[{"data":1,"prerenderedAt":501},["ShallowReactive",2],{"navigation":3,"\u002Fcomposables\u002Frequirements":94,"\u002Fcomposables\u002Frequirements-surround":496},[4,33,52],{"title":5,"path":6,"stem":7,"children":8,"icon":32},"Getting Started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-play",{"title":23,"path":24,"stem":25,"icon":26},"Configuration","\u002Fgetting-started\u002Fconfiguration","1.getting-started\u002F4.configuration","i-lucide-settings",{"title":28,"path":29,"stem":30,"icon":31},"Production","\u002Fgetting-started\u002Fproduction","1.getting-started\u002F5.production","i-lucide-shield-check","i-lucide-rocket",{"title":34,"path":35,"stem":36,"children":37,"icon":51},"Composable Endpoints","\u002Fcomposables","2.composables\u002F1.index",[38,41,46],{"title":39,"path":35,"stem":36,"icon":40},"Overview","i-lucide-layout-grid",{"title":42,"path":43,"stem":44,"icon":45},"Requirements","\u002Fcomposables\u002Frequirements","2.composables\u002F2.requirements","i-lucide-list-checks",{"title":47,"path":48,"stem":49,"icon":50},"Recipes","\u002Fcomposables\u002Frecipes","2.composables\u002F3.recipes","i-lucide-book-marked","i-lucide-blocks",{"title":53,"icon":54,"path":55,"stem":56,"children":57,"page":93},"Modules","i-lucide-package","\u002Fmodules","3.modules",[58,63,68,73,78,83,88],{"title":59,"path":60,"stem":61,"icon":62},"Identity management","\u002Fmodules\u002Fidentity-management","3.modules\u002F1.identity-management","i-lucide-user-cog",{"title":64,"path":65,"stem":66,"icon":67},"Cookie auth","\u002Fmodules\u002Fcookie-auth","3.modules\u002F2.cookie-auth","i-lucide-cookie",{"title":69,"path":70,"stem":71,"icon":72},"Bearer auth","\u002Fmodules\u002Fbearer-auth","3.modules\u002F3.bearer-auth","i-lucide-key",{"title":74,"path":75,"stem":76,"icon":77},"JWT","\u002Fmodules\u002Fjwt","3.modules\u002F4.jwt","i-lucide-fingerprint",{"title":79,"path":80,"stem":81,"icon":82},"Passkeys","\u002Fmodules\u002Fpasskeys","3.modules\u002F5.passkeys","i-lucide-scan-face",{"title":84,"path":85,"stem":86,"icon":87},"ReAuth","\u002Fmodules\u002Freauth","3.modules\u002F6.reauth","i-lucide-shield-alert",{"title":89,"path":90,"stem":91,"icon":92},"External OAuth","\u002Fmodules\u002Fexternal-oauth","3.modules\u002F7.external-oauth","i-lucide-log-in",false,{"id":95,"title":42,"body":96,"description":489,"extension":490,"links":491,"meta":492,"navigation":493,"path":43,"seo":494,"stem":44,"__hash__":495},"docs\u002F2.composables\u002F2.requirements.md",{"type":97,"value":98,"toc":480},"minimark",[99,103,108,207,210,214,279,282,298,301,305,315,322,326,366,370,373,437,444,448,451,461,465,476],[100,101,102],"p",{},"Misconfigured composition is the most common integration issue. Follow these rules when you skip the facade (or when you extend it).",[104,105,107],"h2",{"id":106},"_1-di-must-match-maps","1. DI must match maps",[109,110,111,124],"table",{},[112,113,114],"thead",{},[115,116,117,121],"tr",{},[118,119,120],"th",{},"You map…",[118,122,123],{},"You must register…",[125,126,127,143,156,168,185,197],"tbody",{},[115,128,129,136],{},[130,131,132],"td",{},[133,134,135],"code",{},"MapIdentityManagementApi",[130,137,138,139,142],{},"Identity API endpoints + EF stores + token providers (as with ",[133,140,141],{},"AddIdentityApiEndpoints"," \u002F