跨 ASP.Net Core Web 应用程序使用 Azure AD B2C Cookie

Question

I have two ASP.Net Core 3 Web App projects. Both use Azure AD B2C to authenticate. One is technically an API but I have included the Cookie authentication service so that the browser can easily be used to make API requests.

This seems to work although each app likes to request its own cookie which overrides the other's. I could avoid them from overriding each others, but I'd prefer that once authenticated via the UI, the API can use the same cookie/bearer token. I can't find anything online but I am new to ASP.Net development to know if I'm searching for the right thing.

What's the best/correct approach for this?

Thanks! Tom

Answer 1

The recommended approach is:

• The web UI redirects authentication of the end user to Azure AD B2C. If authenticated, then it acquires an access token from Azure AD B2C and sends this access token in the Authorization header to the web API.
• The web API receives the access token in the Authorization header from the web app and validates it. If valid, then it allows the API call; otherwise, it denies it.

An example of this can be found in the Azure AD B2C: Call an ASP.NET Web API from an ASP.NET Web App sample .