MSDN Documentation

ASP.NET Core provides a flexible and extensible authentication system. It supports various authentication schemes, including cookies, JWT bearer tokens, OAuth, OpenID Connect, and custom providers. The core of the authentication system is built around the IAuthenticationService and associated middleware.

Key concepts include:

• Authentication Schemes: Define how a user's identity is verified (e.g., cookie, JWT, OAuth).
• Authentication Handlers: Implement the logic for a specific authentication scheme.
• Authentication Middleware: Integrates the authentication system into the ASP.NET Core request pipeline.
• User Principal: Represents the authenticated user and their claims.

Cookie authentication is a common method for web applications where the server issues a cookie after successful sign-in, which the browser then sends with subsequent requests. ASP.NET Core provides built-in support for cookie authentication.

To enable cookie authentication, you typically need to:

1. Add the Microsoft.AspNetCore.Authentication.Cookies NuGet package.
2. Configure the cookie authentication services in Startup.cs (or Program.cs for minimal APIs).
3. Use the cookie authentication middleware in the request pipeline.

Here's a snippet of how to configure it:

services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
                    .AddCookie(options =>
                    {
                        options.LoginPath = "/Account/Login";
                        options.LogoutPath = "/Account/Logout";
                    });

And in the request pipeline:

app.UseAuthentication();
app.UseAuthorization();

ASP.NET Core makes it easy to integrate with external identity providers like Google, Facebook, Microsoft, Twitter, etc., using protocols like OAuth 2.0 and OpenID Connect.

This involves:

• Registering your application with the external provider to get client ID and secret.
• Configuring the appropriate authentication middleware (e.g., AddGoogle, AddFacebook) in your application.
• Handling the callback from the external provider to sign in the user.

For APIs and stateless authentication, JSON Web Tokens (JWT) are a popular choice. ASP.NET Core supports JWT bearer authentication, allowing you to validate tokens issued by an authentication server.

You'll typically use the Microsoft.AspNetCore.Authentication.JwtBearer package. Configuration involves specifying the authority, audience, and signing key for token validation.

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                    .AddJwtBearer(options =>
                    {
                        options.Authority = "https://your.identityserver.com";
                        options.Audience = "your_api_audience";
                    });

If none of the built-in schemes meet your needs, you can implement custom authentication handlers by inheriting from AuthenticationHandler<TOptions>. This provides maximum flexibility for unique authentication scenarios.

• Official ASP.NET Core Authentication Overview
• Cookie Authentication in ASP.NET Core
• External Login with Google
• JWT Bearer Authentication in ASP.NET Core