[{"data":1,"prerenderedAt":748},["ShallowReactive",2],{"navigation":3,"\u002Fmodules\u002Fcookie-auth":203,"\u002Fmodules\u002Fcookie-auth-surround":743},[4,33,96,114,177],{"title":5,"path":6,"stem":7,"children":8,"icon":32},"Get started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22,27],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Install AuthEndpoints","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-play",{"title":23,"path":24,"stem":25,"icon":26},"Choose a sign-in stack","\u002Fgetting-started\u002Fchoose-a-sign-in-stack","1.getting-started\u002F4.choose-a-sign-in-stack","i-lucide-signpost",{"title":28,"path":29,"stem":30,"icon":31},"Use the AuthEndpoints skill with coding agents","\u002Fgetting-started\u002Fai-agents","1.getting-started\u002F5.ai-agents","i-lucide-bot","i-lucide-rocket",{"title":34,"path":35,"stem":36,"children":37,"icon":95},"Guides","\u002Fguides","2.guides\u002F01.index",[38,40,45,50,55,60,65,70,75,80,85,90],{"title":34,"path":35,"stem":36,"icon":39},"i-lucide-list-checks",{"title":41,"path":42,"stem":43,"icon":44},"Register users","\u002Fguides\u002Fregistration","2.guides\u002F02.registration","i-lucide-user-plus",{"title":46,"path":47,"stem":48,"icon":49},"Sign users in","\u002Fguides\u002Fsign-in","2.guides\u002F03.sign-in","i-lucide-log-in",{"title":51,"path":52,"stem":53,"icon":54},"Sign users out","\u002Fguides\u002Fsign-out","2.guides\u002F04.sign-out","i-lucide-log-out",{"title":56,"path":57,"stem":58,"icon":59},"Turn on two-factor authentication","\u002Fguides\u002Ftwo-factor","2.guides\u002F05.two-factor","i-lucide-smartphone",{"title":61,"path":62,"stem":63,"icon":64},"Reset a forgotten password","\u002Fguides\u002Freset-password","2.guides\u002F06.reset-password","i-lucide-key-round",{"title":66,"path":67,"stem":68,"icon":69},"Change a user's email or password","\u002Fguides\u002Fmanage-account","2.guides\u002F07.manage-account","i-lucide-user-cog",{"title":71,"path":72,"stem":73,"icon":74},"Add, rename, and remove passkeys","\u002Fguides\u002Fmanage-passkeys","2.guides\u002F08.manage-passkeys","i-lucide-scan-face",{"title":76,"path":77,"stem":78,"icon":79},"Link and unlink GitHub or Google accounts","\u002Fguides\u002Flink-external-accounts","2.guides\u002F09.link-external-accounts","i-lucide-link",{"title":81,"path":82,"stem":83,"icon":84},"Require step-up before sensitive actions","\u002Fguides\u002Fstep-up","2.guides\u002F10.step-up","i-lucide-shield-check",{"title":86,"path":87,"stem":88,"icon":89},"Call the API from a browser","\u002Fguides\u002Fbrowser-clients","2.guides\u002F11.browser-clients","i-lucide-globe",{"title":91,"path":92,"stem":93,"icon":94},"Prepare for production","\u002Fguides\u002Fproduction","2.guides\u002F12.production","i-lucide-factory","i-lucide-waypoints",{"title":97,"path":98,"stem":99,"children":100,"icon":113},"Composable endpoints","\u002Fcomposables","3.composables\u002F1.index",[101,104,108],{"title":102,"path":98,"stem":99,"icon":103},"How composition works","i-lucide-layout-grid",{"title":105,"path":106,"stem":107,"icon":39},"Composition requirements","\u002Fcomposables\u002Frequirements","3.composables\u002F2.requirements",{"title":109,"path":110,"stem":111,"icon":112},"Compose a custom auth stack","\u002Fcomposables\u002Frecipes","3.composables\u002F3.recipes","i-lucide-book-marked","i-lucide-blocks",{"title":115,"icon":116,"path":117,"stem":118,"children":119,"page":176},"Reference","i-lucide-book-open","\u002Fmodules","4.modules",[120,125,129,134,139,144,148,153,157,162,166,171],{"title":121,"path":122,"stem":123,"icon":124},"Endpoint reference","\u002Fmodules\u002Fendpoints","4.modules\u002F01.endpoints","i-lucide-route",{"title":126,"path":127,"stem":128,"icon":69},"Identity management