asp.net-coreblazor-webassemblyasp.net-authentication

ASP.NET Core: how long is new ApplicationUser logged in?


I'm currently creating a Blazor WASM web app and I stumbled across the following:

I'm able to authenticate anonymous users as "Alice" using the following lines within a Web API endpoint (apparently without storing anything in the database):

var user = new ApplicationUser();
user.Email = "test@awesomemail.makeitwork";
user.UserName = "Alice";

await _signInManager.SignInAsync(user, false);

My questions are:

  1. How does the SignInManager keep track of Alice while not storing anything into the database?
  2. How long is the user authenticated this way? As long as the client keeps the cookie? Until the server restarts?
  3. Will the SignInManager remove the "cached" user after a while?
  4. If so (3.), am I able to offer an endpoint that automatically reassigns the "anonymous" identity "Alice" to the user if he still has said cookie?

Solution

  • How does the SignInManager keep track of Alice while not storing anything into the database?

    It generate a value inside the cookie, if you don't write any logic to store something based on this cookie, it will not store into the database.

    How long is the user authenticated this way? As long as the client keeps the cookie? Until the server restarts?

    Check the generated cookies:

    enter image description here

    This is a session cookie, normally, session cookies are removed when the client shuts down. But, different browser may handle session cookie different.

    Will the SignInManager remove the "cached" user after a while?

    When the cookie expires, the user is missed.

    LIf so (3.), am I able to offer an endpoint that automatically reassigns the "anonymous" identity "Alice" to the user if he still has said cookie?

    Normally, no need do this thing. You could directly generate a name inside the cookie to identitiy which user is accessing your application without calling the _signInManager.