The .NET 8 Auth Changes You Must Know About!

Use code DDD20 and get 20% off the brand new Domain-Driven Design course on Dometrain: dometrain.com/...
Become a Patreon and get source code access: / nickchapsas
Hello, everybody, I'm Nick, and in this video, I will show you how Authentication and Identity have changed in .NET 8 in an effort to simplify it and make it more accessible.
Subscribe to Amichai: ‪@amantinband‬
Workshops: bit.ly/nickwor...
Don't forget to comment, like and subscribe :)
Social Media:
Follow me on GitHub: bit.ly/ChapsasG...
Follow me on Twitter: bit.ly/ChapsasT...
Connect on LinkedIn: bit.ly/ChapsasL...
Keep coding merch: keepcoding.shop
#csharp #dotnet

[@eg8568]

This is such a helpful addition. I recently had to build whole identity system and whilst a lot of the heavy lifting was taken care for me by identity, I had to build the endpoints for generating & refreshing tokens, resetting user passwords, etc. This would have saved SO much of my time.

[@jessecalato4677]

@@ApheliontI'm seriously thinking about this right now.

[@eg8568]

@Apheliont I'd always recommend against implementing your own solution (and said so to my company!), but they didn't want to pay the license fee for Duende. Anyways, deep diving into Identity/Open ID was a good learning experience for me so I can't complain

[@Velociapcior]

@@eg8568 Azure has 50 000 MAU for free on B2C

[@virtualdars]

You are not alone.

[@HarrishSelvarajah]

@eg8568 Why did you not have a look at dunde ?

[@josephizang6187]

This is perfect! I think Microsoft should prescribe the right way of doing things and leave it to devs to customize it in anyway they want. Nice video Nick

[@Paul-uo9sv]

November 14, 2023 ASP .NET Core 8, with its much-anticipated features and enhancements, is scheduled to be officially released on November 14, 2023

[@araz911]

Is this thing secure?

[@SM-tj4jc]

@@araz911 No, it is not.

[@PippiTheLongSock]

I would love to see how well these endpoints could be customized. For example, what if you want to have some custom fields when registering a user (first name, last name, etc). How can you modify the request body? You also need to override the underlying implementation of the given endpoint. Suggestion for you Nick: When all of the new improvements to the way we deal with identity are finally released in dotnet 8, can you create a full course on what would be the modern/recommended approach of working with identity. Because over the years there have been so many ways and it really has become confusing (especially for a beginner). Also, Microsoft have been pushing the Identity UI MVC (or was it actually razor pages, idk) built-in capabilities, which for me was a mistake as the industry is really moving away from the MPAs. I promise I would be the first to buy this course :) Edit: You can even collaborate with Anton from RawCoding because as you know he is very passionate about auth

[@10Totti]

Exact!

[@jomama55ful]

I have to agree. My learning experience with auth was painful at best and has led to a lot of confusion as to best practices. In the end I found using third party solutions was less painful as a rule.

[@mateuszkaleta1495]

That's the point

[@1dfe-4e68-bd9f]

yeah! it's like a marketing feature😅 this is for programmers who like to compare programming languages by writing helloworld application )) loook, in python enough "print('hello')" in c# it needs so many codes like (class program { static void Main(string[] args) { Console.WriteLine('hello'); }😂😂

[@elpe21]

I guess you have to scaffold the endpoints and do what's necessary. Additional fields most likely is just a matter of adding properties as those endpoints will work on T where IdentityUser

[@SnOrfus]

This is definitely great, and a move in the right direction. That said, in the enterprise, it’s extraordinarily rare to build authn as part of your API like this. You’re almost always integrating with a 3rd party IdP/oidc/saml, and that integration is equally annoying.

[@rzaip]

Yea, I was just thinking if this could replace IdentityServer and came to the same conclusion that this is mostly for single apps that doesn't require oidc or single sign on.

