skills.rest
ecnepsyroc-bot
ecnepsyroc-botCOMMUNITY
Explore all skills by this author →
GitHub

aspnet-dual-auth

Configure ASP.NET Core policy scheme selection for cookie and JWT authentication.

Updated Aug 23, 2026
Search Tags:#csharp#authentication#jwt#spa#cookies#aspnet-core#policy-scheme
One-click install
npx skills add https://github.com/ecnepsyroc-bot/Dejavara --skill aspnet-dual-auth
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aspnet-dual-auth
Source: https://github.com/ecnepsyroc-bot/Dejavara/tree/main/deploy/skills/aspnet-dual-auth
Command: npx skills add https://github.com/ecnepsyroc-bot/Dejavara --skill aspnet-dual-auth

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Many APIs must serve both same-origin SPAs that rely on secure cookies and external clients that use Bearer JWTs, but ASP.NET Core's default authentication assumes a single scheme which leads to cookies not being set, SPAs redirecting to signin, or 401 responses turning into 302 redirects.

Core Features & Use Cases

  • Automatic Scheme Selection: Uses a policy scheme that inspects the request and forwards to JwtBearer when an Authorization: Bearer header is present or to Cookie authentication for same-origin SPA requests.
  • Safe SPA Cookies: Recommends HttpOnly, secure cookies with SameSite=Lax and sliding expiration to preserve sessions without localStorage.
  • API-Friendly Responses: Overrides cookie redirect events to return 401/403 for API calls and provides a pattern to issue both a cookie for the SPA and a JWT for external clients.
  • Use Case: A React/Vue/Angular SPA served from the same origin can authenticate via an HttpOnly cookie while mobile apps or third-party services use JWTs.

Quick Start

Configure the API to use a policy selector that chooses JWT for Authorization: Bearer requests and cookies for same-origin SPA requests, set cookie options to HttpOnly, SameSite=Lax and secure, and ensure the cookie events return 401/403 for API calls.

Frequently Asked Questions about aspnet-dual-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure ASP.NET Core to support both cookie and JWT authentication for my SPA and external API clients?▼

ASP.NET Core dual authentication uses a policy scheme that inspects requests and forwards to JwtBearer when an Authorization: Bearer header is present, or to Cookie authentication for same-origin SPA requests. This setup allows an API to serve both secure browser-based SPAs and external token-based clients simultaneously.

Why does my ASP.NET Core API return a 302 redirect instead of a 401 when my SPA fails authentication?▼

ASP.NET Core cookie authentication defaults to redirecting to a login page on 401, which breaks SPA flows. You must override cookie authentication events to return 401 or 403 JSON responses directly, preventing unwanted redirects for same-origin API calls while keeping cookie-based session security intact.

What cookie settings should I use for ASP.NET Core SPA authentication without localStorage?▼

ASP.NET Core SPA cookies should use HttpOnly, SameSite=Lax, and secure attributes with sliding expiration. This preserves sessions safely without exposing tokens to JavaScript, preventing cross-site scripting theft while maintaining a smooth user experience for same-origin requests.

Can I issue both a secure cookie for my React SPA and a JWT for mobile apps from the same ASP.NET Core endpoint?▼

Yes, ASP.NET Core can issue both an HttpOnly cookie for same-origin SPAs and a JWT for external clients. A policy scheme selector automatically detects Authorization: Bearer headers to apply JWT validation, while applying cookie validation to same-origin browser requests.

What's the best way to prevent my ASP.NET Core SPA from redirecting to signin during cross-origin credential issues?▼

Override the cookie authentication events in ASP.NET Core to return 401 and 403 status codes instead of triggering redirects. Configure cookies with HttpOnly, SameSite=Lax, and secure attributes, and use a policy scheme to forward Bearer headers to JWT validation automatically.

Related Skills

Explore More Software Engineering Skills→
codewithmukeshcodewithmukesh
640

authentication

Configure JWT bearer and cookie authentication for ASP.NET Core applications.

Official
Intermediate
7a336e6e7a336e6e
1

managing-sessions-tokens

Manage JWT authentication sessions with rotating refresh tokens and revocation.

Community
Advanced
abhijeetkakade1234abhijeetkakade1234
1

cors-csrf-audit

Detect CORS misconfigurations and CSRF vulnerabilities in web applications.

Community
Advanced
medridemedride
1

dotnet-api-auth

Implement JWT Bearer and API key authentication for ASP.NET Core Web APIs.

Official
Advanced