ASP.NET Core Identity 8.0

Last reviewed Sep 6, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. C# 12124 lines · 4.2K tokens
  2. ASP.NET Core 8.063 lines · 3K tokens
  3. ASP.NET Core Identity 8.055 lines · 3.3K tokens
Total242 lines · 10.5K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 89
  • 94
  • 117
  • 190
  • 204
  • 208
  • 209
  • 214
  • 257
  • 287
  • 295
  • 307
  • 312
  • 319
  • 323
  • 327
  • 338
  • 347
  • 352
  • 362
  • 367
  • 378
  • 426
  • 434
  • 488
  • 502
  • 521
  • 524
  • 525
  • 532
  • 552
  • 601
  • 613
  • 614
  • 620
  • 636
  • 639
  • 640
  • 674
  • 732
  • 759
  • 770
  • 772
  • 775
  • 798
  • 807
  • 841
  • 862
  • 915
  • 916
  • 918
  • 942
  • 1004
  • 1275
  • 1333
  • 1395

Prompt Preview

Apply the included ASP.NET Core 8.0 baseline first. These rules cover ASP.NET Core Identity 8.0 account stores, password and sign-in flows, Identity cookies, security stamps, recovery tokens, external logins, multifactor authentication, and the Identity API endpoints introduced in .NET 8. Identity ships in the ASP.NET Core shared framework, so it takes the .NET 8 runtime's servicing updates, while Microsoft.AspNetCore.Identity.UI and Microsoft.AspNetCore.Identity.EntityFrameworkCore are separate packages that move only when you update them; keep them on the same servicing release.

Registration and account identity

  • Choose the registration surface deliberately: AddDefaultIdentity supplies the default UI and token providers, AddIdentity exposes the broader configurable stack, and AddIdentityApiEndpoints<TUser> enables both Identity cookies and proprietary bearer tokens. Do not register a surface merely because a template includes it.
  • Configure IdentityOptions after the Identity registration call and verify the effective startup options. The defaults do not require a confirmed email, phone number, or account, so set SignIn.RequireConfirmedAccount or RequireConfirmedEmail when possession must be verified before sign-in; a custom IUserConfirmation<TUser> is consulted only with RequireConfirmedAccount enabled.
  • Treat the Identity user ID as an immutable application principal key. Do not authorize by mutable email, user name, display name, or an external provider's unverified claims, and keep tenant membership and object ownership checks separate from