Claims-Based Authorization and Authentication
Explore how ASP.NET Core MVC handles access control through claims-based authorization and authentication. Understand authentication schemes, the role of cookies and JWT tokens, claim types, and the configuration needed to secure resources effectively.
Like all modern frameworks, ASP.NET Core authorizes access to resources using claims. Claims are assertions about the subject that needs to access the resources. They are obtained through a process called authentication, which is defined in manifests called authentication schemes.
Authentication and authentication schemes
Each authentication scheme specifies the kind of action needed for authenticating a user and to compute its claims. Authentication must not be confused with login. In fact, login is the process of obtaining credentials for being authenticated in subsequent requests, while authentication is the process of validating these credentials on each request, and of extracting claims from them. The application that issues your credentials can be different from the application where we use these credentials to authenticate.
Typical credentials used by web applications are cookies and JWT (JSON Web Token) tokens.
Cookies must be necessarily emitted by ...