[@jeffbarnard348]

This is great for small projects, but it's not OAuth2.0 and OIDC standardized. We'll still need to integrate OpenIddict or IdentityServer for full compliance

[@Jared-150]

I've been using OrchardCore just for its out of the box OpenIddict.

[@TheProTip]

My other comment got deleted because I linked the repo.. There is code in the Asp Net Core project for handling OIDC flows (including I believe opaque tokens). If you don't need to be an IdP it's all buried in there and you can scaffold out the UI and see the stuff in action via the Razor pages right now.

[@shanemonck3225]

second this, very correct

[@carson8417]

yeah they destroyed the authentication that we actually need

[@ExpensivePizza]

I literally just manually coded something like this a couple of weeks ago. This would have made things much easier. I would love to see more content around this topic on the different token types, how to integrate it with front end frameworks like React and Vue and different backend databases like MongoDB.

[@luis1118]

Hope the new documentation will be clear about the addition of social login options 😬

[@hemant-sathe]

It’s great to see the improvements and also encouraging to see David Fowler replying to questions. Loving it. Is it possible to set up an independent auth server with this to be shared across multiple services? Also does this work with other third party systems like social login and azure Active Directory? Can we map the user with any Active Directory attributes like email, name, groups etc?

[@Zenoc2]

+1 here wondering whether this can be used with an independent auth server for multiple services!

[@eg8568]

@marklnz why wouldn't you call the extension method to add the endpoints? Functionality such as resetting user passwords etc would likely still be needed

[@SlugiuesRex]

Also, are there any improvements in net8 that work more efficiently with Azure Functions ??

[@hemant-sathe]

@@marklnz I tend to favour Azure AD instead of local auth db. Azure B2B can be overkill at times but then you don't need to worry much about the authN functionality.

[@cn-ml]

1:57 like that reference 👌

[@fifty-plus]

Finally, I've been using this since it dropped instead of writing a ton of custom code. Very nice.

[@luigicfilho]

For my case, I'm going for another approach, because the token get exposed in the client, any script on the browser has access. This can be a great idea to do a new video about the "backend for frontend" :)

[@d0neall_]

What approach did you go for? Have a video?

[@luigicfilho]

@@d0neall_ I use the backend for frontend approach, I don't think there is an video about it it's pretty new

[@virtualdars]

This is great! In this example the protected endpoint resides on the same Auth microservice (with RequireAuthorization()). Nick, can you please show us another sample of the separate API service that performs validation of the access tokens issued by this Auth service? Thank you!

[@drrd5145]

Would love to see that! I'm looking for an example in .NET8, where I have a service that is used for login/token authentication and other API (separated service) that will use the token to call the service. Looks like any example assumes that the services API are the SAME as the authentication API.

[@keesdewit1982]

@nickchapsas Please note that the default implementation of IdentityUser (used in this video) uses a string as Id which turns into a NVARCHAR(450) as primary key. This is terrible as it will lead to fragmentation because they don't insert records in a sequentially increasing order. This can lead to increased page splits and fragmentation within the database, potentially degrading performance over time as the database grows. To solve this and turn it into (for example) a integer primary key, the MyUser should inherit IdentityUser and the DbContext should inherit IdentityDbContext This will turn all primary keys into incrementing integers which are inserted in the right order.

[@RebelliousCanadian]

Love this update. Wonder how good this works with Swagger/OpenApi and more clarification between this and a JWT bearer tokens?

[@kabal911]

Will be seamless with Swagger, they are just endpoints. I’m guess that the difference is that this token is not base64url encoded, and does not contain client readable info, unlike a jwt

[@sikor02]

@@kabal911I don't see these endpoints in swagger edit: I had to add builder.Services.AddEndpointsApiExplorer(); builder.Services.AddControllers(); I worked on blazor dotnet 8 app and it wasn't included by default.

[@microtech2448]

That's great that it is out of the box now. It would be nicer if it could be jwt format

[@MaximilienNoal]

Finally ! It was such a headache.