module","\u002Fmodules\u002Fidentity-management","4.modules\u002F02.identity-management",{"title":130,"path":131,"stem":132,"icon":133},"Cookie sign-in module","\u002Fmodules\u002Fcookie-auth","4.modules\u002F03.cookie-auth","i-lucide-cookie",{"title":135,"path":136,"stem":137,"icon":138},"Identity bearer sign-in module","\u002Fmodules\u002Fbearer-auth","4.modules\u002F04.bearer-auth","i-lucide-key",{"title":140,"path":141,"stem":142,"icon":143},"JWT module","\u002Fmodules\u002Fjwt","4.modules\u002F05.jwt","i-lucide-fingerprint",{"title":145,"path":146,"stem":147,"icon":74},"Passkeys module","\u002Fmodules\u002Fpasskeys","4.modules\u002F06.passkeys",{"title":149,"path":150,"stem":151,"icon":152},"ReAuth module","\u002Fmodules\u002Freauth","4.modules\u002F07.reauth","i-lucide-shield-alert",{"title":154,"path":155,"stem":156,"icon":49},"External OAuth packages","\u002Fmodules\u002Fexternal-oauth","4.modules\u002F08.external-oauth",{"title":158,"path":159,"stem":160,"icon":161},"Configuration options","\u002Fmodules\u002Fconfiguration","4.modules\u002F09.configuration","i-lucide-settings",{"title":163,"path":164,"stem":165,"icon":84},"Antiforgery (CSRF) rules","\u002Fmodules\u002Fcsrf","4.modules\u002F10.csrf",{"title":167,"path":168,"stem":169,"icon":170},"Responses and errors","\u002Fmodules\u002Ferrors","4.modules\u002F11.errors","i-lucide-circle-alert",{"title":172,"path":173,"stem":174,"icon":175},"Rate-limit policies","\u002Fmodules\u002Frate-limits","4.modules\u002F12.rate-limits","i-lucide-gauge",false,{"title":178,"icon":179,"path":180,"stem":181,"children":182,"page":176},"Concepts","i-lucide-lightbulb","\u002Fconcepts","5.concepts",[183,188,193,198],{"title":184,"path":185,"stem":186,"icon":187},"AuthEndpoints compared with other options","\u002Fconcepts\u002Fcompare","5.concepts\u002F1.compare","i-lucide-git-compare",{"title":189,"path":190,"stem":191,"icon":192},"Stock Identity endpoints vs AuthEndpoints","\u002Fconcepts\u002Fstock-identity-vs-authendpoints","5.concepts\u002F2.stock-identity-vs-authendpoints","i-lucide-columns-2",{"title":194,"path":195,"stem":196,"icon":197},"Security model","\u002Fconcepts\u002Fsecurity-model","5.concepts\u002F3.security-model","i-lucide-shield",{"title":199,"path":200,"stem":201,"icon":202},"FAQ","\u002Fconcepts\u002Ffaq","5.concepts\u002F4.faq","i-lucide-circle-help",{"id":204,"title":130,"body":205,"description":736,"extension":737,"links":738,"meta":739,"navigation":740,"path":131,"seo":741,"stem":132,"__hash__":742},"docs\u002F4.modules\u002F03.cookie-auth.md",{"type":206,"value":207,"toc":722},"minimark",[208,218,240,245,299,306,310,352,361,365,371,440,444,462,513,519,524,559,566,570,577,600,604,631,635,664,668,692,696,718],[209,210,211,212,217],"p",{},"Cookie sign-in for first-party web\u002Fbrowser clients. Pair with ",[213,214,216],"a",{"href":215},"\u002Fmodules\u002Fidentity-management\u002F","Identity management",".",[209,219,220,224,225,228,229,232,233,236,237,217],{},[221,222,223],"code",{},"MapCookieAuthEndpoints"," (and the facade ",[221,226,227],{},"MapAuthEndpoints",") maps ",[221,230,231],{},"LoginCookie"," to ",[221,234,235],{},"POST {prefix}\u002Flogin",". The scheme is always ",[221,238,239],{},"IdentityConstants.ApplicationScheme",[241,242,244],"h2",{"id":243},"di","DI",[246,247,252],"pre",{"className":248,"code":249,"language":250,"meta":251,"style":251},"language-cs shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","builder.Services.AddAntiforgery();\nbuilder.Services.AddCookieAuthEndpoints(); \u002F\u002F ReAuth schemes + rate