Authentication and Authorization in ASP.NET Core

Prerequisites

To get the most from this workshop, you should have:

• Basic knowledge of ASP.NET Core (equivalent to my ASP.NET Core Fundamentals workshop)
• Solid understanding of C# including LINQ and lambda expressions
• Understanding of the HTTP/HTTPS protocol and web fundamentals
• Visual Studio 2026, or another .NET IDE that can run ASP.NET Core 10
• The workshop assumes you use Windows. On macOS or Linux, see the FAQ below.

What You’ll Be Able To Do

After the workshop, you can:

• Implement cookie authentication from scratch, without black-box libraries
• Create ClaimsPrincipal and ClaimsIdentity objects to represent users
• Configure the authentication middleware and follow how it processes each request
• Use the authentication operations: Challenge, SignIn, Authenticate, SignOut and Forbid
• Explain authentication schemes, tickets and how the cookie handler works inside
• Set cookie and ticket lifetime, persistence and renewal for different security needs
• Customize the cookie handler with event handlers
• Apply role-based, claims-based and policy-based authorization
• Write custom authorization requirements and handlers, and use resource-based authorization for fine-grained access control
• Debug authentication flows with Fiddler
• Protect your applications against broken access control

What Is Included?

When you take the Authentication and Authorization in ASP.NET Core workshop, you get:

• Workshop Material:
  I wrote the material myself and update it regularly to follow current practice. You get the presentation and the exercises as PDF.
• Hands-On Exercises:
  You apply each concept in practical exercises during the workshop.
• Ongoing Support:
  During and after the workshop, access a private chat for additional resources, questions, and updates.
• Live and Interactive Sessions:
  Ask questions in real-time via chat or audio and get immediate clarifications. I also give live demonstrations.

Who Is This Workshop For?

• ASP.NET Core developers who want to understand how authentication and authorization work.
• Developers moving from ASP.NET Framework to ASP.NET Core.
• Backend developers who are responsible for the security of web applications.
• Developers who plan to use ASP.NET Core Identity, OAuth or OpenID Connect and want to learn the foundation first.

Workshop FAQ

What topics are covered in this workshop?

This workshop focuses on local authentication using cookies and the core ASP.NET Core authentication and authorization infrastructure.

You’ll learn cookie authentication, claims-based identity, the authentication middleware, and both basic and advanced authorization patterns.

What topics are NOT covered in this workshop?

This workshop does not cover external authentication providers (Google, Facebook, Microsoft), OAuth 2.0, OpenID Connect, or ASP.NET Core Identity. These topics build upon the fundamentals taught in this workshop and are covered in my other workshops.

To learn OpenID Connect and OAuth, see my Introduction to OpenID Connect and OAuth workshop.

Is this workshop suitable for beginners?

This workshop assumes you have basic ASP.NET Core knowledge. If you’re new to ASP.NET Core, I recommend taking my ASP.NET Core Fundamentals workshop first. However, no prior authentication or security experience is required.

What version of .NET is used?

This workshop uses ASP.NET Core 10 and .NET 10. The concepts and patterns taught apply to earlier versions as well, though some API details may differ. To see what changes in .NET 11, read my blog post What’s new in ASP.NET Core authentication in .NET 11.

What if I am using an older version like .NET 6–9?

You can definitely still attend. The foundations of authentication and authorization have remained stable across recent versions. Most concepts (cookies, claims, and policies) apply directly to .NET 6–9. I will highlight the few areas where .NET 10 introduces specific API changes or new features.

Why learn cookie authentication when Identity and OAuth exist?

Understanding cookie authentication gives you the foundation to work effectively with any authentication system.

ASP.NET Core Identity and OAuth/OIDC providers are all built on top of the authentication and authorization primitives you’ll learn in this workshop. This knowledge helps you debug issues, customize behavior, and make informed architectural decisions.

Is this workshop live or recorded?

It is live and instructor-led, and it is not recorded. I teach it in person or online, usually in Zoom or Teams. You’ll have direct access to me for questions and discussion throughout the workshop.

Can the workshop be customized for our team?

Yes, I offer private team sessions where the content can be adjusted to focus on topics most relevant to your organization. Contact me to discuss your specific needs.

Will there be exercises?

Yes, this workshop includes an extensive set of hands-on exercises integrated throughout each module. After most topics, you’ll complete practical exercises that let you apply what you’ve just learned. More than half of the workshop time is hands-on work.

Do I need any special tools?

You need a .NET development environment that can run ASP.NET Core 10 (such as Visual Studio 2026 or another .NET IDE) and an HTTP/HTTPS debugging proxy.

The demonstrations and exercises use Fiddler Classic, which runs on Windows. On macOS or Linux you can use another proxy and still follow along, because the concepts and workflows are the same. Common alternatives are Fiddler Everywhere (commercial, with a trial), Charles Proxy, Proxyman and HTTP Toolkit. I can’t give tool-specific support for these.

Prefer to learn on your own? My self-paced video course on the same topic, Getting Started: Authentication and Authorization in .NET, is available on Dometrain.