[@thechrisgate]

True

[@nepalxplorer]

Yes

[@rogeriobarretto]

Is a great step forward. But the must annoying thing for me is the dictatorship on how my Authentication Tables needs to be setup (migrate). It is very common to change a new project where there's already a Database Model in place, some simple scenarios where there's only a Users table with Email and Password. Would be great if we were able to setup the Authentication in that Stupid Simple Lean approach (where you could specify what is the table and how complex you want your authentication to be, (include refresh tokens, hashed passwords, etc)

[@davidfowl]

You would want the auth system to work with any database schema? Or would you augment the schema for the identity system? I think a better solution would be to provide more building block when the database schema is fixed. Another option is the use the identity schema as standalone and link it to your user table via foreign keys.

[@dave7038]

Yup. Most of the systems I work on are 20+ years old and we don't have a lot of flexibility to update user stores (they are accessed or managed by many other systems). I have yet to work on a project where the built-in auth schemas are used. The direction I took was to create a class implementing Microsoft.AspNetCore.Identity.IUserPasswordStore and IUserLoginStore and a class implementing IRoleStore that I register as singletons and that handle interfacing with our user and role store (which in some cases is just an INI file with some username=scrambledPassword pairs under either [admin] or [user] keys), and then services.AddIdentity() connects my custom user and role stores with the identity system (I could probably also use the .AddRoleStore(), .AddUserStore() extensions on .AddIdentity()). We don't usually need the other features due to the nature of the systems we're working with, but implementing the stores for tokens and claims is similarly straightforward. That seems to work well, is very flexible, and fairly painless to set up. It would be great to have some guidance on how (or when/whether it makes sense) to integrate some of these newer options with custom stores that have limited feature sets.

[@victor1882]

I wish they had gone with OpenIddict, but I guess they don't want another IdentityServer situation and that it would be a competitor to Azure AD (or Entra, I don't know anymore)

[@saicharan1000]

I just needed this for what I am building. Thanks a lot.

Looks great I just hope there is enough customization possible and (more important) that the documentation for customization is well written. Are there also razor pages/blazor templates for UI variants of the endpoints?

[@dyakobaram]

i wish they also made seeding admin accounts easier with roles and claims. can you make a video about it?

[@arjix8738]

If by seeding you are talking about creating the default admins, then you can do that before you run the app. You can manually create a scope and get the db context.

[@andrewcolleen1698]

@@arjix8738that’s problematic if your app is distributed

[@z_prospective160]

this is usually done via a post deployment script. if using ef core migrations you can do this in your db context class.. you can do this in your "OnModelCreating" method via the "HasData" method.

[@jerryjeremy4038]

I really like it. Thanks Nick. I hope you create a video about this in full details and features.

[@marijnfeijten]

For one of my projects I was looking into doing this myself and thought it would be a pain to setup. Then I saw that Microsoft was adding this and it looks really cool. Thanks for explaining yet another great topic!

[@jjeffh]

StartingAsync! I think that solves a problem (a dirty background service hack like you mentioned) for me. Thanks!!

[@jeffjones9502]

This is awesome! After setting up auth so many times this will definitely help streamline and make the process easier.

[@LordCoon159]

It looks great and spent so many hours with identity in last few years. However, one of the thing which i am still missing is some kind of the way to invalidate at least refresh token. This basic behavior is simple but it still require additional work from us. I always implementing logic for validation of user every time when you use refresh token and also logic which is validating users in database at least once in every 5 minutes. My reason is that I am mostly working on closed systems where it's really important to kick users out of system almost immediately when admins decide to remove their right to be there.

[@AhmedAymanM]

7:39 I love how you roasted microsoft, which created this auto refresh token generation, in 2 seconds 😂😂😂😂

[@souleymanembengue5989]

Good but It would be better to implement standards OAuth and OIDC but Microsoft does prefer to sell Azure Active Directory...

[@ZimTachyon]

You deliver excellent and relevant information which helped me a lot. Thank you.

[@alex.semeniuk]

Nick, you are doing a great job! Keep it up.

