aspnet-dual-auth

What problem does it solve?

Many APIs must serve both same-origin SPAs that rely on secure cookies and external clients that use Bearer JWTs, but ASP.NET Core's default authentication assumes a single scheme which leads to cookies not being set, SPAs redirecting to signin, or 401 responses turning into 302 redirects.

Core Features & Use Cases

• Automatic Scheme Selection: Uses a policy scheme that inspects the request and forwards to JwtBearer when an Authorization: Bearer header is present or to Cookie authentication for same-origin SPA requests.
• Safe SPA Cookies: Recommends HttpOnly, secure cookies with SameSite=Lax and sliding expiration to preserve sessions without localStorage.
• API-Friendly Responses: Overrides cookie redirect events to return 401/403 for API calls and provides a pattern to issue both a cookie for the SPA and a JWT for external clients.
• Use Case: A React/Vue/Angular SPA served from the same origin can authenticate via an HttpOnly cookie while mobile apps or third-party services use JWTs.

Quick Start

Configure the API to use a policy selector that chooses JWT for Authorization: Bearer requests and cookies for same-origin SPA requests, set cookie options to HttpOnly, SameSite=Lax and secure, and ensure the cookie events return 401/403 for API calls.