Authentication and Authorization
So far we’ve learned how to build a full-stack app but we’ll never be able to deploy it without securing it. If you publish a form that talks to a database and allow anyone to use it, it will eventually be found by bots designed to find database vulnerabilities. If you pay for your data server as you use it, the result will be a massive bill. 😟
In principle, creating a custom authentication and authorisation system is fairly easy. You can try it yourself with the knowledge you already have. Simply create a ‘user’ table with login and password and create a registration form that will insert a new user and a login form that will check the user input against that table. If the input password matches the one stored in the database they're 'authenticated' and 'authorized' to view your page. If not, redirect them to the login/registration area.
The reality is a little bit more complex though. Not only this simple approach is easy to hack, but any real A&A system will need to support functionalities like changing password, managing an account, confirming a registration, just to name a few. There are several battle-tested enterprise level approaches for this task. Since this is a .NET/C# course we'll be using an approach that's part of the .NET ecosystem: ASP.NET Core Identity offers scaffolding for dozens of these operations, shipping fully-functioning front and back-end solutions. And they’re customisable too! Let’s see how it works.
Requirements
In this project, you'll have two tasks. In a first moment you'll create a new Web App project with Identity as part of it.
In a second moment you'll scaffold Identity into the one of the Blazor or MVC apps you created before. If you chose the Angular or React paths, you'll have to learn how to create and run a basic Blazor or MVC or Razor Pages project to complete this task.
You need to use Entity Framework, raw SQL isn't allowed.
You need to seed test data.
You need to use EF's EnsureCreated method so the database and tables are created automatically.
You need to add logging logic to your app and save logs to your database when errors occur.
You don't need to handle auth scenarios such as e-mail confirmation, password recovery, etc. These will be addressed in future projects.
Your project needs to contain a Readme file that will contain information about what the app does, what technologies it uses, what you've learned in this project and what were your challenges. We suggest you don't use AI. This not only serves as documentation for your future self but it gives everyone a chance to see how you think and express yourself as a developer.
Resources
Here are a few resources that might be helpful.
Tips
If your front-end choice is React or Angular, you might want to go back and complete the first couple of projects of the Blazor or MVC areas first. Don't worry, it's fairly straightforward. And it won't be a waste of time. Even if you never work with these technologies again, this exposure to ASP.NET Core technologies and the .NET scaffolding system will make you a more well-rounded developer.
After wiring Identity up, you need to apply it to the controller you want to protect.
You'll only submit one project for review, however it's important to complete both tasks. Creating an app with identity from the beginning, and then scaffolding identity into an existing app. These are two different beasts and it's important to have exposure to both.
Comments
0 comments
No comments yet. Start the conversation.