
Explore core security concepts, authentication, and authorization through a real-world base analogy, showing how identity, security context, and cookies or tokens grant access and enforce page permissions.
Explore how the security context in ASP.NET Core defines the user through a claims principal, with identities and claims, and how these drive authorization for resources.
To access the source code. Please go to this github link: https://frank-liu-toronto/WebApp_Security_DotNet8 (github.com)
Or download the entire source code from this lecture.
Configure cookie-based authentication in ASP.NET Core by adding the authentication middleware and the cookie authentication scheme. Allow the middleware to decrypt and interpret the cookie to populate the security context.
Explore authorization architecture in ASP.NET Core, using claims and policies to gate access via the authorization middleware and implement custom handlers with Startup.cs and authorize attributes.
Learn to implement simple and multi-claim policies with the authorize attribute and authorization middleware, including denying anonymous users, configuring login paths, and handling access denied scenarios.
Implement logout using cookies in ASP.NET Core by calling sign out async, creating a logout page, and a login status partial to show a logout button when authenticated.
Implement a custom policy based authorization by adding an HR probation requirement and handler to restrict the HR manager page until the probation period passes.
Explore how cookie lifetime and browser session affect authentication in ASP.NET Core Identity, and enable a persistent cookie with remember me for longer sign-ins.
Compare token authentication with cookie authentication and see how tokens travel in http headers. Learn jwt structure: header, claims, and signature, signed with a secret key for one-way verification.
The token flow, a web app obtains a token from an authentication provider and uses it in the authorization header to access a web api; cookie authentication is an alternative.
Configure jwt bearer authentication for a web api by installing the jwt bearer package and adding authentication middleware. Validate token claims, signing key, and lifetime, then test with postman.
Create an in-memory identity database by deriving from identity db context, configure SQL Server connection in program.cs, and run a migration to generate the app users database with identity tables.
Create a user registration page in ASP.NET Core Identity by building a Register ViewModel with email and password validation, and post to create the user via UserManager.
Explain email confirmation flow in asp.net core identity by generating a token, sending it via email, and validating it via stored tokens or a self-contained jwt tied to the user.
Refactor email sending by extracting a reusable email service, configure smtp settings via the options pattern from appsettings, and inject the service for async sending.
Implement sign out with the signing manager, inject the signing manager, and redirect to /account/login, updating the layout with the login status partial for ASP.NET Core Identity.
Extend the identity user to collect department and position during registration, update the registration page and viewmodel, and create a migration to add new columns to the ASP.NET Users table.
discover how roles and claims control access in identity systems, compare simple role checks with flexible claim-based policies, and learn when to use each approach for page permissions.
Explore multifactor authentication (MFA) and two-factor authentication by comparing username and password with additional factors like security questions and verification codes from email, text, or an authenticator app.
Enable and implement email-based two-factor authentication in ASP.NET Core Identity by generating and sending an OTP via email, handling the two-factor login flow, and testing with remember me.
Build an authenticator MFA login flow: present the security code after the first factor, validate with two-factor authenticator sign-in, remember me, and manage a user-id cookie.
Enable mfa setup in asp.net core identity by generating a qr code bytes array with nuget qr code package, embedding totp data (provider, user email, secret key) for authenticator apps.
Learn how OAuth enables login with social media by redirecting users to Facebook, obtaining consent, and returning a claims-rich response to the web application.
The course is updated to use .NET 10
Authentication and Authorization are vital components of modern web app and web API development. ASP.NET Core Identity provides a complete solution to achieve this purpose. While it may seem easy to scaffold a solution with a few clicks, truly adapting it to your specific project requirements demands a deep understanding of how ASP.NET Core Identity works from the inside out.
With 5 sections and about 7 hours of high-quality content created by Frank Liu - a senior software developer with over 20 years of experience in .NET development - this course will empower you with comprehensive knowledge and practical skills.
Why Choose This Course:
Clear and logical explanations with diagrams: Gain a solid theoretical understanding of ASP.NET Core authentication and authorization through visually engaging diagrams, providing you with a deeper comprehension of the subject matter.
In-depth exploration: Secure your web app and web APIs without relying solely on ASP.NET Core Identity, understanding what lies beneath the surface.
ASP.NET Core Identity mastery: Learn not only how to code with ASP.NET Core Identity but also comprehend the reasons behind its workings.
Multi-Factor Authentication (MFA): Master MFA essentials in ASP.NET Core, starting with Email MFA and progressing to the use of the Authenticator App.
External Authentication Providers: Discover how to integrate social media login with Facebook as an external authentication provider into ASP.NET Core apps.
You will learn the following topics in depth:
Section #1: ASP.NET Core Authentication and Authorization UNDER the HOOD.
You will start with a solid understanding of the theory of ASP.NET Core authentication and authorization first and then you will be learning to secure your web app without using ASP.NET Identity, so that you know what is under the hood. This builds a strong foundation for you.
Section #2: Securing ASP.NET Core Web APIs
Same idea with the previous section, but here we are securing Web APIs.
Section #3: ASP.NET Core Identity In Depth
Now we are getting into ASP.NET Core Identity. Here you will not only learn how to code with ASP.NET Core Identity, but you will learn all the reasons behind the working of Identity with the knowledge you have just learned in the previous sections.
Section #4: MFA in ASP.NET Core Identity
MFA is a must when you work with a public facing website. Hence, this section is very important. After the in-depth explanation of the concept, you will start with a simpler Email MFA scenario, then moving on to the Authenticator App MFA case.
Section #5: Integrate External Authentication Providers into ASP.NET Core apps
Lots of applications (public facing or not) want to use external social media to manage the user login, so that the applications can focus on the business logic. This section takes Facebook Login as an example and walks you through the steps of using an external authentication provider.
You will master the following technical skills:
What are Identities, Claims, and Principal (Security Context) in ASP.NET Core.
Cookie Authentication for ASP.NET Core Web App.
ASP.NET Core Authentication and Authorization handlers
Policy based Authorization in ASP.NET Core web apps.
Create Custom Policies in ASP.NET Core web apps.
JWT Token Authentication for ASP.NET Core Web APIs / REST APIs.
ASP.NET Core Identity Configuration
Use ASP.NET Core Identity to implement all typical scenarios including: User Registration, User Login, Logout, Email confirmation, Roles vs Claims and User Profile page.
Integrate MFA with Email into ASP.NET Core apps.
Integrate MFA with Authentication App into ASP.NET Core apps.
Integrate Social Media login with Facebook into ASP.NET Core apps.
What you will need:
Intermediate Level of C# or at least 6 months of experience.
Intermediate Level of ASP.NET Core or at least 6 months of experience.
Basic HTML.
You should know OOP and the concept of interface in C#.
You are interested in learning this topic.
You are eager to learn.
Who this course is for:
ASP .NET Core Developers
API Developers
Mobile Application Developers
C# or VB NET Developers
Enroll now to become an expert in authentication, authorization, and ASP.NET Core Identity, and take your web API development skills to the next level! Experience the power of clear explanations complemented by visually engaging diagrams, ensuring you gain a comprehensive understanding of the subject matter. Don't miss the opportunity to learn from an experienced instructor and excel in your career development.