How do you use cookies for authentication in ASP.NET Core?

Using cookies for authentication in ASP.NET Core is a common technique to manage user sessions and maintain state between requests. Here's an overview of how to use cookies for authentication in ASP.NET Core:

1. Configure authentication middleware: In the Startup.cs file, add the following code to configure the authentication middleware:

public void ConfigureServices(IServiceCollection services)
{
    // ...
    services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
        .AddCookie(options => {
            options.LoginPath = "/Account/Login";
            options.LogoutPath = "/Account/Logout";
            options.AccessDeniedPath = "/Account/AccessDenied";
        });
    // ...
}

This code sets up the authentication middleware to use the CookieAuthentication scheme, which provides support for cookie-based authentication. You can also set the login, logout, and access denied paths for the middleware.


2. Authenticate the user: In your login action, use the SignInAsync method to create a cookie for the authenticated user:

public async Task<IActionResult> Login(LoginViewModel model)
{
    if (ModelState.IsValid)
    {
        var user = await _userManager.FindByNameAsync(model.UserName);
        if (user != null && await _userManager.CheckPasswordAsync(user, model.Password))
        {
            var identity = new ClaimsIdentity(CookieAuthenticationDefaults.AuthenticationScheme);
            identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, user.Id));
            identity.AddClaim(new Claim(ClaimTypes.Name, user.UserName));

            await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme,
                new ClaimsPrincipal(identity),
                new AuthenticationProperties {
                    IsPersistent = model.RememberMe
                });

            return RedirectToAction("Index", "Home");
        }
    }

    ModelState.AddModelError("", "Invalid UserName or Password");
    return View(model);
}

This code creates a new ClaimsIdentity object and adds the user's ID and username as claims. Then, it calls the SignInAsync method to create a cookie for the authenticated user. The AuthenticationProperties object can be used to set the IsPersistent property to true to make the cookie persistent across browser sessions.

3. Protect resources: Use the [Authorize] attribute on actions or controllers to protect resources that require authentication:

[Authorize]
public class HomeController : Controller
{
    // ...
}


This code ensures that only authenticated users can access the actions or controllers that are marked with the [Authorize] attribute.

4. Log out the user: In your logout action, use the SignOutAsync method to remove the authentication cookie:

public async Task<IActionResult> Logout()
{
    await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
    return RedirectToAction("Index", "Home");
}


This code removes the authentication cookie and redirects the user to the home page.

Using cookies for authentication in ASP.NET Core is a common technique that can provide a simple and effective way to manage user sessions and maintain state between requests.