facade)",[115,144,145,150],{},[130,146,147],{},[133,148,149],{},"MapCookieAuthEndpoints",[130,151,152,155],{},[133,153,154],{},"AddCookieAuthEndpoints()"," (+ antiforgery)",[115,157,158,163],{},[130,159,160],{},[133,161,162],{},"MapBearerAuthEndpoints",[130,164,165],{},[133,166,167],{},"AddBearerAuthEndpoints()",[115,169,170,175],{},[130,171,172],{},[133,173,174],{},"MapJwtAuthEndpoints",[130,176,177,180,181,184],{},[133,178,179],{},"AddJwtEndpoints\u003CTUser, TContext>(…)"," and ",[133,182,183],{},"UseRefreshToken()"," on the DbContext",[115,186,187,192],{},[130,188,189],{},[133,190,191],{},"MapPasskeyEndpoints",[130,193,194],{},[133,195,196],{},"AddPasskeyEndpoints()",[115,198,199,202],{},[130,200,201],{},"CSRF-protected routes",[130,203,204],{},[133,205,206],{},"AddAntiforgery()",[100,208,209],{},"Cookie and bearer helpers also register ReAuth schemes and rate-limit policies used by login\u002Faccount flows.",[104,211,213],{"id":212},"_2-pipeline-order","2. Pipeline order",[215,216,221],"pre",{"className":217,"code":218,"language":219,"meta":220,"style":220},"language-cs shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","app.UseAuthentication();\napp.UseAuthorization();\napp.UseRateLimiter();\napp.UseAntiforgery();\n","cs","",[133,222,223,243,255,267],{"__ignoreMap":220},[224,225,228,232,236,240],"span",{"class":226,"line":227},"line",1,[224,229,231],{"class":230},"sTEyZ","app",[224,233,235],{"class":234},"sMK4o",".",[224,237,239],{"class":238},"s2Zo4","UseAuthentication",[224,241,242],{"class":234},"();\n",[224,244,246,248,250,253],{"class":226,"line":245},2,[224,247,231],{"class":230},[224,249,235],{"class":234},[224,251,252],{"class":238},"UseAuthorization",[224,254,242],{"class":234},[224,256,258,260,262,265],{"class":226,"line":257},3,[224,259,231],{"class":230},[224,261,235],{"class":234},[224,263,264],{"class":238},"UseRateLimiter",[224,266,242],{"class":234},[224,268,270,272,274,277],{"class":226,"line":269},4,[224,271,231],{"class":230},[224,273,235],{"class":234},[224,275,276],{"class":238},"UseAntiforgery",[224,278,242],{"class":234},[100,280,281],{},"The facade equivalent is a single call:",[215,283,285],{"className":217,"code":284,"language":219,"meta":220,"style":220},"app.UseAuthEndpoints();\n",[133,286,287],{"__ignoreMap":220},[224,288,289,291,293,296],{"class":226,"line":227},[224,290,231],{"class":230},[224,292,235],{"class":234},[224,294,295],{"class":238},"UseAuthEndpoints",[224,297,242],{"class":234},[100,299,300],{},"Without rate limiting and antiforgery middleware, endpoint policies and CSRF filters will not behave correctly.",[104,302,304],{"id":303},"_3-map-management-once","3. Map management once",[100,306,307,308,310,311,235],{},"In production hosts, map ",[133,309,135],{}," ",[312,313,314],"strong",{},"once",[100,316,317,318,321],{},"If you intentionally map management on two groups (for example cookie + bearer test hosts), pass a unique ",[133,319,320],{},"confirmEmailEndpointName"," for the second map so email confirmation link generation stays unambiguous.",[104,323,325],{"id":324},"_4-antiforgery-rules","4. Antiforgery rules",[327,328,329,337,348,359],"ul",{},[330,331,332,333,336],"li",{},"Cookie and other CSRF-sensitive endpoints use ",[133,334,335],{},"RequireAntiforgery()"," (endpoint filter).",[330,338,339,340,343,344,347],{},"Bearer