Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
API-level authentication, authorization, and security patterns for ASP.NET Core. This skill owns API auth
implementation: ASP.NET Core Identity configuration, OAuth 2.0/OIDC integration, JWT bearer token handling, passkey
(WebAuthn) authentication, CORS policies, Content Security Policy headers, and rate limiting.
Scope
ASP.NET Core Identity configuration and Identity API endpoints
OAuth 2.0 / OpenID Connect integration with external providers
JWT bearer token authentication and policy-based authorization
OWASP Top 10 mitigations and deprecated security patterns -- see [skill:dotnet-security-owasp]
Secrets management and secure configuration -- see [skill:dotnet-secrets-management]
Cryptographic algorithm selection -- see [skill:dotnet-cryptography]
Blazor auth UI components -- see [skill:dotnet-blazor-auth]
Cross-references: [skill:dotnet-security-owasp] for OWASP security principles, [skill:dotnet-secrets-management] for
secrets handling, [skill:dotnet-cryptography] for cryptographic best practices.
ASP.NET Core Identity
ASP.NET Core Identity provides user management, password hashing, role-based authorization, and two-factor
authentication out of the box. It is the recommended starting point for applications that manage their own user
accounts.
prevents the Microsoft OIDC handler from remapping standard JWT claims (e.g.,
`sub` to `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier`). Set this to `false` to preserve the
original claim types from the identity provider.
---
## JWT Bearer Token Authentication
For API-only scenarios where the client sends a JWT in the `Authorization` header:
```csharp
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
{
options.Authority = builder.Configuration["Jwt:Authority"];
options.Audience = builder.Configuration["Jwt:Audience"];
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuer = true,
ValidateAudience = true,
ValidateLifetime = true,
ValidateIssuerSigningKey = true,
ClockSkew = TimeSpan.FromMinutes(1) // Default is 5 min; tighten for security
}
var
// Protect endpoints
"/api/profile"
new
### Policy-Based Authorization
"AdminOnly"
"Admin"
"PremiumUser"
"subscription"
"premium"
new
## Passkeys / WebAuthn (.NET 10)
10
inpasskey (WebAuthn/FIDO2) support for passwordless authentication. Passkeys use public-key
cryptography and are phishing-resistant.
```csharp
// .NET 10: Add passkey support to Identity
builder.Services.AddIdentityApiEndpoints<ApplicationUser>(options =>
{
options.User.RequireUniqueEmail = true;
})
.AddEntityFrameworkStores<AppDbContext>()
.AddDefaultTokenProviders()
.AddPasskeys()
// Enable WebAuthn passkey authentication
var
// Passkey registration and authentication endpoints are added automatically
### Passkey Registration Flow
1.
get
2.
Client creates a credential using the Web Authentication API (`navigator.credentials.create`)
3. Client sends the attestation response to `/passkey/register`
4. Server validates and stores the credential
### Passkey Authentication Flow
1. Client calls `/passkey/login/options` to get a `PublicKeyCredentialRequestOptions` challenge
2. Client signs the challenge using `navigator.credentials.get`
3. Client sends the assertion response to `/passkey/login`
4. Server validates the assertion and issues a session/token
**Key benefits:** No passwords to phish, no credentials stored server-side (only public keys), built-in resistance to
replay attacks.
---
## CORS Policies
Cross-Origin Resource Sharing (CORS) controls which origins can call your API. Always use explicit, named policies --
never use `AllowAnyOrigin()` in production.
```csharp
builder.Services.AddCors(options =>
{
options.AddPolicy("Production", policy =>
{
policy.WithOrigins(
"https://app.example.com",
"https://admin.example.com")
.WithMethods("GET", "POST", "PUT", "DELETE")
.WithHeaders("Content-Type", "Authorization")
.SetPreflightMaxAge(TimeSpan.FromMinutes(10))
// Cache preflight
"Development"
"https://localhost:5173"
// Vite dev server
var
"Development"
"Production"
### Common CORS Pitfalls
is
by
true
this
Set a reasonable cache duration (10-60 minutes) to reduce latency.
- **Wildcard headers with credentials:** `AllowAnyHeader()` combined with `AllowCredentials()` works in ASP.NET Core but
may behave unexpectedly in some browsers. Prefer explicit header lists.
- **CORS middleware order:** `UseCors()` must be called after `UseRouting()` and before `UseAuthorization()`.
---
## Content Security Policy (CSP)
Content Security Policy headers prevent XSS, clickjacking, and other injection attacks by controlling which resources
the browser can load.
```csharp
app.Use(async (context, next)
// API-focused CSP -- restrict all content sources
"Content-Security-Policy"
"default-src 'none'; frame-ancestors 'none'"
// Additional security headers
"X-Content-Type-Options"
"nosniff"
"X-Frame-Options"
"DENY"
"Referrer-Policy"
"strict-origin-when-cross-origin"
"Permissions-Policy"
"camera=(), microphone=(), geolocation=()"
await
text
For APIs serving HTML responses (Razor Pages, Blazor Server), use a more permissive CSP with nonces:
```csharp
app.Use(async (context, next)
