ASP.NET Core Authentication - The Dirty Details
summary
Deep dive examines ASP.NET Core internals: the tiny IAuthenticationHandler surface (initialize/authenticate/challenge/forbid), how options and authentication properties get serialized into state for remote flows, and how the remote authentication handler uses a correlation cookie (32 random bytes + base64) to prevent CSRF. Shows addScheme plumbing, cookie session signing, claims transformation running on every request, a full local facial‑recognition auth provider and a fake remote identity provider, and an API‑aware cookie decorator that returns 401 instead of redirects.
AI-written summary · about
chapters (10)
- 0:00ASP.NET Core Auth intro
- 1:04Auth handler basics
- 15:56Sign-in/out extensions
- 25:41Remote auth deep dive
- 33:42Policy schemes config
- 41:28Custom auth providers
- 51:42Identity provider impl
- 55:55Claims transformation pitfalls
- 58:30API auth handling
- 1:01:08Q&A
related talks
59mASP.NET Core Authentication and Authorization - the Key Concepts
49mDemystifying authentication in ASP.NET Core
57mASP.NET Core Authentication and Authorization - the Key Concepts
41mDemystifying authentication in ASP.NET Core
59mThe whirlwind tour of Authentication and Authorization with ASP.NET Core
51mAuthentication and Authorization in ASP.NET Core 2
39mA guided tour of ASP.NET core security
01h 04mImplementing Authentication and Authorization with ASP.NET Core 2