JWT \u002F Identity bearer: the filter ",[312,341,342],{},"skips"," CSRF when the request is authenticated via bearer schemes and ",[312,345,346],{},"not"," the application\u002Fexternal cookie.",[330,349,350,351,354,355,358],{},"Clients: ",[133,352,353],{},"GET …\u002FcsrfToken"," → send ",[133,356,357],{},"RequestVerificationToken"," on unsafe methods.",[330,360,361,362,365],{},"Optional host middleware: ",[133,363,364],{},"AntiforgeryEnforcementMiddleware"," (the Demo sample uses it; filter-only is enough for mapped endpoints).",[104,367,369],{"id":368},"_5-rate-limit-policies","5. Rate-limit policies",[100,371,372],{},"Policies are registered by cookie\u002Fbearer\u002FJWT\u002Fpasskey DI helpers:",[109,374,375,385],{},[112,376,377],{},[115,378,379,382],{},[118,380,381],{},"Policy constant",[118,383,384],{},"Typical use",[125,386,387,397,407,417,427],{},[115,388,389,394],{},[130,390,391],{},[133,392,393],{},"AuthEndpoints.Login",[130,395,396],{},"Login \u002F token create \u002F refresh (token bucket: 10 tokens, +2 \u002F 10s per IP)",[115,398,399,404],{},[130,400,401],{},[133,402,403],{},"AuthEndpoints.AccountAbuse",[130,405,406],{},"Account abuse–sensitive actions (10 \u002F minute per IP)",[115,408,409,414],{},[130,410,411],{},[133,412,413],{},"AuthEndpoints.ConfirmIdentity",[130,415,416],{},"ReAuth confirm (20 \u002F minute per IP)",[115,418,419,424],{},[130,420,421],{},[133,422,423],{},"AuthEndpoints.Passkey.ObtainOptions",[130,425,426],{},"Passkey options (5 \u002F minute per IP)",[115,428,429,434],{},[130,430,431],{},[133,432,433],{},"AuthEndpoints.Passkey.Register",[130,435,436],{},"Passkey register (3 \u002F minute per IP)",[100,438,439,440,443],{},"Ensure ",[133,441,442],{},"UseRateLimiter()"," runs in the pipeline.",[104,445,447],{"id":446},"_6-reauth-for-sensitive-mutations","6. ReAuth for sensitive mutations",[100,449,450],{},"Manage 2FA\u002Finfo mutations and passkey add\u002Frename\u002Fdelete\u002FcreationOptions require step-up ReAuth (plus antiforgery where applicable).",[100,452,453,454,457,458,235],{},"Hosts can protect their own endpoints with ",[133,455,456],{},".RequireReauth()"," after registering ReAuth schemes. See ",[459,460,84],"a",{"href":85},[104,462,464],{"id":463},"related","Related",[327,466,467,471],{},[330,468,469],{},[459,470,47],{"href":48},[330,472,473],{},[459,474,475],{"href":19},"Quick start facade",[477,478,479],"style",{},"html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":220,"searchDepth":227,"depth":245,"links":481},[482,483,484,485,486,487,488],{"id":106,"depth":245,"text":107},{"id":212,"depth":245,"text":213},{"id":303,"depth":245,"text":304},{"id":324,"depth":245,"text":325},{"id":368,"depth":245,"text":369},{"id":446,"depth":245,"text":447},{"id":463,"depth":245,"text":464},"Hard prerequisites for composing AuthEndpoints modules correctly.","md",null,{},{"icon":45},{"title":42,"description":489},"ltmQIx4suYxTOD4HUe1hC6eolJ95Kt1jPdrZz-5fzoo",[497,499],{"title":39,"path":35,"stem":36,"description":498,"icon":40,"children":-1},"Compose Identity management, sign-in stacks, and passkeys on the prefixes your host needs.",{"title":47,"path":48,"stem":49,"description":500,"icon":50,"children":-1},"Common composition patterns for cookie SPA, Identity bearer, JWT-only, and custom paths.",1785399440325]