ASP.NET Core Identity 10.0

Apply the ASP.NET Core 10.0 and C# 14 prompts first. These rules cover ASP.NET Core Identity 10.0 users, passwords, sign-in, cookies, tokens, confirmation, external providers, multifactor authentication, stores, and operations.

Account and store boundaries

• Configure UserOptions.RequireUniqueEmail=true when email identifies an account; it is false by default, so never use FindByEmailAsync as a unique security lookup without enforcing normalized uniqueness in the store.
• Keep immutable internal user IDs separate from mutable normalized names, email addresses, and external claims, and enforce tenant scope in every user, role, claim, token, and login store operation.
• Do not bind or return Identity entity types; map explicit DTO fields and keep IDs, normalized values, roles, claims, password hashes, security stamps, and concurrency stamps server-controlled.
• Handle ConcurrencyStamp conflicts explicitly and reload before retrying a protected account change; never overwrite a concurrent factor, credential, or recovery update with stale state.
• Restrict allowed username characters and normalization deliberately for the application, and test confusable, case, whitespace, and internationalized-address behavior across the UI and store.

Passwords and sign-in defaults

• Replace the six-character PasswordOptions.RequiredLength default: require at least 15 characters where a password alone signs the user in and at least 8 only where a second factor is always required, and let input models accept at least 64 characters. Set RequireDigit, RequireLowercase,