ASP.NET Core SPA Templates Need Better Options for Authentication

[Grauenwolf]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem? Please describe the problem.

I am trying to create basic SPA applications that manage their own passwords without the cost and complexity of third-party products like Identity Server.

Other's I'm talking to just want simple social media authentication.

We're all at a loss as to how to achieve this because none of the SPA templates give us any direction on how to proceed. There are out-of-band tutorials we can look at. But they are often incomplete or confusing, which is not acceptable for something that has to be perfect on day one. The phrase, "I'm learning authentication by trial-and-error" is quite frightening.

Describe the solution you'd like

The SPA templates for Angular, React, Blazor, etc. should include options for...

• ASP.NET Identity for cookie-based authentication (i.e. not Identity Server)
• Microsoft Identity
• Azure B2C
• Azure Active Directory
• Generic OAuth with JWT template
• any other Microsoft-supported authentication platform

Additional context

We are regularly seeing posts on Reddit with titles like "Why is authentication such a XXXX show with .NET 6?" and "Does anyone else feel as lost as I do in the .NET Identity documentation?". The community is having a really hard time with this and needs far better guidance than what we're getting.

[MJomaa]

+ 1

I don't even know why you would need identity server when starting out with a web project. It's overkill and requires licensing.

WebApp with internal API

I wish there was a SPA template with session cookie authentication, CSRF protection, Microsoft+Google federated login and scaffolded UI where you change everything, even the routes.

Public API

If you want to offer a public API it's trivial to implement client credentials flow where the client credentials can be generated in the web app (usually under "organization" or "account settings")

[toddbauermeister]

+1

My recent experience with Blazor Server and scaffolding in Auth pages for customisation (which are .cshtml and not .razor pages) was not super fun or intuitive tbh 😅

It would have been really nice to have a template with a choice of provider(s) / auth components to be included in the template by default, and the support to scaffold in .razor pages (or even include some of the most important ones in the project by default) many people including myself have been confused that there is a project with pages which 'don't exist' in the solution until you scaffold them in.

[DavidKrowitz]

Pretty please with a bow on top!

Would make the lives of working professional coders a lot easier.

[GuerrillaCoder]

Also an example using openiddict which is free instead of identity server that would require a license for us to use.

[atresnjo]

Also an example using openiddict which is free instead of identity server that would require a license for us to use.

https://github.com/openiddict/openiddict-samples/tree/dev/samples/Hollastin/Hollastin.Server

[dajma00]

Even trying to do an API with auth, we are at a loss. A Laravel team tried and failed. Went back to Laravel.

[robheffo79]

Honestly, Authentication is terrible. It's overcomplicated and slow.

I implemented my own Authentication platform that completely hides the default built-in system, It's much faster than the stock system. I would share it but it's for a client and I don't own the rights to the code

Authentication needs to be split out into its own libraries and not as part of the core of ASP.NET 6.

[MJSanfelippo]

That would be fantastic.

[taylorchasewhite]

Here are related issues I wrote (focused on the documentation, but certainly reflect the same concerns):

1. Understanding & Using Microsoft Identity (StackOverflow)
2. Blazor WASM Additional Authentication Scenarios (#221222)
3. AzureAD Blazor Issues #19803
4. AzureAD Blazor Claims Issues #19576
5. BaseAddressAuthorizationMessageHandler #18344

FWIW, we largely did our own work as well to make auth work in our Blazor WASM app and divorce from Identity Server, but I would much rather use a well supported foundation than what I built.

Thanks @Grauenwolf for your suggestions.

[prince272]

I'm happy that these are now concerns to the community. When standalone react and api application was introduced, I thought authentication would be improved upon but I rather saw complexity of third-party products like Identity Server, etc. I'm currently considering identify server 4 with OID client and still stuck with Net 5.
But I'm hoping there would be a better solution like what @MJomaa suggested. Thank you

[kyledevans]

I've managed to implement both username/password and the Microsoft Identity Web platform into a react SPA + backend API project. But it's been a hugely complicated task, and while it's great when I look back at how much I've learned, I doubt anyone wants to spend 6+ months digging into the deepest depths of ASP in order to come up with a production-ready implementation. The only reason I was able to do it is because Covid forced me to take a lot of time off work.

If it's at all helpful, I have a working implementation here: Kiddo (Username/Password/Azure Ad web app). It uses JWTs instead of cookies, but on the server side it still uses the ASP Identity framework for managing usernames/passwords.

I fully get that adding even a stripped down version of what I've managed to get working is a bit much for a template. There's simply so much boilerplate necessary simply to get the server-side API to work. That's not considering all of the UI components and integration with your site branding and design.

I've wondered at the possibility that we (the community and ASP teams) could come up with a REST protocol to at least streamline the server-side component. From there it would be up to individual teams to write the actual SPA frontend that integrates with the API.

[chindilhan]

Yes this is a must have, easy to use feature. We've switched few projects to other techs just because of this auth nightmare.

[robert-txt]

Something has already started to happen in this matter: https://devblogs.microsoft.com/dotnet/asp-net-core-updates-in-dotnet-7-preview-5/#jwt-authentication-improvements-automatic-authentication-configuration Is it the right direction?