An authentication credential is information presented to establish a user's identity. In the standard username-and-password case, the username is public while the password is known only by the user. Authentication must happen before authorization can decide whether that user may access a feature. section 39.2
ASP.NET Core applications submit credentials to an authentication endpoint. A login form posts the values to an AccountController action, where SignInManager and UserManager authenticate the user. Failed authentication returns a model-validation error; successful authentication redirects to the requested URL. section 11.4
A practical credential flow includes these concerns:
- Collect the username and password in a view model, requiring both values through model validation. section 11.4
- Post the credentials over the login form and protect the request with an antiforgery token. section 11.4
- Keep authentication on the server; client-side validation can improve feedback but must not authenticate users. section 11.4
- Persist successful authentication in a cookie for later requests, or use bearer tokens for web services and JavaScript clients. section 39.6
SportsStore login
A user requesting a restricted page is redirected to /Account/Login. The GET action supplies a LoginModel and return URL; the POST action validates the submitted credentials, signs the user in when they are correct, and redirects back to the original destination. section 11.4
Listing 11.12 The LoginModel.cs file in the SportsStore/Models/ViewModels folder
using System.ComponentModel.DataAnnotations;
namespace SportsStore.Models.ViewModels {
public class LoginModel {
public required string Name { get; set; }
public required string Password { get; set; }
public string ReturnUrl { get; set; } = "/";
}
}
Inspect the LoginModel definition to see the credential fields and return URL used by the login workflow. section 11.4