[@WTHBrou]

How extendable is it? For instance, doing the classic step to use BCrypt or Argon instead of their default hash implementation? All it leaves is the authorization setup side to do? So far I find it pretty awesome. A huge facade made by Microsoft which certainly solves the complex setup it requires to properly create your own Identity Server. I don't remember how many times I have recalled to the documentation and guides when setting up one of these. Marvelous move done by Microsoft.

[@lukegordon4734]

Pretty easy to use bcrypt or argon2 with this. You just specify the password hashed singleton for the DI to use (I’ve done this for both already)

[@jasonsteelj]

It's a nice step, but they need a full example of authentication with SPAs, one that doesn't involve identity server/DUENDE. I don't need a whole identity server. I just need login on the local app.

[@TheProTip]

Cookies are the way, it's not clear to me from this short overview that it's setting the cookies though. I know that David knows that though based on the GitHub issue, so it probably has support for setting cookies in there some where.

[@Paul-uo9sv]

That's great video. Thanks. November 14, 2023 ASP .NET Core 8, with its much-anticipated features and enhancements, is scheduled to be officially released on November 14, 2023

[@brandonpearman9218]

I'm always worried about customization with black box magic because it looks simple until you use it in the real world. if I have to work on a system that implements this, how long will it take to figure out how to customize it. For example I may need to send an email on register, or maybe I need extra data on register to setup a relation to another entity.

[@benjamininkorea7016]

Well, i think the idea is that you can call the API from anywhere in your server-side logic.

[@todorkatsarski7487]

I loved that Doug reference. THIS is awesome content.

[@dukefleed9525]

...a step in a right direction! Previous "web" authentication/authorization from Microsoft was very wrong. This is something better, but there is still a lot to improve. See, authentication/authorization can be done in a lot of different ways, the lack of usage of interfaces and also the fact that appears to be "all or nothing" is still quite wrong. A problem like authorization/authentication should be treated as much as orthogonal problems as possible. This requires a very profound redesign, and even if the proposed solution is very handy in simple scenario, i dubt it can be adopted for advanced things (imagine a system where the grants are added to the user and the UI have to respond in near real time using a gRPC channel with JWT bearer and an event sourced database as storage.... i dubt this thing could do it)

[@allothernameswherealreadytaken]

Fantastic! I wish they had implementet the passkey auth though.

[@AceSyntaxx]

I'd appreciate some explanation of how this integrates with other identity providers, Facebook, X etc. This looks like oidc/oauth, but you say it's not JWT, which bothers me. Could you enlighten me?

[@kawamustudio]

Oidc and oauth protocols does not require token to be in JWT format.

[@ARumGremlin]

I would love to see a video on how to lock down an API with Azure AD authentication. I just went through the horror of doing it myself and the documentation for it is woefully confusing.

[@SaltySquirrel12]

+1. Would like to see this in action with Azure AD

[@hemant-sathe]

Normally you would have to create an app registration and provide the client id, tenant id & secret. Then you set it up for a 302 response instead of 401 and you are mostly done. Postman documentation is also decent to explain how to set it up and how to add the postman return url in the app registration. The set up for an app like angular can be messy though. I find having our own UI for login more complex to set up in a typical SPA + API scenario.

[@aremes]

it seems to me like this system is entirely designed for when you want to provide your own user-management/authentication solution. With AzureAD (or MS Entra, now, because i think Microsoft has a renaming-things fetish) you dont have to do any of that, You use good old OAuth2 with maybe a little OpenID sprinkled on top. And that stuff will *always* be confusing. I've implemented it, I've taught it, I've written documentation for it and trust me: "Simple" and "Authentication" just dont go together. You just cant secure an API using *any* identity provider without some serious requirements introspection (i.e. what clients do you want to support, what level of security, where does your config live, etc.

[@fabiolune]

Totally agree. In my (could be limited) experience, it's rarely a good idea to create a custom authentication system. On top of security, there's also a huge amount of regulation compliance that can easily become a nightmare. So, while I appreciate the effort, I don't think I will ever use it in this way: better to rely on some authentication provider using a robust standard.

