Demystifying authentication in ASP.NET Core
summary
Explains how ASP.NET Core turns an incoming request into a user: the authentication middleware calls handlers (cookie, JWT, OIDC) that run five operations: authenticate, sign in, sign out, challenge, forbid. Cookie handler creates an authentication ticket (ClaimsPrincipal + properties), encrypts it into a cookie, and can split large cookies over 4KB. Gotchas covered: challenge vs redirect (calling ChallengeAsync then returning Redirect replaces responses) and logout paths/returnUrl semantics. Revokeable sessions require server-side session revocation.
AI-written summary · about
chapters (9)
- 0:00ASP.NET Core auth intro
- 6:08Auth middleware user ID
- 11:24Auth handler core ops
- 22:55Sign in with claims
- 28:43Cookie contents on sign-in
- 33:19Sign out and challenges
- 41:01Stolen cookie risks
- 44:33Large claims cookie limits
- 47:05ASP.NET Core auth flow summary
related talks
41mDemystifying authentication in ASP.NET Core
57mASP.NET Core Authentication and Authorization - the Key Concepts
59mASP.NET Core Authentication and Authorization - the Key Concepts
01h 03mASP.NET Core Authentication - The Dirty Details
59mThe whirlwind tour of Authentication and Authorization with ASP.NET Core
01h 04mImplementing Authentication and Authorization with ASP.NET Core 2
51mAuthentication and Authorization in ASP.NET Core 2
39mA guided tour of ASP.NET core security