'm using this <a href="http://bitoftech.net/2014/10/27/json-web-token-asp-net-web-api-2-jwt-owin-authorization-server/">guide</a> for creating a Jwt authorization, for the most part. Except I have an app on one domain, so here is what my Startup.cs looks like - </p>
  
  <pre><code>public void Configuration(IAppBuilder app)
          {
              var config = new HttpConfiguration();               
              config.MapHttpAttributeRoutes();    
              ConfigureOAuth(app);    
              ConfigureValidationOAuth(app);
          }
  
  private static void ConfigureOAuth(IAppBuilder app)
          {
              var oAuthServerOptions = new OAuthAuthorizationServerOptions
              {
                  AllowInsecureHttp = true,
                  TokenEndpointPath = new PathString("/oauth2/token"),
                  AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(30),
                  Provider = new CustomOAuthProvider(),
                  AccessTokenFormat = new CustomJwtFormat(ConfigurationManager.AppSettings["owin:issuer"])
              };
  
              app.UseOAuthAuthorizationServer(oAuthServerOptions);
          }   
  
   private static void ConfigureValidationOAuth(IAppBuilder app)
      {
          var issuer = ConfigurationManager.AppSettings["owin:issuer"];
          var audience = ConfigurationManager.AppSettings["owin:audience"];
          var secret = TextEncodings.Base64Url.Decode(ConfigurationManager.AppSettings["owin:secret"]);
  
          //Api controllers with [Authorize] attribute will be validated with Jwt
          app.UseJwtBearerAuthentication(
              new JwtBearerAuthenticationOptions
              {
                  AuthenticationMode = AuthenticationMode.Active,
                  AllowedAudiences = new[] {audience},
                  IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
                  {
                      new SymmetricKeyIssuerSecurityTokenProvider(issuer, secret)
                  }
              });
      }
  </code></pre>