Cookie Authentication With ASP.NET Core 2.0

This view will hold the Login form and redirects the user to user home page after successful login.

Open UserLogin.cshtml and put the following code into it. 

@model CookieAuthDemo.Models.UserDetails  
@{  
    ViewData["Title"] = "UserLogin";  
}  
  
<h2>User</h2>  
<h4>Login</h4>  
<hr />  
<div class="row">  
    <div class="col-md-4">  
        @if (TempData["UserLoginFailed"] != null)  
        {  
            <p class="alert alert-danger">@TempData["UserLoginFailed"]</p>  
        }  
  
        <form asp-action="UserLogin">  
            <div asp-validation-summary="ModelOnly" class="text-danger"></div>  
            <div class="form-group">  
                <label asp-for="UserID" class="control-label"></label>  
                <input asp-for="UserID" class="form-control" />  
                <span asp-validation-for="UserID" class="text-danger"></span>  
            </div>  
            <div class="form-group">  
                <label asp-for="Password" class="control-label"></label>  
                <input asp-for="Password" class="form-control" />  
                <span asp-validation-for="Password" class="text-danger"></span>  
            </div>  
            <div class="form-group">  
                <input type="submit" value="Login" class="btn btn-default btn-success" />  
                <a asp-action="RegisterUser" class="btn btn-info">SignUp</a>  
            </div>  
        </form>  
    </div>  
</div>  
@section Scripts {  
    @{await Html.RenderPartialAsync("_ValidationScriptsPartial");}  
}  

Login Controller

To handle the business logic of User registration and login, open LoginController.cs and put following code into it

using System;  
using System.Collections.Generic;  
using System.Linq;  
using System.Security.Claims;  
using System.Threading.Tasks;  
using CookieAuthDemo.Models;  
using Microsoft.AspNetCore.Authentication;  
using Microsoft.AspNetCore.Mvc;  
  
namespace CookieAuthDemo.Controllers  
{  
    public class LoginController : Controller  
    {  
        UserDataAccessLayer objUser = new UserDataAccessLayer();  
  
        [HttpGet]  
        public IActionResult RegisterUser()  
        {  
  
            return View();  
        }  
  
        [HttpPost]  
        public IActionResult RegisterUser([Bind] UserDetails user)  
        {  
            if (ModelState.IsValid)  
            {  
                string RegistrationStatus = objUser.RegisterUser(user);  
                if (RegistrationStatus == "Success")  
                {  
                    ModelState.Clear();  
                    TempData["Success"] = "Registration Successful!";  
                    return View();  
                }  
                else  
                {  
                    TempData["Fail"] = "This User ID already exists. Registration Failed.";  
                    return View();  
                }  
            }  
            return View();  
        }  
  
        [HttpGet]  
        public IActionResult UserLogin()  
        {  
  
            return View();  
        }  
  
        [HttpPost]  
        [ValidateAntiForgeryToken]  
        public async Task<IActionResult> UserLogin([Bind] UserDetails user)  
        {  
            ModelState.Remove("FirstName");  
            ModelState.Remove("LastName");  
  
            if (ModelState.IsValid)  
            {  
                string LoginStatus = objUser.ValidateLogin(user);  
  
                if (LoginStatus == "Success")  
                {  
                    var claims = new List<Claim>  
                    {  
                        new Claim(ClaimTypes.Name, user.UserID)  
                    };  
                    ClaimsIdentity userIdentity = new ClaimsIdentity(claims, "login");  
                    ClaimsPrincipal principal = new ClaimsPrincipal(userIdentity);  
  
                    await HttpContext.SignInAsync(principal);  
                    return RedirectToAction("UserHome", "User");  
                }  
                else  
                {  
                    TempData["UserLoginFailed"] = "Login Failed.Please enter correct credentials";  
                    return View();  
                }  
            }  
            else  
                return View();  
  
        }  
    }  
}  

To handle database operations, we have created an object of UserDataAccessLayer class inside the LoginController class.

If the user tries to register with a User id which is already registered into the database then we will display an error message on the view. This error message is passed on to the view using Tempdata.

Since we are using the same model for both, registering a new user and login into the application, but we do not require Firstname and LastName property for Login, hence we have removed those value from our model using ModelState.Remove inside UserLogin method.

If the validation is successful from the database end, then we will create a Claims list which will store the UserID of the user into the Name claim inside the cookie. This cookie data will be encrypted by default. Then we will build an identity and principal and then set the cookie using the SignInAsync method.

UserHome View

This is a dummy home page which will be accessed by authorized users only.

Open UserHome.cshtml and put the following code into it.

@{  
    ViewData["Title"] = "UserHome";  
}  
<ul class="nav navbar-nav navbar-right">  
    <li>  
        <a asp-action="Logout">Sign Out</a>  
    </li>  
</ul>  
  
<h2>UserHome</h2>  
<h3>This is the user home page</h3>  

Open UserController.cs and put the following code into it

using System;  
using System.Threading.Tasks;  
using Microsoft.AspNetCore.Authentication;  
using Microsoft.AspNetCore.Authorization;  
using Microsoft.AspNetCore.Mvc;  
  
namespace CookieAuthDemo.Controllers  
{  
    [Authorize]  
    public class UserController : Controller  
    {  
        public IActionResult UserHome()  
        {  
            return View();  
        }  
  
        [HttpGet]  
        public async Task<IActionResult> Logout()  
        {  
            await HttpContext.SignOutAsync();  
            return RedirectToAction("UserLogin", "Login");  
        }  
    }  
}  

The [Authorize] attribute signifies that this controller will be accessed only after successful authentication.

When an authentication request is made then, the middleware will check for the existence of authentication cookie which was set while login. If the cookie is found then the login is successful and the user will be redirected to UserHome view. But if the cookie is not present then the user will be redirected to the Login page (as set up using options.LoginPath in Startup.cs in next section). The user cannot access the UserHome view in this case.

using System;  
using System.Threading.Tasks;  
using Microsoft.AspNetCore.Authentication.Cookies;  
using Microsoft.AspNetCore.Builder;  
using Microsoft.AspNetCore.Hosting;  
using Microsoft.Extensions.Configuration;  
using Microsoft.Extensions.DependencyInjection;  
  
namespace CookieAuthDemo  
{  
    public class Startup  
    {  
        public Startup(IConfiguration configuration)  
        {  
            Configuration = configuration;  
        }  
  
        public IConfiguration Configuration { get; }  
  
        // This method gets called by the runtime. Use this method to add services to the container.  
        public void ConfigureServices(IServiceCollection services)  
        {  
            services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)  
                    .AddCookie(options =>  
                    {  
                        options.LoginPath = "/Login/UserLogin/";  
  
                    });  
            services.AddMvc();  
        }  
  
        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.  
        public void Configure(IApplicationBuilder app, IHostingEnvironment env)  
        {  
            app.UseAuthentication();  
  
            if (env.IsDevelopment())  
            {  
                app.UseBrowserLink();  
                app.UseDeveloperExceptionPage();  
            }  
            else  
            {  
                app.UseExceptionHandler("/Home/Error");  
            }  
    
            app.UseStaticFiles();  
  
            app.UseMvc(routes =>  
            {  
                routes.MapRoute(  
                    name: "default",  
                    template: "{controller=Login}/{action=UserLogin}/{id?}");  
            });  
        }  
    }  
}