ASP.NET Core Authentication and Authorization - the Key Concepts
summary
Distills how ASP.NET Core actually wires identity: the HTTP context user comes from the default authentication scheme, and the five core APIs AuthenticateAsync/ChallengeAsync/SignInAsync/SignOutAsync/ForbidAsync behave differently for cookies vs bearer tokens (redirects and 401/403). Explains schemes and defaults, why ASP.NET Identity creates identity.application and identity.external cookies, shows an app wired to OpenID Connect + IdentityServer that issues access tokens (API validates them), warns to configure Data Protection key persistence, and mentions refresh tokens via Duende Access Token Management.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 1:09Authentication vs authorization
- 3:39Core auth APIs
- 9:27HTTP context user
- 11:11Remote auth handlers
- 13:45Auth schemes and providers
- 17:38Default schemes hierarchy
- 18:25Authorization policies
- 23:02ASP.NET Identity overview
- 26:34Identity cookie schemes
- 29:02Identity user structure
- 30:27Data protection basics
- 34:08Demo setup
- 35:11Explicit data protection
- 36:36Cookie auth and login
- 38:48Fixing auth quirks
- 42:03OpenID Connect auth
- 43:10Default auth schemes
- 44:15Testing OpenID Connect
- 45:42API auth with tokens
- 46:23Single sign-on and single sign-out challenges
- 48:09Authorization policy
- 49:16Testing auth and roles
- 50:44Complex authorization
- 52:56Summary
- 54:05Q&A
related talks
57mASP.NET Core Authentication and Authorization - the Key Concepts
49mDemystifying authentication in ASP.NET Core
51mAuthentication and Authorization in ASP.NET Core 2
01h 03mASP.NET Core Authentication - The Dirty Details
59mThe whirlwind tour of Authentication and Authorization with ASP.NET Core
01h 04mImplementing Authentication and Authorization with ASP.NET Core 2
39mA guided tour of ASP.NET core security
53mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0