The Ultimate Authentication Course with C# and Svelte

Set up the project in Visual Studio 2022 Community Edition, create an ASP.NET Core Web API with C#, install EF Core packages, configure .NET 6, and run on port 8000.

Set up the database with Microsoft SQL Server and Management Studio, connect to the database, and add the default connection string to app settings json.

Create a user model with id as key and properties for first name, last name, email, and password; map front-end names, configure db context with users DbSet, and run migrations.

Create an api controller with a register endpoint to receive user data and test with postman. Define a registered dto for first name, last name, email, password, and password confirm.

Educate on registering users by serializing DTO data, validating password confirmation, saving to the database with an ApplicationDbContext, returning the user, and verifying via Postman.

Add a JSON ignore attribute to hide passwords and hash them with SHA-256, storing only the hash and excluding it from API responses.

Create a login flow with a login detail data transfer object (email and password), load the user from the database, validate credentials, and return user data or unauthorized status.

Create a JWT with user id and expiry in app settings. Generate access and refresh tokens secured by signing credentials and secret keys; store the refresh token in a cookie.

Enable cross origin resource sharing by adding middleware to the http request pipeline, allowing ports 3000, 8080, and 4200, any header or method, and credentials for cookies.

Extract the authorization header and access token, then decode the token to obtain the user id. Retrieve and return the authenticated user from the database, handling unauthenticated cases.

Learn to refresh a 30‑second access token using a post refresh request and a cookie-stored refresh token, decode the token to verify identity, and return a new access token.

Implement a logout controller that handles a post request by checking the refresh token cookie, returning 'already logged out' if absent, or deleting the cookie and confirming logout.

Implement secure logout by storing refresh tokens in a database, creating a user token model, applying migrations, validating tokens on refresh, and deleting tokens on logout.

Implement forgot and reset password flow by adding a reset token model, updating the database context and migrations, and creating forgot and reset controllers with a forgot DTO.

Test the forgot password flow by sending a reset link via smtp using mail hog on port 1025, configure the smtp client, and verify the reset email is delivered.

Explore the reset password workflow using a reset token, dto validation, password hashing, and database updates, including email-based reset links and success verification.

Set up the front end using the WELD framework, install dependencies with npm, configure TypeScript for Svelte, and run the dev server to preview the app.

Create navigation routes in a Svelte app by configuring home, login, and register components, using a router and link components, and noting URL slash and SEO implications.

Install the package, bind Svelte inputs for first name, last name, email, and passwords, preventing default submission. Post with Axios to the backend and redirect to the login page.

Log in with the registered user, obtain the refresh token as a cookie, receive the access token in the response, and set the authorization header with a bearer token.

Make an Axios call on mount to fetch the authenticated user, then display the user's name and use a refresh token to renew the access token when needed.

Learn how to use axios interceptors to refresh tokens automatically: implement a refresh token flow, handle 401 errors, set authorization headers, and retry failed requests.

Implement a logout button in a Svelte app using onMount and axios to call logout, remove the refresh token, and ensure a single refresh flow avoids infinite loops.

Implement a centralized authenticated store to manage login state and updates for 200 and 401 responses, ensuring the user is requested once and the logout resets the authorization header.

Explore building a forgot password flow in a Svelte app, sending a reset link via email and handling user notifications with an interactive login and navigation components.

Build a reset password flow by creating a reset component, obtaining the token from the url, collecting password and confirmation, posting to reset, and redirecting to login.

implement two-factor authentication by updating the user model with a secret field, adding a two-factor controller, and generating a base32 secret and an otp url for google authenticator.

Create a two factor DTO and wire it into the two factor controller to validate the authenticator code with the Google Authenticator package, set the secret, and generate tokens.

Learn a two-factor login flow in a Svelte app, splitting the login and authenticator forms, dispatching login events with user data to drive the QR code generation.

Implement an authenticator form in Svelte that captures six-digit codes, posts data to factor authentication with axios, manages cookies and access/refresh tokens, and sets authorization header.

Practice implementing two-factor authentication with QR codes in a C# and Svelte app. Generate a QR from user data, scan it on a phone, and export the value for login.

Implement Google sign-in with C# and ASP.NET Core 3 by configuring credentials and validating tokens. Map Google users to your database and issue access and refresh tokens.

Learn to implement Google authentication in a Svelte app using the svelte social oath, including setting up client ID and sending the ID token to the backend with Axios.