How asad-maiga/aspnetcore-authentication-from-scratch works
This is a teaching Web API that demonstrates how requests become authenticated identities and how those identities are authorized. The main workflow is request authentication, claims/principal creation, policy or resource checks, and a controller response. Cookie and JWT endpoints add login/session or token/refresh flows; API-key authentication is the default scheme. The README documents further authorization examples and capabilities. Wiring below is based on sampled source and README claims; unsampled implementations are represented only where the tree supports their paths.
Main entry points: Program.cs App pipeline · JwtAuthController.cs JWT endpoints · ApiKeyAuthenticationHandler.cs Claims principal · IdentityController.cs Identity endpoints
Components 17
Request runtime
- App pipeline
AuthFromScratch/AuthFromScratch.Api/Program.cs
Authentication
- API key handler
AuthFromScratch/AuthFromScratch.Api/Authentication/ApiKey/ApiKeyAuthenticationHandler.cs - Cookie authentication
AuthFromScratch/AuthFromScratch.Api/Authentication/Cookie - JWT validation
AuthFromScratch/AuthFromScratch.Api/Program.cs - Claims principal
AuthFromScratch/AuthFromScratch.Api/Authentication/ApiKey/ApiKeyAuthenticationHandler.cs - Access token service
AuthFromScratch/AuthFromScratch.Api/Authentication/Jwt/JwtTokenService.cs - Refresh token service
AuthFromScratch/AuthFromScratch.Api/Authentication/Jwt/RefreshTokenService.cs - Refresh token store
AuthFromScratch/AuthFromScratch.Api/Authentication/Jwt/InMemoryRefreshTokenStore.cs
Authorization
- Authorization policies
AuthFromScratch/AuthFromScratch.Api/Program.cs - Access-level handler
AuthFromScratch/AuthFromScratch.Api/Authorization/MinimumAccessLevelHandler.cs - Resource-owner handler
AuthFromScratch/AuthFromScratch.Api/Authorization/ResourceOwnerHandler.cs
API features
- Identity endpoints
AuthFromScratch/AuthFromScratch.Api/Controllers/IdentityController.cs - Cookie endpoints
AuthFromScratch/AuthFromScratch.Api/Controllers/CookieAuthController.cs - JWT endpoints
AuthFromScratch/AuthFromScratch.Api/Controllers/JwtAuthController.cs - Identity resources
AuthFromScratch/AuthFromScratch.Api/Authorization/Resources/IdentityResource.cs - Demo user settings
AuthFromScratch/AuthFromScratch.Api/Authentication/Cookie/DemoUserOptions.cs
Other components
- HTTP client
Connections 22
- HTTP client → App pipeline: sends request
- App pipeline → API key handler: dispatches default
- App pipeline → Cookie authentication: configures scheme
- App pipeline → JWT validation: configures scheme
- API key handler → Claims principal: creates principal
- Cookie authentication → Claims principal: restores principal
- JWT validation → Claims principal: validates token
- App pipeline → Identity endpoints: maps controllers
- App pipeline → Cookie endpoints: maps controllers
- App pipeline → JWT endpoints: maps controllers
- Identity endpoints → Identity resources: reads resource
- Identity endpoints → Resource-owner handler: authorizes resource
- Resource-owner handler → Claims principal: reads claims
- Identity endpoints → Authorization policies: requires policy
- Cookie endpoints → Demo user settings: reads credentials
- JWT endpoints → Demo user settings: reads credentials
- Cookie endpoints → Cookie authentication: signs in or out
- JWT endpoints → Access token service: creates access token
- JWT endpoints → Refresh token service: issues or rotates
- Refresh token service → Refresh token store: reads and writes
- JWT endpoints → Claims principal: reads request identity
- Authorization policies → Access-level handler: uses requirement