Implementing Cookie Authentication in ASP.NET Core

In the previous article, we explored the concept of authentication, gaining an understanding of how user identity is verified. In this article, we’ll dive into implementing Cookie-based authentication in ASP.NET Core applications. Through this process, we’ll see clearly how user identity information is stored in a cookie—and how that cookie enables authentication for every subsequent request.

What Is Cookie Authentication?

Cookie authentication is a widely used authentication mechanism. When a user successfully logs in, the server generates a cookie and stores it in the user’s browser. This cookie typically contains user identity information and serves as a credential for subsequent requests. Each time the user sends a request, the browser automatically includes this cookie—allowing the server to recognize and authenticate the user.

Steps to Implement Cookie Authentication

1. Configure Services

First, we need to configure authentication services in the Startup.cs file. Add the following code inside the ConfigureServices method:

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
        .AddCookie(options =>
        {
            options.LoginPath = "/Account/Login"; // Redirect path when unauthenticated
            options.LogoutPath = "/Account/Logout"; // Redirect path after logout
            options.AccessDeniedPath = "/Account/AccessDenied"; // Redirect path when access is denied
        });

    // Other service configurations...
    services.AddControllersWithViews();
}

Here, we use AddAuthentication to register cookie authentication and specify basic settings—such as the redirect path for unauthenticated users.

2. Create a Login Controller

Next, we create a controller to handle login requests. Below is a simple example of an AccountController:

using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using System.Security.Claims;
using System.Threading.Tasks;

public class AccountController : Controller
{
    [HttpGet]
    public IActionResult Login()
    {
        return View();
    }

    [HttpPost]
    public async Task<IActionResult> Login(string username, string password)
    {
        // Add real validation logic here (e.g., query database to verify credentials)
        if (username == "admin" && password == "password") // Example validation
        {
            var claims = new[]
            {
                new Claim(ClaimTypes.Name, username)
                // Additional claims can be added here
            };
            var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
            var authProperties = new AuthenticationProperties
            {
                IsPersistent = true // Whether to persist login state across browser sessions
            };

            await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme,
                new ClaimsPrincipal(claimsIdentity), authProperties);

            return RedirectToAction("Index", "Home"); // Redirect after successful login
        }

        ModelState.AddModelError("", "Invalid login attempt.");
        return View();
    }

    [HttpPost]
    public async Task<IActionResult> Logout()
    {
        await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
        return RedirectToAction("Index", "Home"); // Redirect after logout
    }
}

In the Login action above, we first validate the user’s credentials. If validation succeeds, we construct a ClaimsIdentity, then call HttpContext.SignInAsync to store it in the user’s cookie.

3. Create the Login View

Next, we build a login page. Create a simple form in Views/Account/Login.cshtml:

@model YourNamespace.Models.LoginViewModel

<form asp-action="Login" method="post">
    <div>
        <label asp-for="Username"></label>
        <input asp-for="Username" />
    </div>
    <div>
        <label asp-for="Password"></label>
        <input asp-for="Password" type="password" />
    </div>
    <button type="submit">Log In</button>
</form>

4. Protect Resources Using the [Authorize] Attribute

By applying the [Authorize] attribute to controllers or actions, we restrict access to authenticated users only. For example:

[Authorize]
public class HomeController : Controller
{
    public IActionResult Index()
    {
        return View();
    }
}

If an unauthenticated user attempts to access such a resource, they are automatically redirected to the login page.

Summary

We’ve now walked through the foundational steps required to implement Cookie authentication. Users submit credentials via a login page; the server validates them and issues an authentication cookie; and that cookie is subsequently used to authenticate each request. This mechanism provides a secure and straightforward way to manage user state in your application.

In the next article, we’ll explore role-based authorization—learning how to control user access based on roles. Stay tuned!