Getting Started: Authentication and Authorization in .NET
My on-demand video course on Dometrain. It shows what happens inside ASP.NET Core when a user signs in, and how you decide what they get access to.
Who Is This Course For?
For .NET developers who build on ASP.NET Core and want to understand how it handles sign-in, cookies and access control under the hood.
The course is specific to ASP.NET Core and starts from the fundamentals. The first section sets up Fiddler and HTTPS, so you can watch the HTTP traffic yourself. You watch it on Dometrain, at your own pace.
What the Course Covers
I start with the basics: the User object, the ClaimsPrincipal and the request pipeline. Then I go through the authentication middleware and its five operations (Challenge, SignIn, Authenticate, SignOut and Forbid) and the internals behind them: schemes, authentication properties, the authentication ticket and data protection.
Next is the cookie handler, its event handlers, and how long cookies and tickets live. The rest of the course is about authorization: simple, role-based, policy-based and resource-based, with custom requirements and handlers, authorization filters and view-based authorization. Advanced Authorization is the longest section, at about 2.5 hours.
Course Agenda
- Course overviewWelcome; What will you learn in this course?; Who is the course for and prerequisites
- Getting StartedCourse Material; Installing Fiddler; Fiddler and HTTPS; Exploring the starter project
- FundamentalsThe User Object; Creating a ClaimsPrincipal; The Request Pipeline
- The Authentication MiddlewareIntroduction; Authentication Operations; Challenge; SignIn; Authenticate; SignOut; Forbid
- The Authentication InternalsSchemes; Authentication Properties; Authentication Ticket; Data Protection
- The Cookie HandlerIntroduction; Challenge; SignIn; Authenticate; SignOut; Forbid
- Cookie and Ticket LifetimeSession Cookies; Persistent Cookies; Persistent Cookies Using Max Age; Ticket lifetime; Ticket Renewal; Choosing Cookie and Ticket Lifetime
- Cookie Event HandlersChallenge, SignIn, Authenticate, SignOut and Forbid Events
- AuthorizationIntroduction; Authorization in ASP.NET Core; Simple Authorization; Role-Based Auth; Policy-Based Auth; Broken Access Control
- Advanced AuthorizationRequirements and Handlers; Resource-based Authorization; The MVC filter pipeline; Authorization Filters; Custom Authorization Attributes; DefaultPolicy and FallbackPolicy; View-based authorization
- Course conclusionConclusion and next steps
Want This for Your Whole Team?
I also teach this topic as a live two-day workshop, on-site or remote, with time for your team’s own questions and code. See my workshop Authentication and Authorization in ASP.NET Core.