A deep dive into JWT authentication, AES-256-GCM encryption, SignalR, and production security patterns.
Introduction
Real-time messaging apps are everywhere, but most tutorials gloss over the hard parts — the security. In this post I'll walk you through SecureChat, a production-grade messaging app I built with .NET 8 and Angular 18. By the end you'll understand:
How to encrypt messages at rest using AES-256-GCM
How to build a JWT + rotating refresh token authentication flow











