API Auth via IdentityServer

[mkArtakMSFT]

details TBD but likely just adds IdentityServer & JWT middleware then

[blowdart]

@DamianEdwards this means template changes which aren't to simplify. So what do you want to do?

[SidShetye]

There is a related ticket open on the ASP.NET documentation about API security of an ASP.NET api application using IdentityServer (plus an SPA using said APIs).

The current VS templates are using the deprecated OAuth2 implicit flow instead of the OAuth2 OIDC PKCE flow. OAuth 2 is fairly complicated so if the ASP.NET API + authentication templates don't supply a simplified "pre-wired" starting point, it will simply promote bad practices. This "pre-wired" template is especially important because currently identity server 4's documentation is broken against ASP.NET 3.0, adding even more pain.

[Pilchie]

Ping on this, since it's currently in Preview7, which doesn't seem likely at this point.

[Pilchie]

Moving to backlog since nothing has happened here.

[HaoK]

@blowdart is this tracking future work still?

[blowdart]

Closing, because the whole thing needs a rethink anyway :)