0

I'm developing a .NET Core Identity API using the following setup:

builder.Services.AddIdentityApiEndpoints<AppUser>()
                .AddRoles<AppRole>()
                .AddEntityFrameworkStores<AppDbContext>();

This gives me the prebuilt endpoints for login, register, etc., which work fine through the API.

Now, I want to create a separate ASP.NET Core web application (not an API), and use these existing endpoints for login/register—just like traditional Identity is used in Razor Pages or MVC projects. I also want to use attributes like [Authorize], [Authorize(Roles = "...")], etc., just like in a typical Identity setup.

The problem is: I don't want to manually write authentication/authorization middleware. I'd like to reuse the API directly for auth, including role-based authorization.

I've seen that when I use ?useCookies=true&useSessionCookies=true during login in the API, I don't need to send the bearer token on each request to access authorized endpoints—the session/cookie is used instead.

My questions are:

  • Can I use these Identity API endpoints directly in my ASP.NET Core web project and still have full authentication and role-based authorization features (without writing custom middleware)?

  • If I enable useCookies=true&useSessionCookies=true during login, can I reuse that session/cookie in the web project so that I don’t have to manually handle tokens or headers?

I'm looking for a clean, built-in way to make this work, ideally without reinventing the wheel. Any guidance or sample implementation would be appreciated!

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.