[@eg8568]

I recently did this for a client and automated it via IaC / Bicep files. The documentation for both was dreadful and made it doubly confusing, I feel your pain.

[@btogkas1]

What would be nice to have would be 1. Invalidating the token (one login, locking the user) 2. Ability to see online users. 3. Dynamic ACL based on user rights - role rights

[@Daanik8]

I liked the humor! 😂 But hey Nick, it would be great if you show how to integrate this identity authentication and authorization with keycloak!

[@Ballebone]

Ha! I was going to beg for the same thing! All of our apps require KC use. Scopes and refresh are an added bonus!

[@bitmanagent67]

This shit is still complicated. We would have never figured this out on our own. MSFT consistently convolutes approaches because they have this spaghetti against the wall mentality of refining features. Back in the day we used to have property panes and dialogs to configure options. The changes were made in the background for you. Now they basically said fk you to powerful tools and followed the rest of the open source community down the "type all your setup and config into a file" rabbit hole.

[@iSoldat]

Can the new auth changes accept the AD as a user store? if so, how about mapping membership groups or custom AD properties in claims?

[@viniciusmelquiades]

C# has changed a lot since I last used it. If I ever go back to backend, I'll probably use C#

[@AntiPolarity]

Hoping that they will integrate it into blazor

[@sokoo1978]

There will be a new scaffold for Blazor in .NET8 RC1.

[@sokoo1978]

@@marklnzIt will be obviously server rendered.

[@felipepassion]

thanks u.u @@sokoo1978

[@felipepassion]

you can try with webassembly. i was working with .ney7 with duende, ait it was a nightmare. then i can think now to replace the replacement that i used to replace duende 1 year ago in my server side. It's all about the server side. it's obvious.@@marklnz

[@sokoo1978]

@@marklnzI think you misunderstand.. RC1 will be able to create you the client template like MVC did before. It will have the basic functionality and pages/components to register, login, have the basic header with the auth and user info. In many applications this is actually good enough, like intranet apps where Windows user is not applicable. The logic is all server side (like hosted WASM in current version).

[@KobeBlackMamba24]

Perfect…just perfect. .Net really stepped up their game

[@KobeBlackMamba24]

As usual

[@ryanobray1]

I think this is great simplification. I do have some questions though. First, is it safe to assume that .net 8 is using data protection under the hood for managing the certs used to mint the JWT? If so, is the only out-of-the-box way to implement this in such a way that it's cluster safe, to enable sticky sessions on the load balancer? I could see that becoming problematic with long living tokens though. I'm curious to know the best practice for implementing this in a cluster because unless Microsoft has added more options since I dug into it deeply, data protection isn't all that easy/reliable to implement in a cluster without just using sticky sessions. I once wrote my own SQL server solution for hosting dp keys, but it was difficult to avoid timing issues. I had to use locking techniques to prevent failures when all nodes in the cluster were spinning up at the same time. I had to role my own because the MS sql server dp provider didn't properly handle that very concern.

[@davidfowl]

1. It is using data protection yes. 2. The token is not a JWT, it's a different format. 3. If there are still timing issues with data protection providers, we'll need to fix them, these tokens are on top of that subsystem.

[@ryanobray1]

@@davidfowl Thanks for the response. I did catch in Nick's video that he said they aren't JWTs, but then the tokens in the login response looked a lot like what you get back in the OAuth OIDC client flow, so my brain went to JWTs. If I remember correctly, the easiest way to recreate the SQL Server DP provider timing issue was to stop all the nodes in the cluster, delete the DP keys from the database and then start the cluster. In my case, I was using Cloud Foundry with an app that I scaled up to something like 10 nodes. Even though I know the DP subsystem has some level of control around how nodes handle key rotation, I wanted to see what would happen if multiple nodes in the cluster were trying to create new keys at nearly the same time. The result in my test was that some nodes ended up with different DP keys than others because the SQL Server DP provider doesn't do any locking, which I believe could be necessary. The DP subsystem tries to get a key from the provider and if it doesn't exist, it tries having the provider write/save the one and then calls the get method again. If multiple nodes fail to get a key (because a write/save hasn't yet completed), each of those node's write/save key method will be hit, which can result in some nodes having different keys. It's pretty fringe case but was still concerning enough for me to write my own SQL provider for DP.

