Version: |

ASP.NET Core Authentication

This section is applicable if your application uses OWIN and classic .NET Framework. For OWIN stack, visit the Using OWIN Security for Authentication.

Let's see how to work with authentication in ASP.NET Core. To set up the standard cookie authentication, just add this snippet in the Startup.cs file.

app.UseCookieAuthentication(new CookieAuthenticationOptions {
    LoginPath = new PathString("/ComplexSamples/Auth/Login"),
    AuthenticationScheme = "Cookie",
    Events = new CookieAuthenticationEvents {
        OnRedirectToReturnUrl = c => DotvvmAuthenticationHelper.ApplyRedirectResponse(c.HttpContext, c.RedirectUri),
        OnRedirectToAccessDenied = c => DotvvmAuthenticationHelper.ApplyStatusCodeResponse(c.HttpContext, 403),
        OnRedirectToLogin = c => DotvvmAuthenticationHelper.ApplyRedirectResponse(c.HttpContext, c.RedirectUri),
        OnRedirectToLogout = c => DotvvmAuthenticationHelper.ApplyRedirectResponse(c.HttpContext, c.RedirectUri)
    AutomaticAuthenticate = true,
    AutomaticChallenge = true

Please note that authentication middlewares should be always registered before DotVVM. The authentication middleware needs to determine the current user (e.g. by parsing the authentication token from the cookie) before DotVVM takes control of the HTTP request.

The DotvvmAuthenticationHelper.ApplyRedirectResponse method is used to perform the redirect because DotVVM uses a different way to handle redirects. Because the HTTP requests invoked by the command bindings are done using AJAX, DotVVM cannot return the HTTP 302 code. Instead, it returns HTTP 200 with a JSON object which instructs DotVVM to load the new URL.

Login Page with ASP.NET Core Cookie Authentication

In the login page, you need to verify the user credentials and create the ClaimsIdentity object that represents the logged user's identity. Then, you need to pass the identity to the Context.GetAuthentication().SignInAsync method:

public class LoginViewModel : DotvvmViewModelBase
    public string UserName { get; set; }
    public string Password { get; set; }        

    public async Task Login()
        if (VerifyCredentials(UserName, Password)) 
            // the CreateIdentity is your own method which creates the IIdentity representing the user
            var identity = CreateIdentity(UserName);
            await Context.GetAuthentication().SignInAsync("Cookie", new ClaimsPrincipal(identity));

    private bool VerifyCredentials(string username, string password) 
        // verify credentials and return true or false

    private ClaimsIdentity CreateIdentity(string username) 
        var identity = new ClaimsIdentity(
                new Claim(ClaimTypes.Name, username),

                // add claims for each user role
                new Claim(ClaimTypes.Role, "administrator"),
        return identity;
Next Chapter


Help & Contribute

The documentation is maintained on GitHub.
We'll be happy if you edit the page and create a pull request.

Send message