AuthEndpoints
Changelog
Modules

Cookie auth

Identity cookie login, logout, and CSRF token endpoints for SPA hosts.

Cookie sign-in for first-party SPAs. Pair with Identity management.

DI

builder.Services.AddAntiforgery();
builder.Services.AddCookieAuthEndpoints(); // ReAuth schemes + rate limits

Map

app.MapGroup("/identity").MapCookieAuthEndpoints<AppUser>();

Routes

Relative to the group prefix (facade default /identity):

MethodPathNotes
POST/loginApplication cookie; lockout on failure; rate-limited
POST/logoutAuth + CSRF
GET/csrfTokenAntiforgery token for unsafe methods

Login body

Uses Identity login fields, including optional:

  • twoFactorCode
  • twoFactorRecoveryCode

SPA client notes

  1. Send cookies: credentials: "include" (or Axios withCredentials: true).
  2. GET /identity/csrfToken (or your prefix).
  3. On POST / PUT / PATCH / DELETE, send header RequestVerificationToken with the token value.

Gotchas

  • Pipeline must include authentication, authorization, rate limiting, and antiforgery.
  • Do not map cookie and bearer login on the same path without separate groups — pick one sign-in stack per prefix.
  • CORS must allow credentials if the SPA origin differs from the API.

Related

Identity management

Account lifecycle endpoints — register, confirm, forgot/reset password, manage info and 2FA.

Bearer auth

Identity bearer token login, refresh, and logout endpoints.