[@uflidd]

That was just a ton of tables and magic 😮

[@GlebWritesCode]

Really helpful. Is there an option to get this working so that Identity endpoints are not in minimal API fashion?

[@EzequielRegaldo]

Where is the secret or cert? Can we change endpoints names? Can we choose features instead get all or nothing? Can i do an authentication server with this out of the box or integrate this ?

[@cjt9150]

Good work. Can you please create a video for custom authentication with cookie/local storage/session storage & without identity

[@socomjoy4563]

Need this, too 😲 with some other stuff like persistence (e.g. pressing F5 will log you out in Blazor Server) ... - never found a working solution for this

[@blackpaw29]

Really interesting, much more than I was expecting. Do you know how difficult it would be to link to an existing user database, rather than creating one from scratch?

[@nilswierling5899]

Hey! What do you think about CQRS Pattern with EF ? Any experiences on that topic? And is there maybe a Video comming from you about CQRS?

[@TheSpruut]

great video, thanks Nick

[@LifeWithSeb99]

What's really helpful! What should I do if I don't need some of the endpoints? For example my API won't use 2 factor authentication

[@hevymetldude]

Love the Doug DeMuro cameo.

[@mrkjartanvalur]

Is it possible to override e.g. the login method for custom logic like logging or add custom claims

[@muzammilghani2492]

Great video Nick 👍🏻

[@TaiNguyen-gb1pr]

Great video! How to customize register endpoint, because maybe we need more field, ex: phone, avatar...?

[@nickchapsas]

Simply add the field on the user object

[@jesperkped]

Can you show how to do it from a blazer wasm client calling the API?

[@z_prospective160]

I like these features.. however, I think it is better practice create an centralized identity management solution that many apps can consume.

[@parlor3115]

Does it support storing the user session in the database in case the token needs to be invalidated?

[@hananiahlinde1377]

My favorite part 7:40

[@ethanford9678]

Love the Doug DeMuro reference :D

[@88spaces]

They removed the pain from setting up bearer tokens. That alone is worth using it.

[@myhjrhfgnb]

Saves devs setting up many things, that is a boom

[@CryptoWulf_app]

This scenario is only intended for when your service also functions as an auth-service and not when you use an auth-provider like Azure AD/Azure AD B2C, right?

[@ManuelPerez-cn2fj]

Loved the "except for Microsoft" comment! xD

[@allenn9068]

Great intro to this new feature. Echoing questions about generating and customizing UI for AspNet, Blazor, or SPA frameworks. Wondering if there are templates to start with. Looks perfect for a simple personal web site that has auth for an admin area or customer/client features. Wondering if it can be used for a Generic Host as well as for a Web Host. Will have to try it. Looks good!

[@drewkillion2812]

I wrote many of the endpoints myself. I'm a happy I don't have to do it anymore

[@antonmartyniuk]

Wow, that so much code I was writing before. It's so great. I wonder if any endpoint can be overriden with custom behaviour? And does this out of the box support refresh tokens if the same user is logged-in with multiple devices?

[@SvdSinner]

How it will work with an enterprise identity server like Auth0?

[@lucaciandrei]

Do you have info / video on how to set this up properly as a JWT? Is this also out of the box (configuration only)? Or should we add extra code for that?

[@poojamahtha2780]

Wow ! Such a great video.

[@joelm.artins]

Great video Nick! Was wondering what if we need to add a few more properties to the user? How easy it is to customize to also add them to the request?

[@haxi52]

Would like to see what happens when you start filling out the user class. Does it support complex types?