limits\n","cs","",[221,253,254,278],{"__ignoreMap":251},[255,256,259,263,266,269,271,275],"span",{"class":257,"line":258},"line",1,[255,260,262],{"class":261},"sTEyZ","builder",[255,264,217],{"class":265},"sMK4o",[255,267,268],{"class":261},"Services",[255,270,217],{"class":265},[255,272,274],{"class":273},"s2Zo4","AddAntiforgery",[255,276,277],{"class":265},"();\n",[255,279,281,283,285,287,289,292,295],{"class":257,"line":280},2,[255,282,262],{"class":261},[255,284,217],{"class":265},[255,286,268],{"class":261},[255,288,217],{"class":265},[255,290,291],{"class":273},"AddCookieAuthEndpoints",[255,293,294],{"class":265},"();",[255,296,298],{"class":297},"sHwdD"," \u002F\u002F ReAuth schemes + rate limits\n",[209,300,301,302,305],{},"The facade (",[221,303,304],{},"AddAuthEndpoints",") registers these for you.",[241,307,309],{"id":308},"map","Map",[246,311,313],{"className":248,"code":312,"language":250,"meta":251,"style":251},"app.MapGroup(\"\u002Fidentity\").MapCookieAuthEndpoints\u003CAppUser>();\n",[221,314,315],{"__ignoreMap":251},[255,316,317,320,322,325,328,331,335,337,340,342,345,349],{"class":257,"line":258},[255,318,319],{"class":261},"app",[255,321,217],{"class":265},[255,323,324],{"class":273},"MapGroup",[255,326,327],{"class":265},"(",[255,329,330],{"class":265},"\"",[255,332,334],{"class":333},"sfazB","\u002Fidentity",[255,336,330],{"class":265},[255,338,339],{"class":265},").",[255,341,223],{"class":273},[255,343,344],{"class":265},"\u003C",[255,346,348],{"class":347},"sBMFI","AppUser",[255,350,351],{"class":265},">();\n",[209,353,354,355,358,359,339],{},"The facade maps this group under ",[221,356,357],{},"IdentityPath"," (default ",[221,360,334],{},[241,362,364],{"id":363},"routes","Routes",[209,366,367,368,370],{},"Relative to the group prefix (facade default ",[221,369,334],{},"):",[372,373,374,390],"table",{},[375,376,377],"thead",{},[378,379,380,384,387],"tr",{},[381,382,383],"th",{},"Method",[381,385,386],{},"Path",[381,388,389],{},"Notes",[391,392,393,411,425],"tbody",{},[378,394,395,401,406],{},[396,397,398],"td",{},[221,399,400],{},"POST",[396,402,403],{},[221,404,405],{},"\u002Flogin",[396,407,408,410],{},[221,409,231],{},"; application cookie; lockout on failure; rate-limited",[378,412,413,417,422],{},[396,414,415],{},[221,416,400],{},[396,418,419],{},[221,420,421],{},"\u002Flogout",[396,423,424],{},"Auth + CSRF",[378,426,427,432,437],{},[396,428,429],{},[221,430,431],{},"GET",[396,433,434],{},[221,435,436],{},"\u002FcsrfToken",[396,438,439],{},"Antiforgery token for unsafe methods",[241,441,443],{"id":442},"login-query-string","Login query string",[209,445,446,448,449,453,454,457,458,461],{},[221,447,231],{}," reads ",[450,451,452],"strong",{},"only"," ",[221,455,456],{},"useSessionCookies",". ",[221,459,460],{},"useCookies"," is ignored.",[372,463,464,474],{},[375,465,466],{},[378,467,468,471],{},[381,469,470],{},"Query",[381,472,473],{},"Result",[391,475,476,484,493,503],{},[378,477,478,481],{},[396,479,480],{},"omitted",[396,482,483],{},"session application cookie",[378,485,486,491],{},[396,487,488],{},[221,489,490],{},"useSessionCookies=true",[396,492,483],{},[378,494,495,500],{},[396,496,497],{},[221,498,499],{},"useSessionCookies=false",[396,501,502],{},"persistent application cookie",[378,504,505,510],{},[396,506,507],{},[221,508,509],{},"useCookies=true",[396,511,512],{},"ignored",[209,514,515,516,217],{},"Persistent cookie: ",[221,517,518],{},"POST \u002Fidentity\u002Flogin?useSessionCookies=false",[520,521,523],"h3",{"id":522},"two-factor-and-remembered-browsers","Two-factor and remembered browsers",[209,525,526,527,530,531,534,535,538,539,542,543,546,547,550,551,554,555,558],{},"A persistent login (",[221,528,529],{},"?useSessionCookies=false",") with a valid ",[221,532,533],{},"twoFactorCode"," also sets the Identity two-factor remember-client cookie (",[221,536,537],{},"rememberClient"," is ",[221,540,541],{},"true"," when the login is persistent). Later password logins from that browser skip the 2FA challenge. A session