ASP.NET Core SPA Authentication Tutorial (.NET 7 Minimal Apis C#)

🕰 Timestamps
00:00 Introduction
01:34 Same Domain
05:45 Separate Domains
13:20 SSR Framework
18:24 Bonus: user information call elimination

👉 Try Rider
RD5K9-4TXXW-KMV3G-NYWSF-3ZSTP

#aspnetcore #authentication #cookies

[cocoscacao]

There could never be enough auth videos

[saurabhumadikar]

This helped a lot... Thanks a lot for making the video series on Authentication!

[alexanderbikk]

Hey Anton, nice content and the whole Auth playlist is just incredible.
It's been a while so I don't expect your answer, but I'm still wondering about a few things

1. When SPA and API are on different sub-domains SameSite=Lax and enabling CORS should work well as in your example.
2. However when my SPA and API are on completely different domains I guess I need SameSite=None and CORS, otherwise it won't work, right? In that case, I have to enable anti-forgery token generation for my API and attach it to every Response + verification of it on the API side. Without SameSite=None it won't be possible to share the cookie across completely different domains, correct? And when SameSite=None we are vulnerable to CSRF attack so anti-forgery is a must.

Thanks

[Computer_Gig]

Dude great tutorials! Could you record a vid on elastic search implementation and visualization with kibana? Cheers

[RatebBarakat]

Thanks for this series, i have a question, do we need csrf protection in this case when we are using cookies for authentication, even if cors is exists, can a mobile app or let's say a non browser app that doesn't respect cors access or make requests?

[prouleau]

Interesting domain separation representation on the wall.

[wdorsett]

Love the authentication series. In your opinion, would it be best to create a secure cookie on the backend rather than on the frontend vue app for example? Are there limitations with creating the secure cookie that's available across subdomains in a Vue app?

[joshem]

Thanks so much for all this material, question, would it be complicated to add role based authorization?

[lasindunuwanga]

great video!

he says spa, I say S P A

[YPLabs]

This is Awesome, how to achieve this with something like WS-Federation SSO?

[straddlescout]

Great video! Any thoughts on making a video on GraphQL?

Hey Anton, how are you? I have a question: For OAuth can we follow the same approach? Or we will need something specific? With your tutorials and explanations I''m trying to build my own auth server and use it for all my applications (like a firebase, but just for personal use and free hahaha) Thank you so much for your content! Off question: are you a communist? hahaha you are quite humble it seems like my communists friends

[markogrdinic]

How would you do 3rd party authentication with same domain SPAs? I am just wondering if this would be possible without having the user leave the page. I know I could just start off the app by having the user login into Azure AD, and then on success redirecting it to the main SPA app, but I want to know whether it would be possible to have the user login using a 3rd party at arbitrary points without having it leave the page which would cause the client state to be invalidated.

[prathameshshende]

Can we secure Blazor wasm like this without Identity Server 6

[pispis]

Акцент такой знакомый
Родом из стран пост советского пространства?