[@nickchapsas]

Yeap

[@TheMeatySurprise]

Now they just need to fix the authorization framework to allow for parameters to be passed in the Authorize attribute so you don't have to define dozens of schemes to support different required claim values. That would be great

[@aslanamca8225]

Why not JWT?

[@benjamininkorea7016]

I don't understand. Are these API endpoints only accessible from onsite? What's to stop someone from batch-creating a million accounts using the register endpoint?

[@systemslave510]

Now how to make it work with dapper?

[@shahzshafie]

very helpful.. would like to know how .net8 can be integrated with a 3rd party IAM provider like Auth0...

[@vasilisplavos]

Thank you so much Nick for your informative video. I was wondering, what options do we have if we want to sign in users with phone number or anonymously? Google is providing these options out of the box with a PaaS solution! Do we have something similar here?

[@tanglesites]

This is a game changer and such a time saver!

[@krzysztof808]

This is heplful in the simple scenarios without more complex token business logic.

[@sikor02]

adding few social login providers and merging that with local account would be nice. But I guess the 3rd party integration requires redirection at some point so no single API call will handle this, right?

[@kabal911]

This already is supported. If your identity username is the same as your social username (usually email address) then you can login with either. If they have different usernames, then you would need to do something to allow an authed user to then link a social account - which I haven’t tried, but should be simple enough

[@leoravilo2812]

Oh god... I waited for that for so long... Finally !

[@JKhalaf]

Can you please do a video on how to setup .NET 8 with AWS Cognito with the Blazor auth scaffolding pages?

[@atur94]

That is so freaking awesome. Finally

[@_curtman]

Can't wait for .Net 8 to be released.

[@felipepassion]

AWESOME! no more duende-paid framework to anoy us. Thanks .net 8!

[@freigeist2147]

this is very cool, only one question, where do I get then the email confirm code from, to send it over Email to the user. This flow is not clear after the video, bit this would be I think to much for a 10 min video. Thanks a lot !!

[@freigeist2147]

Also the refresh token as a JSON and not as a HTTP-ONLY Cookie could be a little dangerous.

[@KonradGaska]

Just wondering how often would you really use it? In majority of current applications identity comes from external identity providers and you don't have to bother with stuff like user registration, etc. It is still cool that this was simplified though.

[@therealdebater]

Yep. The only thing that really strikes me is that MS should have done this about 20 years ago :-)

[@kagishophahlamohlaka2306]

This is mind blowing!!!

[@mightypirate100]

Thanks for the video. Question: How to customise the register and login endpoints to accept user id instead of email? Thank you

[@TonyKenny-u5h]

This is a great iintro, thank you, but where is the signout URL? I can't find it in the source or the documentatioin

[@keithealanta7790]

That's really useful. I wonder if there's an easy way to get it to use JWTs by default (I'm sure it's possible to rewrite overall, I'd just love to be able to set a flag for that, as we use JWTs in the rest of our system, and it would be ideal to maintain compatibility/)

[@ModBay]

Game changer I think. 🎉

[@jiM3op]

yo nick... this is great! How would this work with Windows Authentication for like Intranet Web Applications?

[@nothingisreal6345]

The issue is not and was never a lack of supporting libraries. The issue is that you need to combine many classes, libraries, configuration, concepts... And for MOST developers they do something as basic as authentication once in year's. Otherwise, they hopefully focus on productive tasks providing business value (nobody pays anything for your app to have authentication working.). Authentication, Authorization - plumbing! MS should really create a "wizard" in VS that supports initially setting up authentication and also later change authentication. This will be better put NOT in code but in some (XML) configuration file that will generate some code (you must not modify). Covering 80% of the cases can be achieved without having to generate any specialized code. For those who need something more sophisticated - go with the coding approach. @Nick: it would be a business idea to provide a service that offers implementing these plumbing features for projects. Instead of thousand learning how to do it themselves - simply buy the support for a couple of $.

[@Miggleness]

you lost me at XML

[@davidfowl]

This is why there are fully self-contained auth solutions that you can pay for 😁

[@victor1882]

that brought back some 2005 (bad) memories