What is the correct way to do SPA Authentication with ASP.NET Core 3?

user_12105299 0
Viewed 5076

The new ASP.NET Core 3 Angular project template with authentication uses Identity Server and OIDC for authentication. So far I have always used simple JWT-Authentication for my Angular SPA.

Now my question: What is the right approach to implement authentication if you want to use the login page of the Angular app?

So I already have an implemented login page in my Angular app, which I want to use. As far as I know, the OIDC workflow with Identity Server always uses a login page generated on the server. In my case, should I continue to use simple JWT-Authentication, or is it possible to use my Angular login page with Identity Server?

I'm pretty sure the problem lies in my lack of understanding of OIDC, but I have already read a book and several articles about it and still do not quite get it.

I would be very happy to receive an explanatory answer!

jwt angular asp.net-core oauth-2.0 openid-connect
2 Answers

Both OIDC and JWT are concrete industrial standards for stateless authentication.

Stateless authentication stores the user session data on the client side.

OAuth are more direct integrations with 3rd-party app (example google or github), but i think JWT is easier to implement and to manipulate.

But you aren't forced to use Identity or Identity Server, you can also implement your personal tables for authentication, but to answer your questions, yes, you can use IdentityServer with JWT: http://docs.identityserver.io/en/latest/topics/apis.html

I use Angular 8 and net.Core 3 Web Api with JWT and Microsoft Identity and Role tables

user_109947100

If you're doing a true SPA then you don't need asp.net at all. Use the oidc client library to manage security. If so there's a tutorial and code sample of mine that may help: https://authguidance.com/2017/09/24/basicspa-overview/

Or are you doing a server side web app? May depend on how you expect to host the web content ..

user_90198850
Related