ASP.NET Core 2.0 Cookie Authentication


How to implement cookie authentication in ASP.NET Core 2.0


Create an empty project and update Startup to configure services and middleware for MVC and Authentication,

Create a model to receive login details,

Create a login page,

Create a controller for Login and Logout actions,

Finally add a controller to secure using [Authorize] attribute,


Authentication middleware intercepts incoming requests and checks for the existence of a cookie holding encrypted user data.

  • If a cookie is found, it will be serialised into a ClaimsPincipal type and can be accessed via HttpContext.User property.
  • If a cookie isn’t found, middleware redirects to login page using an action method. Through the login page you’ll receive user details and authenticate against your database records. Once authenticated, you’ll need to,

    • Create List<Claim> related to the user identity.
    • Create ClaimsIdentity, assign claims and specify authentication type.
    • Create ClaimsPrincipal and assign identity.
    • Call HttpContext.SignInAsync() with authentication scheme name (setup via services, see next section) and Principal.
Cookie Authentication Options

When setting up cookie services there are several options to tweak its behavior like,

  • AccessDeniedPath: redirects to this path when authorization fails
  • AuthenticationScheme: name that identifies the scheme, used with signing in and out. In the solution it’s FiverSecurityScheme.
  • Cookie.Domain: domain used for cookie storage, defaults to request’s host. Browser will only send cookie to matching host
  • Cookie.HttpOnly: sets whether cookie can be accessed from client side scripts. Default is truei.e. only accessed via HTTP and not via scripts.
  • Cookie.Name: set to override default name of cookie, which is .AspNetCore.Cookies
  • Cookie.Path: path where cookie is created, default is ‘/’ i.e. root.
  • Cookie.SecurePolicy: determines if cookie can be accessed via HTTPS requests only.
  • ExpireTimeSpan: determines how long the cookie is valid for.
  • LoginPath: redirects to this page for unauthenticated users.
  • ReturnUrlParameter: name of query string parameter appended to URL when redirected to login path.
  • SlidingExpiration: set to keep the cookie alive once close to expiry time (half way).

Cookie Authentication allows developers to hook into events at various lifecycle stages of authentication process. For instance you could log successful sign-ins using OnSignedIn or use OnValidatePrincipal (runs on every request) to invalidate the user (e.g. if you want to force sign-out).

For some of the events (e.g. OnValidatePrincipal) the HttpContext.User is null, use the Principalproperty of event’s context parameter.

Sign Out

To delete the authentication cookie, and thus sign out the user, you call HttpContext.SignOutAsync() method with the authentication scheme name.

Cookie Expiration

In order to set an absolute expiry time for the identity/cookie (as opposed to sliding expiration), you could use AuthenticationProperties,

Migrating from ASP.NET Core 1.x

Prior to ASP.NET Core 2.0 the cookie authentication was setup little differently. It was setup in Configure() method and some of the property names were different too. Below is from the project I originally created using ASP.NET Core 1.x,

Also the sign-in and sign-out methods were accessed using Authentication property on HttpContext,

Source Code