asp.net core cookie authentication properties

Question

see this small code
app.UseCookieAuthentication(new CookieAuthenticationOptions()
{
AuthenticationScheme = "MyCookieMiddlewareInstance",
LoginPath = new PathString("/Account/Unauthorized/"),
AccessDeniedPath = new PathString("/Account/Forbidden/"),
AutomaticAuthenticate = true,
AutomaticChallenge = true
});

1) what is this one AuthenticationScheme = "MyCookieMiddlewareInstance", ? is it cookie name or something else. please guide me.
2) if i set AutomaticAuthenticate = true and AutomaticChallenge = true what will happen?
if i do not mention this property then what will happen ?

if i set AutomaticAuthenticate = false and AutomaticChallenge = false then what will happen ?

please share idea. thanks

Answer 1

Hi @T.Zacks ,

According to the document:

1. The AuthenticationScheme in the options corresponds to the logical name for a particular authentication scheme. A different value may be assigned in order to use the same authentication middleware type more than once in a pipeline.
2. AutomaticAuthenticate: If true the authentication middleware alter the request user coming in. If false the authentication middleware will only provide identity when explicitly indicated by the AuthenticationScheme.
3. AutomaticChallenge: If true the authentication middleware should handle automatic challenge. If false the authentication middleware will only alter responses when explicitly indicated by the AuthenticationScheme.

----------

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best regards,
Qing Guo

Answer 2

Read this article.

Answer 3

asp.net .net core supports a site having more than one authentication provider. of example say your site used a database login system for normal users and ad authentication for the admin. there are two sets of users and two sets of roles and two authentication cookie types. to keep these separate, you define a scheme (just a name) for each one.

when the middleware converts the cookie to an identity it nows which scheme. the authorize attributes also refer to. scheme, so protection can be based on the user type.

another example if your site allows google, Facebook and twitter logins. each would have it own scheme. when the cookie is read, the scheme lets the middleware know what type of login. you can then also have code that only google users had access to if you wanted.

note: asp.net core defines a default scheme. if you use more than one, you need to define the additional schemes.