This time I want to focus on user authentication. In APIs we can use different methods for user authentication like:
-cookie Authentication
-basic Authentication (not recommended, slow and insecure)
-token Authentication
In this post I want to show you how to implement cookie authentication in ASP.NET Core Web API.
First make sure you have installed Microsoft.AspNetCore.Identity.EntityFrameworkCore NuGet package in your project. Then let’s modify model a little bit.
Create User class derived from IdentityUser.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
public class User : IdentityUser { public User() { } public User(string userName) : base(userName) { } public string FirstName { get; set; } public string LastName { get; set; } } |
Next modify Context class. Our Context should be derived from IdentityDbContext<User> class. If your Context is derived from DbContext class, you need to change it. IdentityContext helps us to create all tables needed for user like Roles, Claims, Tokens, etc.
After these modifications, add another migration via Package Manager Console (type Add-Migration migrationName) and update database by Update-Database command. If you don’t know how to perform code first migrations take a look at one of my previous post.
If we have database ready, we can focus on our API project. In Startup.cs class in ConfigureServices method we need to add identity to services by adding this line of code:
|
1 2 |
services.AddIdentity<User, IdentityRole>() .AddEntityFrameworkStores<ELPContext>(); |
where ELPContext is your app context and User is user class derived from IdentityUser.
That’s not all, we need to add more code, to specify how Identity should work. There’s a small problem with ASP.NET Core WebApi, when you call method that needs authorization you can get 404 Not Found Error instead of 401 Unauthorized. It’s because of default redirection to Account/Login page which can be helpful in ASP.NET MVC project but not in Web API. To handle it we need to set up application cookie events. Events allow us to override things that the IdentitySystem does. Add this code after AddItentity method call.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
services.Configure<IdentityOptions>(cfg => { cfg.Cookies.ApplicationCookie.Events = new CookieAuthenticationEvents() { OnRedirectToLogin = (ctx) => { if (ctx.Request.Path.StartsWithSegments("/api") && ctx.Response.StatusCode == 200) { ctx.Response.StatusCode = 401; } return Task.CompletedTask; }, OnRedirectToAccessDenied = (ctx) => { if (ctx.Request.Path.StartsWithSegments("/api") && ctx.Response.StatusCode == 200) { ctx.Response.StatusCode = 403; } return Task.CompletedTask; } }; }); |
In the Configure method in Startup class we need to add another line of code before calling app.UseMvc() method:
|
1 |
app.UseIdentity(); |
We have configured our project, so let’s implement controller with register and login methods. I prefer to avoid logic in Controllers and use only services, so first we need to create UserService. This is my UserService for now.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
public class UserService : IUserService { private UserManager<User> _userManager; private SignInManager<User> _signInManager; public UserService(ELPContext context, UserManager<User> userManager, SignInManager<User> signInManager) { _userManager = userManager; _signInManager = signInManager; } public async Task<User> GetUserByUsername(string username) { return await _userManager.FindByNameAsync(username); } public async Task<IdentityResult> CreateUser(User user, string password) { return await _userManager.CreateAsync(user, password); } public async Task<SignInResult> SignIn(string username, string password) { return await _signInManager.PasswordSignInAsync(username, password, false, false); } } |
I use UserManager and SigninManager that come from Microsoft.AspNetCore.Identiy namespace. These managers do a lot for us.
When we have service it’s time to use it in Controller.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 |
[HttpPost("register")] public async Task<IActionResult> Register([FromBody] UserDto user) { GenericResult result = null; try { User newUser = new User(user.Username); newUser.Email = user.Email; newUser.FirstName = user.FirstName; IdentityResult createdUser = await _userService.CreateUser(newUser, user.Password); if (createdUser != null && createdUser.Succeeded) { result = new GenericResult() { Success = createdUser.Succeeded, Message = "Registration succeeded" }; } else { result = new GenericResult() { Success = false, Message = createdUser.Errors.First().Description }; } } catch (Exception ex) { _logger.LogError(ex.Message); result = new GenericResult() { Success = false, Message = "Registration failed" }; } return new ObjectResult(result); } [ValidateModel] [HttpPost("signin")] public async Task<IActionResult> SignIn([FromBody] UserDto user) { var result = await _userService.SignIn(user.Username, user.Password); if (result.Succeeded) return Ok(); return BadRequest("Failed to login"); } |
We have two methods Register and SignIn. It’s time to test it. Hit F5, start your API and open Postman (If you don’t know what is Postman go to my previous post where I mentioned about it).
In Postman pick Post method call, add body which is raw JSON and hit Send. You should see success and status 200 like on image below.
To test Signin method, repeat above steps. You can see in the result in the Cookies tab there’s cookie provided by ASpNetCore.Identity.Applcation. It contains information about the user. If you close the Postman or browser you have to re-authenticate. The cookie passed back and forth is the thing that going to know what the user is.
Next time I will show you how to implement Token based authentication which is recommended method of authentication 😉
If you want to take a look at the source code it is available in my Github repo.
One comment
Comments are closed.