Can we secure a dotnet core 2.0 React App with only aspnet identity?

Question

I am building a SPA using React and Redux on top of dotnet core 2.0. Unfortunately, the vs2017 template for this does not include Authentication/Authorization.

In looking around, I saw many people talking about the use of JWT's and suggesting things like Identity Server or OpenIddict to handle this, but I have only ever used ASP.NET identity to handle security before.

My question is, is it possible to secure a react app by using ASP.NET identity alone, and if so, why do so many people jump straight to JWT's as the solution for securing SPA apps?

Is token based authentication the only method that works with a SPA app, or can I use Cookie based authentication?

Answer 1

I will try to answer by your questions.

Q.1. Is it possible to secure a react app by using aspnet identity alone, and if so, why do so many people jump straight to JWT's as the solution for securing SPA apps?

Q.2. Is token based authentication the only method that works with a SPA app, or can I use Cookie based authentication?

Answer To First Question(this question technically related to difference between cookie based and token based authentication approach.)

Cookie based authentication system

• cookie based session is StateFull. as here server needs track of active session,while on front end/client end a cookie is created that holds a session identifier.
• you can secure your web api using cookie based authentication system. but in a very limited scope, because ,cookie based system doesn't work well, on native clients or suppose if your web api is going to be consumed by some other web api,

Token based authentication system

• it is StateLess as server doesn't keep here the track of which token are issued or which users are log in.

• Here server needs to verify only the validity of the token. so token based approach is more decupled than cokie based.

Sources

• https://auth0.com/blog/cookies-vs-tokens-definitive-guide/
• Update Above(Auth0) link not working any more Updated Link
• https://docs.microsoft.com/en-us/dotnet/standard/microservices-architecture/secure-net-microservices-web-applications/

Answer To Second Question

Yes you can implement cookie based authentication in spa by using OWIN Cookie Authentication middileware .

you can find more information regarding it on following link.

https://brockallen.com/2013/10/24/a-primer-on-owin-cookie-authentication-middleware-for-the-asp-net-developer/

Hope above will help.