Master Cookie Authentication, Claims-Based Identity, and Policy-Based Authorization in ASP.NET Core 10. Perhaps you’re taking on more responsibility, focusing on compliance, or know you’ll need to upgrade the security of your systems.
Content:
You want to know they’re secure, why, and know there’s a solid yet flexible foundation for you and your team to build on. If so, this course is for you! Building secure web applications is essential in today’s digital landscape. This instructor-led course provides a comprehensive foundation in authentication and authorization for ASP.NET Core 10, teaching you how things work under the hood before you adopt higher-level libraries like ASP.NET Core Identity or external providers like OAuth and OpenID Connect.
What you will learn:
You will learn the concepts, tools and solutions needed to make a secure authorization and authentication pipeline within your application. You will be able to:
• Understand the ASP.NET Core authentication pipeline and how requests are processed
• Work with ClaimsPrincipal, ClaimsIdentity, and the security context
• Master authentication operations: Challenge, SignIn, Authenticate, SignOut, and Forbid
• Understand authentication schemes, tickets, and the cookie handler internals
• Configure cookie and ticket lifetimes for different security scenarios
• Implement custom cookie event handlers for advanced scenarios
• Apply role-based, claims-based, and policy-based authorization
• Create custom authorization requirements and handlers
• Implement resource-based authorization for fine-grained access control
• Debug authentication flows using Fiddler
• Avoid common security pitfalls including broken access control
Agenda:
Module 1 - Course Overview:
• Welcome
• What will you learn in this course
• Who is the course for and prerequisites
Module 2 - Getting Started:
• Course Material
• Installing Fiddler
• Fiddler and HTTPs
• Exploring the starter project
Module 3 - Fundamentals:
• The User Object
• Creating a ClaimsPrincipal
• The Request Pipeline
Module 4 - The Authentication Middleware:
• Introduction
• Authentication Operations
• Challenge
• SignIn
• Authenticate
• SignOut
• Forbid
Module 5 - The Authentication Middleware:
• Schemes
• Authentication Properties
• Authentication Ticket
• Data Protection
Module 6 - The Authentication Handler:
• Introduction
• Challenge
• SignIn
• Authenticate
• SignOut
• Forbid
Module 7 - Cookie and Ticket Lifetime:
• Session Cookies
• Persistent Cookies
• Persistent Cookies Using Max-Age
• Ticket Lifetime
• Ticket Renewal
• Choosing Cookie and Ticket Lifetime
Module 8 - Cookie Event Handlers:
• Challenge Events
• SignIn Events
• Authenticate Events
• SignOut Events
• Forbid Events
Module 9 - Authorization:
• Introduction
• Authorization in ASP.NET Core
• Simple Authorization
• Role-Based Authentication
• Policy-Based Authentication
• Broken Access Control
Module 10 - Advanced Authorization:
• Requirements and Handlers
• Resource-Based Authorization
• The MVC Filter Pipeline
• Authorization Filters
• Custom Authorization Attributes
• DefaultPolicy and Fallback Policy
• View-Based Authorization
Instructor: Tore Nestenius
Tore Nestenius has more than 25 years of professional experience in software development and over a decade specializing in developer training, Tore is a seasoned industry expert. He is an independent consultant, delivering high-quality training, coaching, and consulting services. His areas of focus include .NET, ASP.NET Core, Software Architecture, Web Security, and Identity Management. He is also a Microsoft .NET MVP and blogs frequently at https://nestenius.se/.
Target Audience:
This course is designed for C# developers who want to start building ASP.NET Core web applications
Prerequisites:
To get the most from this course, you should have:
• Basic knowledge of ASP.NET Core (equivalent to our ASP.NET Core fundamentals course)
• Solid understanding of C# including LINQ and lambda expressions
• Understanding of the HTTP/HTTPS protocol and web fundamentals
• A development environment with Visual Studio or an equivalent .NET IDE, capable of running ASP.NET Core 10
• Windows-based development environment recommended. macOS/Linux users can follow the course using alternative HTTP debugging proxy tools; see the FAQ for details and limitations.