ASP.NET Core MVC Interview Question #106

How does cookie authentication work in an MVC application?

Authentication, Authorization, Security & State Management Mid-Level Intermediate

Quick Interview Answer

Cookie authentication stores an encrypted authentication ticket in a browser cookie after sign-in. On later requests, the cookie authentication handler validates the cookie and reconstructs the user's ClaimsPrincipal.

Detailed Explanation

Cookie authentication stores an encrypted authentication ticket in a browser cookie after sign-in. On later requests, the cookie authentication handler validates the cookie and reconstructs the user's ClaimsPrincipal.

Cookies used for authentication should be protected with appropriate Secure, HttpOnly, SameSite, expiration, and data-protection settings. ASP.NET Core Identity builds on this infrastructure and adds comprehensive user-management features.

Code Example

builder.Services
    .AddAuthentication("AppCookie")
    .AddCookie("AppCookie", options =>
    {
        options.LoginPath = "/Account/Login";
        options.AccessDeniedPath = "/Account/Denied";
    });