ASP.NET Core Authentication and Authorization - the Key Concepts
summary
Clear, practical mapping of ASP.NET Core authentication APIs: how AuthenticateAsync/ChallengeAsync/SignInAsync/SignOutAsync/ForbidAsync behave across cookie, JWT bearer and OpenID Connect flows, and why scheme defaults cause unexpected redirects. Demonstrates a working demo app that wires cookie + OIDC + JWT bearer, shows logout must tear down both local cookie and upstream session, and exercises API 401/403 behavior. Calls out real-world impact: about half of support cases stem from these fundamentals and ~30% trace to misconfigured data protection key storage.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 1:52Authentication vs authorization
- 2:56ASP.NET Core auth API methods
- 6:08Cookie auth flow
- 8:16Bearer token API auth
- 11:30Auth middleware setup
- 13:37Remote auth handlers & sessions
- 15:44Auth schemes in code
- 19:36Default schemes & fallback
- 20:19Live demo: cookie auth
- 22:31Sign in with claims
- 25:27Testing auth API methods
- 27:15OpenID Connect auth
- 29:54Sign-out for external providers
- 31:39Authorization policies
- 35:35Custom auth requirements
- 37:03Custom policy demo
- 39:46Default challenge scheme
- 41:19ASP.NET Identity intro
- 43:06ASP.NET Identity services
- 44:35External auth callback
- 47:06User login & migration
- 47:50Data Protection in ASP.NET
- 50:17Data Protection config
- 51:40Live demo: Data Protection
- 53:28Bearer token API auth demo
- 54:55Summary
related talks
59mASP.NET Core Authentication and Authorization - the Key Concepts
49mDemystifying authentication in ASP.NET Core
59mThe whirlwind tour of Authentication and Authorization with ASP.NET Core
01h 04mImplementing Authentication and Authorization with ASP.NET Core 2
51mAuthentication and Authorization in ASP.NET Core 2
01h 03mASP.NET Core Authentication - The Dirty Details
41mDemystifying authentication in ASP.NET Core
01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0