Demystifying authentication in ASP.NET Core
summary
Demo uses ASP.NET Core 8 middleware and cookie handler to show that authentication is implemented as a claims principal built from an authentication ticket that the cookie stores, encrypted by the data protection API. The cookie handler implements five operations (authenticate, sign in, sign out, challenge, forbid). Replacing the protector with a no‑op exposes the ticket so the claims can be inspected, and copying the cookie between browsers proves sign‑out merely deletes a client cookie; fix demonstrated is a session store backend to revoke sessions.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:05Talk goal
- 3:53Request pipeline
- 8:12Auth middleware ops
- 12:32Auth schemes roles
- 15:04User login in ASP.NET Core
- 21:10Sign-in operation
- 22:35Cookie contents
- 27:39Security implications of stolen authentication cookies
- 29:11User sign-out in ASP.NET Core
- 33:24Logout path quirks
- 36:21Cross-browser sign-out
- 38:41Session-based cookies
- 40:04Summary
related talks
49mDemystifying authentication in ASP.NET Core
59mThe whirlwind tour of Authentication and Authorization with ASP.NET Core
01h 04mImplementing Authentication and Authorization with ASP.NET Core 2
01h 03mASP.NET Core Authentication - The Dirty Details
57mASP.NET Core Authentication and Authorization - the Key Concepts
51mAuthentication and Authorization in ASP.NET Core 2
59mASP.NET Core Authentication and Authorization - the Key Concepts
39mA guided tour of ASP.NET core security