Nedo.AspNet.Authentication.Local 2.0.7

Nedo.AspNet.Authentication.Local

Username/password authentication with refresh-token families (with reuse detection), EF Core persistence, email verification, password reset, magic-link sign-in, account management endpoints, and the user store all social providers (Google, Microsoft, Apple, GitHub, Facebook, Keycloak) plug into.

Optional layers: TOTP 2FA (auto-gates every sign-in path), Passkeys / WebAuthn (passwordless or step-up), Dev impersonation (no-password endpoint for local dev + integration tests).

Install

dotnet add package Nedo.AspNet.Authentication.Local
dotnet add package Microsoft.EntityFrameworkCore.Sqlite      # or Npgsql / SqlServer / MySql

Quickstart

using Microsoft.EntityFrameworkCore;
using Nedo.AspNet.Authentication;
using Nedo.AspNet.Authentication.Local;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddLocalAuthentication(opts =>
{
    opts.SigningKey            = builder.Configuration["Jwt:Secret"]!;  // ≥ 32 bytes
    opts.Issuer                = "my-app";
    opts.Audience              = "my-app";
    opts.AccessTokenLifetime   = TimeSpan.FromMinutes(15);
    opts.RefreshTokenLifetime  = TimeSpan.FromDays(7);
    opts.MaxFailedAttempts     = 5;
    opts.LockoutDuration       = TimeSpan.FromMinutes(15);
});

builder.Services.AddLocalAuthStore(
    db => db.UseSqlite("Data Source=auth.db"),     // or UseNpgsql / UseSqlServer
    autoMigrate: true);

builder.Services.AddPasswordHasher<BcryptPasswordHasher>();   // your impl

builder.Services.AddHttpContextAccessor();
builder.Services.AddScoped<IAuthContext, AuthContext>();
builder.Services.AddAuthorization();

var app = builder.Build();
app.UseAuthentication();
app.UseNedoAuthContext();
app.UseAuthorization();
app.MapLocalAuth();      // /auth/login, /register, /refresh, /logout, /change-password,
                         // /verify-email, /forgot-password, /reset-password,
                         // /magic-link/{request,redeem}, /complete-external-signup
app.MapLocalAccount();   // /account/external-logins, /account/sessions
app.Run();

Endpoints

Full reference: docs/local/api-reference.md.

Extensibility hooks

Walkthroughs: docs/local/extensibility.md.

Why use this

• Refresh-token families — every refresh belongs to a family; reuse of a revoked token revokes the entire chain (other sessions unaffected). Catches the standard refresh-token theft pattern.
• Auto-link CVE-safe — social sign-ins only auto-link to existing local users when both sides have a verified email, blocking the "register the victim's email but never confirm it, then wait for them to social-sign-in" attack.
• Five focused services — LocalAuthService, RegistrationService, ExternalSignInService, PasswordResetService, EmailVerificationService (+ MagicLinkService), all sharing one SessionTokenIssuer. Easy to test or replace in isolation.
• Discriminated outcomes — every flow returns AuthOutcome (Tokens / PendingSignup / RequiresMfa / InfoMessage / Failure), so endpoints switch on the concrete subtype rather than reading an "everything optional" struct.

Architecture deep-dive: docs/local/internals.md.

Custom schema mapping

Every table + column name is configurable via LocalAuthSchemaOptions:

builder.Services.AddLocalAuthStore(
    db => db.UseNpgsql(connectionString),
    schema =>
    {
        schema.Schema = "identity";
        schema.UsersTable.TableName = "users";
        schema.UsersTable.Columns.Username = "login_name";
        schema.RefreshTokensTable.TableName = "tokens";
        schema.PasskeysTable.TableName = "credentials";
    });

Related packages

License

MIT — see LICENSE.