Advanced Authentication & Authorization

Trigger On

• setup JWT auth với refresh token rotation
• integrate Google/Microsoft/Facebook/Azure AD login (OAuth2/OIDC)
• scaffold ASP.NET Core Identity, customize IdentityUser, claims
• multi-scheme: JWT cho /api, Cookie cho /admin
• custom AuthorizationHandler cho business rule (e.g., "user own resource")
• roles vs claims vs policies — chọn đúng pattern
• anti-forgery cho SPA + API cookie auth
• migrate từ ASP.NET Membership / IdentityServer cũ

Documentation