login does not set the cookie. A ",[221,544,545],{},"twoFactorRecoveryCode"," login never sets it. ",[221,548,549],{},"POST \u002Fidentity\u002Fmanage\u002F2fa"," with ",[221,552,553],{},"{ \"forgetMachine\": true }"," clears it, and ",[221,556,557],{},"POST \u002Fidentity\u002Flogout"," clears it.",[209,560,561,562,217],{},"Passkey register\u002Flogin uses a different flag table. See ",[213,563,565],{"href":564},"\u002Fmodules\u002Fpasskeys\u002F","Passkeys",[241,567,569],{"id":568},"login-body","Login body",[209,571,572,573,576],{},"Identity ",[221,574,575],{},"LoginRequest",":",[578,579,580,586,591,596],"ul",{},[581,582,583],"li",{},[221,584,585],{},"email",[581,587,588],{},[221,589,590],{},"password",[581,592,593,595],{},[221,594,533],{}," (optional)",[581,597,598,595],{},[221,599,545],{},[241,601,603],{"id":602},"csrf","CSRF",[209,605,606,609,610,613,614,617,618,620,621,620,624,620,627,630],{},[221,607,608],{},"POST \u002Flogin"," does ",[450,611,612],{},"not"," require antiforgery. ",[221,615,616],{},"POST \u002Flogout"," and cookie-authenticated unsafe methods (",[221,619,400],{}," \u002F ",[221,622,623],{},"PUT",[221,625,626],{},"PATCH",[221,628,629],{},"DELETE"," on CSRF-protected routes) do.",[241,632,634],{"id":633},"client-notes","Client notes",[636,637,638,648,653],"ol",{},[581,639,640,641,644,645,339],{},"Send cookies: ",[221,642,643],{},"credentials: \"include\""," (or Axios ",[221,646,647],{},"withCredentials: true",[581,649,650,652],{},[221,651,608],{}," does not require CSRF.",[581,654,655,656,659,660,663],{},"Before logout and other CSRF-protected unsafe methods, call ",[221,657,658],{},"GET \u002Fidentity\u002FcsrfToken"," (or your prefix) and send header ",[221,661,662],{},"RequestVerificationToken"," with the token value.",[241,665,667],{"id":666},"gotchas","Gotchas",[578,669,670,673,676,679],{},[581,671,672],{},"Pipeline must include authentication, authorization, rate limiting, and antiforgery.",[581,674,675],{},"Do not map cookie and bearer login on the same path without separate groups — pick one sign-in stack per prefix.",[581,677,678],{},"CORS must allow credentials if the web client origin differs from the API.",[581,680,681,682,684,685,688,689,339],{},"Do not confuse ",[221,683,231],{}," with bearer ",[221,686,687],{},"Login"," (",[221,690,691],{},"MapBearerAuthEndpoints",[241,693,695],{"id":694},"related","Related",[578,697,698,702,706,712],{},[581,699,700],{},[213,701,216],{"href":215},[581,703,704],{},[213,705,565],{"href":564},[581,707,708],{},[213,709,711],{"href":710},"\u002Fmodules\u002Fbearer-auth\u002F","Bearer auth",[581,713,714],{},[213,715,717],{"href":716},"\u002Fcomposables\u002Frecipes\u002F","Composable recipes",[719,720,721],"style",{},"html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}",{"title":251,"searchDepth":258,"depth":280,"links":723},[724,725,726,727,731,732,733,734,735],{"id":243,"depth":280,"text":244},{"id":308,"depth":280,"text":309},{"id":363,"depth":280,"text":364},{"id":442,"depth":280,"text":443,"children":728},[729],{"id":522,"depth":730,"text":523},3,{"id":568,"depth":280,"text":569},{"id":602,"depth":280,"text":603},{"id":633,"depth":280,"text":634},{"id":666,"depth":280,"text":667},{"id":694,"depth":280,"text":695},"Identity cookie login, logout, and CSRF token endpoints for browser\u002Fweb clients.","md",null,{},{"icon":133},{"title":130,"description":736},"J_v53K9CRPVZYPri0LqBgCHLrjsQJmXhenZjSlCZnBY",[744,746],{"title":126,"path":127,"stem":128,"description":745,"icon":69,"children":-1},"Account lifecycle endpoints — register, confirm, forgot\u002Freset password, manage info and 2FA.",{"title":135,"path":136,"stem":137,"description":747,"icon":138,"children":-1},"Identity bearer token login, refresh, and logout endpoints.",1791123628011]