I have setup a standard project using blazor webassembly with global and using the standard identity template for individual accounts. Solution has 2 projects, Client and Server.

The client uses the controllers that I setup in the Server project with standard authorize attribute.

Is this all I need to do? I am reading about JWT tokens in a separate api, but that seems like a complete rebuild. I am confused, can someone shed light on if my standard calls from the client to the server controllers are secure, or is there something else that I need to do?