A modern and secure auction management REST API built with ASP.NET (.NET 10). This backend powers the AuctionHub platform and provides features such as secure authentication, auction lifecycle management, and a real-time bidding system.
The API is fully documented using Swagger (OpenAPI 3.0) and is designed to work with the AuctionHub React frontend.
AuctionHub uses a separate frontend repository.
Frontend:
AuctionHub_frontend
Built with:
- React
- TypeScript
- Vite
Repository:
https://github.com/Qian1507/AuctionHub_frontend
The API includes full interactive documentation using Swagger UI.
Below is a preview of the Swagger interface.
After running the project you can access Swagger at:
Secure authentication system including:
- User registration
- User login
- JWT token authentication
- BCrypt password hashing
Additional capabilities:
- Users can update their password (with verification)
- Admins can deactivate user accounts
AuctionHub supports a full auction lifecycle.
Features include:
- Create auctions
- Update auctions
- View active auctions
- View auction details
Smart bidding rules:
- Bids only allowed on active auctions
- New bids must exceed the current highest bid
- Automatic auction status tracking
Auction statuses:
- Live – currently active
- Finished – auction ended
- Disabled – disabled by admin
Users can participate in auctions by placing bids.
Rules:
- Bids must be higher than the current highest bid
- Users may cancel their latest bid while the auction is active
Administrative features include:
- Disable auctions
- View all users
- View all auctions regardless of status
Role-based access control (RBAC):
UserAdmin
Protected endpoints require JWT authorization.
Backend Framework
- ASP.NET Core (.NET 10)
Database
- Entity Framework Core
Authentication
- JWT (JSON Web Tokens)
Security
- BCrypt.Net password hashing
Architecture
- Layered Architecture
- Repository Pattern
- Service Layer
API Documentation
- Swagger / OpenAPI 3.0
The backend follows a layered architecture to ensure separation of concerns.
Controller Layer Handles HTTP requests and responses.
Service Layer Contains the main business logic such as auction rules and bid validation.
Repository Layer Handles database access through Entity Framework Core.
Database Layer Stores users, auctions, and bids.
Request flow:
Client ↓ Controller ↓ Service Layer ↓ Repository Layer ↓ Database
AuctionHub_backend
│
├── Controllers/
│ ├── AuctionController.cs
│ └── UserController.cs
│
├── Core/
│ │
│ ├── Interfaces/
│ │ ├── IAuctionService.cs
│ │ ├── ITokenService.cs
│ │ └── IUserService.cs
│ │
│ └── Services/
│ ├── AuctionService.cs
│ ├── TokenService.cs
│ └── UserService.cs
│
├── Data/
│ │
│ ├── Dtos/
│ │ ├── AuctionCreateDto.cs
│ │ ├── AuctionDetailDto.cs
│ │ ├── AuctionListDto.cs
│ │ ├── AuctionUpdateDto.cs
│ │ ├── AuthResponseDto.cs
│ │ ├── BidCreateDto.cs
│ │ ├── BidDto.cs
│ │ ├── UpdatePasswordDto.cs
│ │ ├── UserLoginDto.cs
│ │ ├── UserRegisterDto.cs
│ │ └── UserResponseDto.cs
│ │
│ ├── Entities/
│ │ ├── Auction.cs
│ │ ├── Bid.cs
│ │ └── User.cs
│ │
│ ├── Interfaces/
│ │ ├── IAuctionRepo.cs
│ │ └── IUserRepo.cs
│ │
│ ├── Repos/
│ │ ├── AuctionRepo.cs
│ │ └── UserRepo.cs
│ │
│ ├── Migrations/
│ │
│ └── AuctionDbContext.cs
│
├── appsettings.json
├── Program.cs
└── README.md
Application configuration is stored in:
appsettings.json
Example configuration:
{
"Logging": {
"LogLevel": {
"Default": "Information",
"Microsoft.AspNetCore": "Warning"
}
},
"AllowedHosts": "*",
"ConnectionStrings": {
"DefaultConnection": "YOUR_DATABASE_CONNECTION"
},
"Jwt": {
"Key": "STORED_IN_USER_SECRETS",
"Issuer": "AuctionHub_backend",
"Audience": "AuctionHub_frontend",
"ExpiresMinutes": 60
}
}For security reasons, the JWT key should be stored using .NET User Secrets or environment variables.
- Clone the Repository
git clone [https://github.com/Qian1507/AuctionHub_backend.git] cd AuctionHub_backend
Edit:
appsettings.json
Add your database connection string.
Example (SQL Server):
Server=localhost;Database=AuctionHub;Trusted_Connection=True;
dotnet ef database update
dotnet run
Backend runs at:
http://localhost:5226
Swagger documentation:
http://localhost:5226/swagger
The API uses JWT authentication.
Authentication flow:
- User registers an account
- Password is hashed using BCrypt
- User logs in
- Server returns a JWT token
- Client sends the token in request headers
Example header:
Authorization: Bearer <token>
Protected endpoints require a valid token.
CORS is configured to allow requests from the AuctionHub frontend.
Development frontend URL:
http://localhost:5173
This project is licensed under the MIT License.