Web Api Authorization, without ready-made solutions?

Question

API

Hello, I want to make an API on ASP.net Core and I want to ask a couple of questions about authorization in the API.
The api is not done yet, I just want to plan and draw everything in my head.
Let's imagine there is a database of users with a login and password and some other rubbish.
The controller has an Auth(string login, string pass) method that will return a response to us in which, upon successful login, there will be a token that we will continue to use simply by attaching it to the next requests in the Header.
The token is registered in the Tokens table with the user id and the receiving IP. That is, our token is the key to performing actions from the user, but only from the same IP.
There is a controller with data and other actions, they have an authorization attribute that just checks for the presence of this token in the Header, if not, it does not skip and returns an error, otherwise everything works according to its scenario.
It seems the idea is simple and I do not see "holes" for hacking here.
1) It seems to me that in each request to the API it will take a long time to check the validity of the IP - Token (request to the database) and the answers will be more than half a second, how can you decide or do they do it?
2) Everywhere I read about this topic they write: "Do not write yourself, there will be a lot of holes! Use ready-made solutions. (Owin, etc.)"
Are there holes in my model?
3) If I make a site (Web application) that will access the API (as I understand it, like a regular client - HTTP requests), then in theory my site will be one of the users who uses the Token and holds it in the Header, will it be visible in the web debugger? from which IP will requests go, server or user? I mean those ones will not be in the site controllers, but Ajax.

Answer 1

If you are interested in how the system is already working, you can try )
autoupdateservice.azurewebsites.net/swagger
In response to authorization, there will be a token that will need to be inserted after pressing Authorize
https://github.com/BashkaMen/QRTicket

Answer 2

1) It seems to me that in each request to the API it will take a long time to check the validity of the IP - Token (request to the database) and the answers will be more than half a second, how can you decide or do they do it?

In-memory cache for active tokens.

2) Everywhere I read about this topic they write: "Do not write yourself, there will be a lot of holes! Use ready-made solutions. (Owin, etc.)"
Are there holes in my model?

At the model stage, it is too early to look for holes, and your model is superficial. How tokens will be generated, what complexity, the probability of collisions - this is what decides everything.
It depends on what api and how you implement it. Ajax is a client side technology, yes the token will be visible in the debugger.

Answer 3

Look JWT is a standard, not quite a ready-made solution.

Answer 4

There is a controller with data and other actions, they have an authorization attribute that just checks for the presence of this token in the Header, if not, it does not skip and returns an error, otherwise everything works according to its scenario.

And I read this and I immediately understood that you want to rewrite ASP.NET Identity. Everything is exactly like there. You can set the "Authorized" attribute for controller methods, and then if the user is not authorized, he will be redirected to the authorization page. Plus, you can specify the Role attribute, in which you can specify for which roles this controller method works. Well, and many other advantages, such as authorization through social networks.
Everything is ready, I just don’t understand why you need to spend time developing your own authorization system. Unless you're writing a website for the military...)