skills.rest
envoydev
envoydevCOMMUNITY
Explore all skills by this author →
GitHub

dotnet-authentication

Implements ASP.NET Core authentication and authorization with JWT, cookies, OIDC, and named policies.

1|Updated Jun 2, 2026
Search Tags:#authorization#authentication#jwt#dotnet#identity#aspnet-core#openid-connect
One-click install
npx skills add https://github.com/envoydev/claude-stack --skill dotnet-authentication-envoydev
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dotnet-authentication
Source: https://github.com/envoydev/claude-stack/tree/main/stack/skills/dotnet-authentication
Command: npx skills add https://github.com/envoydev/claude-stack --skill dotnet-authentication-envoydev

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Choosing and wiring the wrong auth scheme in ASP.NET Core leads to insecure endpoints, scattered role checks, and hand-rolled user stores that quietly get security wrong. This Skill provides house conventions for both halves of .NET auth - authentication and authorization - so sign-in flows, token validation, and access policies are implemented correctly the first time. ## Core Features & Use Cases - Scheme selection by surface: JWT bearer for stateless APIs, cookie authentication for server-rendered apps, and OpenID Connect with authorization code flow for delegated SSO. - Hardened token handling: full issuer, audience, lifetime, and signing-key validation with trimmed clock skew, short-lived access tokens, and JsonWebTokenHandler-based minting on .NET 8+. - Policy-based authorization: named policies, custom requirements and authorization handlers, resource-based checks, and endpoint group protection via RequireAuthorization. - Use Case: When standing up a new REST API that needs sign-in, load this Skill to register JWT bearer with all validation flags on, mint 15-minute tokens from explicit claims, and gate admin routes behind a named CanPublish policy verified by integration tests. ## Quick Start Load the dotnet-authentication skill and help me wire JWT bearer authentication with a named authorization policy for my ASP.NET Core API.

Frequently Asked Questions about dotnet-authentication

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add JWT bearer authentication to an ASP.NET Core API?▼

Register AddAuthentication with AddJwtBearer and enable all four TokenValidationParameters: issuer, audience, lifetime, and signing key. Trim ClockSkew to about 30 seconds and mint tokens with JsonWebTokenHandler, the handler .NET 8+ validates with by default.

JWT bearer vs cookie authentication in ASP.NET Core - which should I use?▼

Use JWT bearer for stateless REST APIs where the token carries identity and the server keeps no session. Use cookie authentication for server-rendered apps like MVC, Razor Pages, or Blazor Server, since the browser already holds an HttpOnly, SameSite cookie.

How do I write a custom authorization policy in ASP.NET Core?▼

Define an IAuthorizationRequirement record and an AuthorizationHandler that calls context.Succeed when the rule passes, then register the handler and add a named policy via AddAuthorizationBuilder().AddPolicy. Apply the policy name to endpoint groups with RequireAuthorization instead of scattering role strings.

Does ASP.NET Core authentication work on .NET Framework 4.8?▼

On .NET Framework 4.8, use the OWIN/Katana pipeline with ASP.NET Identity 2.x instead of ASP.NET Core middleware. Configure app.UseCookieAuthentication for server-rendered apps and Microsoft.Owin.Security.Jwt for Web API 2 bearer tokens, preferring RS256 with a JWKS resolver.

Why does my OnTokenValidated event break after upgrading to .NET 8?▼

Since .NET 8, AddJwtBearer validates through JsonWebTokenHandler by default, so context.SecurityToken is a JsonWebToken, not a JwtSecurityToken, and the cast fails. Update the cast or set UseSecurityTokenValidators = true, which forfeits the faster default handler.

When should I use API keys instead of JWT tokens?▼

Use API keys only for service-to-service or webhook callers that cannot perform a real handshake, never as primary user auth. Store a SHA256 hash of the key, compare with CryptographicOperations.FixedTimeEquals, and issue a ClaimsPrincipal so the pipeline treats the caller like any authenticated principal.

Related Skills

Explore More Software Engineering Skills→
TrossitecTrossitec
1

authentication

Implement JWT and cookie authentication with policy-based authorization in ASP.NET Core.

Official
Intermediate
penpotpenpot
59.4k

security-and-hardening

Hardens web application code against OWASP vulnerabilities through threat modeling and defensive patterns.

Official
Advanced
DFly7DFly7

cryptokit

Perform cryptographic operations in Swift using Apple CryptoKit.

Community
Advanced
vaadin-developervaadin-developer
2

jsentinel-vaadin-oidc

Integrate OpenID Connect Single Sign-On into Vaadin applications via authorization-code flow.

Official
Intermediate