dotnet / dotnet/AspNetCore.Docs

[Cookies] Sudden code change in Guide, not marked in diff and not told about

Open
#35,783 2 comments 0 reactions 0 assignees View on GitHub
:watch: Not Triaged aspnet-core/svc security/subsvc Source - Docs.ms
Dominant language
C#
Stars
13.1k
Forks
24.6k
Avg merge
1d 2h
Merged PRs (30d)
109

Description

### Description

in this section: https://learn.microsoft.com/de-de/aspnet/core/security/authentication/cookie?view=aspnetcore-9.0#add-cookie-authentication

I as beginner with asp net core do not know what the `HttpContextAcceccor` is for and dont know if there is any Information about this to be known, for what you are using this or whats the difference to consider, when to use the Generic registration and when the default one is enough:

marking this in the following two snippet you provided as 1st and 2nd sample on the linked page (updated version to current `net10.0` I am now using:

```diff
using Microsoft.AspNetCore.Authentication.Cookies;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRazorPages();
builder.Services.AddControllersWithViews();

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
.AddCookie();

+ builder.Services.AddHttpContextAccessor(); // Default method (?) and *below* the cookie auth

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
app.UseExceptionHandler("/Error");
app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseAuthentication();
app.UseAuthorization();

app.MapRazorPages();
app.MapDefaultControllerRoute();

app.Run();
```
and now notice this:
```diff
using Microsoft.AspNetCore.Authentication.Cookies;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRazorPages();
builder.Services.AddControllersWithViews();

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
.AddCookie(options =>
{
options.ExpireTimeSpan = TimeSpan.FromMinutes(20);
options.SlidingExpiration = true;
options.AccessDeniedPath = "/Forbidden/";
});

+ builder.Services.AddSingleton(); // suddenly we are using generic? Reason? Do we maybe need this?

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
app.UseExceptionHandler("/Error");
app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseAuthentication();
app.UseAuthorization();

app.MapRazorPages();
app.MapDefaultControllerRoute();

app.Run();
```

I would like the docs to somewhere tell us the difference between these ways of definition. the only resource I found so far is: https://stackoverflow.com/questions/55247071/cookiepolicyoptions-or-cookieauthenticationoptions
but its not getting completly clear to me.

Checking the markdown source for this page, I *eventually* have the point that's causing this problem, so you might be able to tackle this, beside the fact that you should at least add a small note when you change something in code, so we can learn when we should do this 👍

1. Here we see `HttpContext.User`, without any remark about its relation to `builder.Services.AddHttpContextAccessor();`

https://github.com/dotnet/AspNetCore.Docs/blob/bce9940f93520e4981be9a8fed348b390a839b1d/aspnetcore/security/authentication/cookie.md?plain=1#L31

2. And here, potentially coming from the MS Docs engine, we only see `SignInAsync()` but not that it is coming from the `.AuthenticationHttpContextExtensions.SignInAsync()`

https://github.com/dotnet/AspNetCore.Docs/blob/bce9940f93520e4981be9a8fed348b390a839b1d/aspnetcore/security/authentication/cookie.md?plain=1#L72

3. Same here with `SignInAsync()`

https://github.com/dotnet/AspNetCore.Docs/blob/bce9940f93520e4981be9a8fed348b390a839b1d/aspnetcore/security/authentication/cookie.md?plain=1#L86

So my question as User would be: Do I need this Registration of HttpContextAccessor() or not? I did not see it mentioned elsewere, not sure if its still up to date or anything special you could potentially add a small link for us to lookup if we dont know it already?

### Page URL

https://learn.microsoft.com/de-de/aspnet/core/security/authentication/cookie?view=aspnetcore-10.0

### Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authentication/cookie.md

### Document ID

b18a015b-914d-f014-f711-120d208904d9

### Platform Id

65dc346c-b9fc-27d6-5769-bf45e510ebae

### Article author

@Rick-Anderson

### Metadata

* ID: d2229fc6-f8c8-952e-e567-b1d5a463055a
* PlatformId: 65dc346c-b9fc-27d6-5769-bf45e510ebae
* Service: **aspnet-core**
* Sub-service: **security**

[Related Issues](https://github.com/dotnet/AspNetCore.Docs/issues?q=is%3Aissue+is%3Aopen+b18a015b-914d-f014-f711-120d208904d9)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.