All 15 Authentication questions
More in Authentication
What is ASP.NET Core Identity, and how does it provide a complete user account management system? How does two-factor authentication (2FA) work with ASP.NET Core Identity, and what does the sign-in flow look like? What is the purpose of the authentication middleware's position in the pipeline, and why must UseAuthentication come before UseAuthorization? How do claims transformations (IClaimsTransformation) let you augment a user's claims after initial authentication but before authorization checks run? How does JWT bearer authentication validate an incoming token, and what claims does TokenValidationParameters check? How do external identity provider integrations (like Google or Microsoft Entra ID) work using OAuth/OpenID Connect authentication handlers? How do refresh tokens work alongside short-lived JWT access tokens, and how would you implement a refresh endpoint? How do you implement API key authentication as a custom authentication scheme for machine-to-machine API access? How would you implement sign-out that properly invalidates both a cookie session and any associated server-side state? How does Windows Authentication (Negotiate/Kerberos) work in ASP.NET Core for intranet applications, and when is it appropriate?
Advertisement
ASP.NET Core › Authentication

What is the difference between IAuthenticationService's SignInAsync/SignOutAsync methods and simply checking if a user 'is authenticated'?

Intermediate

Answer

SignInAsync/SignOutAsync are imperative actions that actually establish or clear an authenticated session (writing/clearing a cookie, or in the case of custom schemes, whatever persistence mechanism the scheme uses) -- distinct from HttpContext.User.Identity.IsAuthenticated, which is merely a read-only check of the current request's already-established identity state, not an action that changes anything.
// Action: actually establishes a new authenticated session
await HttpContext.SignInAsync(scheme, principal);

// Query: just reads the CURRENT request's already-established state
bool isLoggedIn = HttpContext.User.Identity?.IsAuthenticated ?? false;
Real-world example A login action handler calls SignInAsync once after validating credentials to establish the session, while every other part of the application simply reads User.Identity.IsAuthenticated to check the already-established state without triggering any new sign-in action.

Common follow-ups: What actually happens internally when SignInAsync is called for cookie authentication?;Can you be signed in under multiple schemes simultaneously?

Authorization;Sessions Cookies & TempData
All 15 Authentication questions