Cookie auth

Cookie sign-in for first-party web/browser clients. Pair with Identity management.

MapCookieAuthEndpoints (and the facade MapAuthEndpoints) maps LoginCookie to POST {prefix}/login. The scheme is always IdentityConstants.ApplicationScheme.

DI

builder.Services.AddAntiforgery();
builder.Services.AddCookieAuthEndpoints(); // ReAuth schemes + rate limits

The facade (AddAuthEndpoints) registers these for you.

Map

app.MapGroup("/identity").MapCookieAuthEndpoints<AppUser>();

The facade maps this group under IdentityPath (default /identity).

Routes

Relative to the group prefix (facade default /identity):

Login query string

LoginCookie reads only useSessionCookies. useCookies is ignored.

Persistent cookie: POST /identity/login?useSessionCookies=false.

Passkey register/login uses a different flag table. See Passkeys.

Login body

Identity LoginRequest:

• email
• password
• twoFactorCode (optional)
• twoFactorRecoveryCode (optional)

CSRF

POST /login does not require antiforgery. POST /logout and cookie-authenticated unsafe methods (POST / PUT / PATCH / DELETE on CSRF-protected routes) do.

Client notes

1. Send cookies: credentials: "include" (or Axios withCredentials: true).
2. POST /login does not require CSRF.
3. Before logout and other CSRF-protected unsafe methods, call GET /identity/csrfToken (or your prefix) and send header RequestVerificationToken with the token value.

Gotchas

• Pipeline must include authentication, authorization, rate limiting, and antiforgery.
• Do not map cookie and bearer login on the same path without separate groups — pick one sign-in stack per prefix.
• CORS must allow credentials if the web client origin differs from the API.
• Do not confuse LoginCookie with bearer Login (MapBearerAuthEndpoints).

Related

• Identity management
• Passkeys
• Bearer auth
• Composable recipes