I apologize if this is off topic for the site but I could think nowhere else to ask it.

I've been attempting to implement my own cookie based authentication solution in Blazor Server, whereby a user logs in with a username and password, receives a token which is stored as a cookie, and then uses this token to login again without needing to be prompted. To be clear the user can currently login fine without a cookie (login credentials are stored in the db, with the password hashed), however I want automatic login persistence via the form of a token, and nothing more than that (no need for authorization, etc).

All of the official Microsoft documentation doesn't state how to do this directly - it involves libraries that abstract away these details, and often rely on SQL Server with no explanation as to how a different backend db could be used to store user information and tokens (eg: https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity-custom-storage-providers?view=aspnetcore-6.0 attempts to explain alternative backends using Identity but doesn't provide the full source code or explanation as to how it can be done for a non-expert such as myself, and again it relies on another package: Identity).

Books, tutorials, and all other resources I can find explain how to do this with Entity Framework or Active Directory, neither of which interest me, and usually using some abstract package which does things in a way I don't want it to. I want to implement the entire authentication solution in Postgresql (perhaps using Npgsql) from scratch so I can gain intuition as to how things are happening. I don't need to be hand held through the postgresql, but if it could simply be stated what sort of tables I need to create, that would suffice. I have some understanding of JWT bearer tokens (overkill for this I believe as these are more difficult to revoke) and OAuth, however given the site will be for production I don't trust myself enough that my own solution will be implemented correctly. I have implemented a simple authentication solution in javascript/typescript before, so I know it can be done without a lot of complexity or abstraction, but again I don't trust myself to translate this into .Net.

Other languages seem to explain the steps to implement an authentication solution from scratch (apart from using libraries for crucial things such as token generation/encryption/hashing) using one's own preferred db source, but for some reason I can't find any solid resource on this in .Net, which all assume some abstracted dependency which hides away crucial details. To be clear - I can appreciate the need for abstract libraries written by professionals as things grow large, but I'd like to start from first principles and see things working fully without abstraction, using my own preferred backend db, with raw sql (which I know), and not any ORM, etc.

Could someone guide me here? My last resort is using tutorials in python, Go, javascript etc, and translating the source code to C#. But this seems incredibly ridiculous that not a single resource or basic package exists that would allow someone programming in Blazor/Asp.Net to do authentication without relying on heavy abstraction hiding away how things are working at a lower level.

Also, if someone is curious why I wish to take this approach, it's due to two reasons -

  1. Full control, allowing for heavy customization over the authentication process (eg: I may wish to inject my own phone number verification, biometric requirements, etc, in a way that I want, and not in the way some package wants. I'm sure these things I want are possible with abstract packages but I don't want to be fighting with them to get things exactly how I want, I'd rather just understand how everything is working so I can easily change things)
  2. Educational. Even if I do wish to use abstract authentication libraries, Id still like to see things working so I can gain some intuition as to how authentication can work in Blazor or Asp.Net Core with as little 'magic' as possible (and I of course concede some magic must exist, but the less of it, the more control I retain).

And yes, I'm very much aware of the additional security implications of doing things myself, but still wish to do so anyway due to the control offered, and educational experience. And it's also why I'm searching for some resource or software that can help facilitate this process instead of me doing it entirely in the dark without much confidence. I could role my own solution right now, but I wouldn't trust it.


Browse other questions tagged or ask your own question.