The Ultimate Authentication Course with C# and Angular

Set up an ASP.NET Core Web API project with C# in Visual Studio 2022, target dotnet 6, install entity framework core packages, remove weather forecast files, and configure port 8000.

Set up the database with Microsoft SQL Server and SQL Server Management Studio, then connect to the database. Add the default connection string in appsettings.json with server and database names.

Create a user model with id, first name, last name, email, and password; map fields for the front end, set id as key, and configure db context and migrations.

Create an api controller to receive user data via post to api/register, test with postman, and use a dto containing first name, last name, email, and password.

Register users by serializing data, validate password and confirm match, return unauthorized on mismatch, save the user via the DB context, and test with Postman.

Add a json ignore attribute to the password field to prevent it from being returned, and implement a sha-256 hash service to store the password hash in the database.

Create a login controller and a login detail dto to validate email and password, returning user data. Handle unauthorized responses for invalid credentials and note jwt will be added later.

Create and manage jwt tokens, including access and refresh tokens, with user id claims and creation/expiry dates, secured by secret keys and stored as http-only cookies.

Configure cors by adding middleware to the http pipeline to allow ports 3000, 8080, and 4200, with any header, any method, and credentials for refresh tokens.

Read the authorization header to obtain the access token, decode it to extract the user id, and fetch the user from the database, returning unauthorized when invalid or expired.

Implement a refresh token flow by reading the token from a cookie, validating expiration, decoding the refresh token to obtain the user id, and issuing a new access token.

Create a logout controller that handles a post request, deletes the refresh token cookie, and returns an okay status, highlighting the risk of saved tokens requiring a follow-up fix.

Implement a secure refresh token workflow by storing refresh tokens in a user tokens table with user id, token, created, expiry; issue access tokens on refresh and delete on logout.

Create forgot and reset password controllers and a reset token model to store email and token in the database, then generate and email tokens on requests.

Create and test the password reset email by wiring a mail service with an smtp client and MailHog, sending the reset token to the user’s email and confirming delivery.

Implement a reset password workflow that validates the reset token, confirms the email, hashes and saves the new password, and sends a tokenized reset link by email.

set up the frontend with Angular CLI, create the Angular auth project with routing, apply Bootstrap styles, and run ng serve while preparing additional components for future tutorials.

Learn to create and organize Angular components for authentication by generating login, register, and home components, updating modules, and adjusting schematics to skip tests.

Learn to build a header navigation and configure app routing in Angular, enabling seamless transitions between home, login, and register components with a reusable navigation component.

Register a user with Angular reactive forms using a form group and form builder. Bind first name, last name, email, password, and password confirm to form control names.

Register a user by posting form data to the backend with http client, then navigate to login, and refactor into an auth service with an environment API prefix.

Adapt the login flow from the register component to post to api/login with credentials, obtain access and refresh tokens via cookies, store the access token in service, and prepare interceptors.

Learn to implement an http interceptor that attaches a bearer token to every request, retrieve the authenticated user, and handle unauthorized responses, preparing for refresh tokens.

Learn how to handle unauthenticated errors with refresh tokens in an Angular interceptor: detect 401, call refresh, update the access token, and retry the original request.

Implement a logout button that clears the refresh token cookie and resets the access token via a service call. Add a refresh flag to prevent refresh attempts after 401 unauthorized.

Use a static event emitter to share authentication state across components, emitting boolean values, with the nav bar subscribing to update login status and redirect on logout.

Implement a forgot password flow in Angular by creating a forgot component and service, posting the email to api/forgot, and showing success or error notifications.

Implement a reset password flow by building a reset component, retrieving the token from the URL with the root activated route, and submitting password and password confirm.

Implement two factor authentication by adding a two factor DTO and controller, validating codes with the Google Authenticator package, and generating access and refresh tokens for successful sign-ins.

Refactor the login flow to support two-factor authentication by adding a login form and an authenticator form, linked through an output event emitter that passes user id and QR code.

Explore implementing two-factor authentication by wiring an authenticator login, generating and displaying a QR code, and using the received token to navigate to the main page.

Learn to implement Google authentication in a C# and Angular app using ASP.NET Core, Google APIs, and token validation, creating or retrieving users, and issuing access and refresh tokens.

Configure Google authentication in Angular with angular x social login, downgrade the package to 12, add a login with Google button, and post the ID token to enable cookie-based auth.