Authentication

builder.Services.AddAuthentication("Cookies").AddCookie();

app.UseAuthentication();
app.UseAuthorization();

app.MapGet("/me", (HttpContext ctx) => ctx.User.Identity?.Name);

Common follow-ups: What's the difference between authentication and authorization?;What happens to HttpContext.User for an anonymous, unauthenticated request?

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options => {
        options.LoginPath = "/Account/Login";
        options.ExpireTimeSpan = TimeSpan.FromHours(1);
    });

// After validating credentials:
await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal);

Common follow-ups: Why is cookie authentication less suitable for a mobile app or cross-origin API?;How does the cookie's encryption key get managed across multiple server instances?

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options => {
        options.TokenValidationParameters = new TokenValidationParameters {
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(key),
            ValidateIssuer = true, ValidIssuer = "myapp",
            ValidateAudience = true, ValidAudience = "myapp-api",
            ValidateLifetime = true
        };
    });

Common follow-ups: How do you fetch signing keys dynamically from an identity provider's JWKS endpoint instead of hardcoding them?;What happens if ClockSkew isn't configured for distributed systems with slightly different clocks?

builder.Services.AddAuthentication()
    .AddCookie("Cookies")
    .AddJwtBearer("Bearer");

[Authorize(AuthenticationSchemes = "Bearer")]
[Route("api/[controller]")]
public class ApiController : ControllerBase { }

[Authorize(AuthenticationSchemes = "Cookies")]
public class AccountController : Controller { }

Common follow-ups: How is the default scheme selected when an endpoint doesn't specify one?;What happens if a request presents credentials for the wrong scheme?

builder.Services.AddAuthentication()
    .AddGoogle(options => {
        options.ClientId = builder.Configuration["Google:ClientId"];
        options.ClientSecret = builder.Configuration["Google:ClientSecret"];
    });

// GET /signin-google (default callback path) handles the redirect back from Google

Common follow-ups: What's the difference between OAuth 2.0 and OpenID Connect for authentication purposes?;How do you link an external login to an existing local user account?

builder.Services.AddDefaultIdentity<IdentityUser>(options => {
    options.Password.RequiredLength = 8;
    options.SignIn.RequireConfirmedEmail = true;
}).AddEntityFrameworkStores<AppDbContext>();

// Scaffolded Razor Pages handle registration, login, password reset automatically

Common follow-ups: How does Identity's password hashing algorithm compare to rolling your own?;How do you customize IdentityUser to add custom profile fields?

app.MapPost("/auth/refresh", async (RefreshRequest request, ITokenService tokenService) => {
    var principal = tokenService.ValidateRefreshToken(request.RefreshToken);
    if (principal is null) return Results.Unauthorized();
    var newAccessToken = tokenService.GenerateAccessToken(principal);
    var newRefreshToken = tokenService.RotateRefreshToken(request.RefreshToken);
    return Results.Ok(new { accessToken = newAccessToken, refreshToken = newRefreshToken });
});

Common follow-ups: What is refresh token rotation and why does it improve security over static refresh tokens?;How do you revoke a refresh token immediately during a security incident?

var result = await _signInManager.PasswordSignInAsync(username, password, isPersistent: false, lockoutOnFailure: true);
if (result.RequiresTwoFactor) {
    return RedirectToPage("./LoginWith2fa");
}

// On the 2FA verification page:
var twoFactorResult = await _signInManager.TwoFactorAuthenticatorSignInAsync(code, isPersistent, rememberClient: false);

Common follow-ups: How does Identity generate and validate TOTP codes without a third-party service?;What's the difference between 'remember this browser' and full session persistence for repeated 2FA prompts?

public class ApiKeyAuthHandler : AuthenticationHandler<ApiKeyAuthOptions> {
    protected override async Task<AuthenticateResult> HandleAuthenticateAsync() {
        if (!Request.Headers.TryGetValue("X-Api-Key", out var key))
            return AuthenticateResult.Fail("Missing API key");
        var client = await _keyStore.ValidateAsync(key);
        if (client is null) return AuthenticateResult.Fail("Invalid API key");
        var identity = new ClaimsIdentity(new[] { new Claim("client", client.Name) }, Scheme.Name);
        return AuthenticateResult.Success(new AuthenticationTicket(new ClaimsPrincipal(identity), Scheme.Name));
    }
}

Common follow-ups: How does a custom AuthenticationHandler differ in complexity from using an existing scheme?;What are the security trade-offs of API keys versus OAuth client credentials?

app.UseRouting();
app.UseAuthentication();  // MUST come first: establishes HttpContext.User
app.UseAuthorization();   // depends on User already being populated
app.MapControllers();

Common follow-ups: What HttpContext state does UseAuthentication actually populate?;Does this ordering requirement apply the same way to minimal APIs as MVC controllers?