AspNet.Security.OAuth.Providers

AspNet.Security.OAuth.Providers is a collection of security middleware that you can use in your ASP.NET Core application to support social authentication providers like GitHub, Twitter/X or Dropbox. It is directly inspired by Jerrie Pelser's initiative, Owin.Security.Providers.

The latest official release can be found on NuGet and the nightly builds on MyGet.

[!TIP] While the aspnet-contrib providers are still fully supported, developers are encouraged to use the OpenIddict client for new applications.

For information, see the Migrating to OpenIddict section.

Getting started

Adding social authentication to your application is a breeze and just requires a few lines in your Startup class:

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(options => { /* Authentication options */ })
            .AddGitHub(options =>
            {
                options.ClientId = "49e302895d8b09ea5656";
                options.ClientSecret = "98f1bf028608901e9df91d64ee61536fe562064b";
            });
}

public void Configure(IApplicationBuilder app)
{
    app.UseAuthentication();
    app.UseAuthorization();
}

See the /samples directory for a complete sample using ASP.NET Core MVC and supporting multiple social providers.

Contributing

AspNet.Security.OAuth.Providers is actively maintained by:

• Kévin Chalet (@kevin_chalet).
• Martin Costello (@martin_costello).

We would love it if you could help contributing to this repository.

Special thanks to our contributors:

• Aaron Sadler
• Abhinav Nigam
• Adam Reisinger
• Albert Zakiev
• Albireo
• Anders Blankholm
• Andrew Lock
• Andrew Mattie
• Andrii Chebukin
• Anthony Yates
• Chino Chang
• Chris Sung
• CoCo Lin
• Dave Timmins
• Dmitry Popov
• Drew Killion
• Elan Hasson
• Eric Green
• Ethan Celletti
• Floris Westerman
• Galo
• Gehongyan
• Igor Simovic
• James Holcomb
• Jason Loeffler
• Jerrie Pelser
• Jesse Mandel
• Jordan Knight
• Kévin Chalet
• Konstantin Mamaev
• LeaFrock
• Levi Muriuki
• Luke Fulliton
• Mariusz Zieliński
• Martin Costello
• Matthew Moore
• Maxime Roussin-Bélanger
• Michael Knowles
• Michael Tanczos
• Patrick Westerhoff
• Robert Shade
• saber-wang
• Sinan
• Stefan
• Steffen Wenz
• Tathagata Chakraborty
• TheUltimateC0der
• Tolbxela
• Tommy Parnell
• twsl
• wplong11
• Yannic Smeets
• zAfLu
• zhengchun
• Vicente Yu
• Volodymyr Baydalka
• Logan Dam
• Loongle Tse

Security policy

Please see SECURITY.md for information about reporting security issues and bugs.

Support

Need help or wanna share your thoughts? Don't hesitate to join us on Gitter or ask your question on StackOverflow:

• Gitter: https://gitter.im/aspnet-contrib/AspNet.Security.OAuth.Providers
• StackOverflow: https://stackoverflow.com/questions/tagged/aspnet-contrib

License

This project is licensed under the Apache License. This means that you can use, modify and distribute it freely. See https://www.apache.org/licenses/LICENSE-2.0.html for more details.

Migrating to OpenIddict

The OpenIddict client and its 100+ web providers have significant advantages over the simpler OAuth 2.0-only authentication handler that is used by the aspnet-contrib providers:

• OpenIddict fully supports OpenID Connect, which allows enforcing additional security checks for providers that implement it.
• The OpenIddict client is stateful and provides built-in countermeasures against nonce/token replay attacks.
• While the aspnet-contrib providers only support the OAuth 2.0 code flow, the OpenIddict providers support additional flows, including the OpenID Connect hybrid flow, the OAuth 2.0 client credentials grant, the resource owner password credentials grant or the refresh token grant.
• The OpenIddict client supports OAuth 2.0 token introspection and OAuth 2.0 token revocation.
• OpenIddict uses OAuth 2.0 and OpenID Connect server configuration discovery to avoid hardcoding the endpoint URIs of a provider when possible, making the OpenIddict web providers more robust and more future-proof.
• While the aspnet-contrib providers require targeting the latest ASP.NET Core version, the OpenIddict web providers can be used in any supported version. They can also be used in ASP.NET 4.6.1+ websites and Windows/Linux desktop applications.
• OpenIddict uses Microsoft.Extensions.Http.Polly (or Microsoft.Extensions.Http.Resilience on .NET 8+) to make backchannel HTTP communications less prone to transient network errors.

For more information on how to get started with the OpenIddict web providers, you can read:

• Getting started with the OpenIddict web providers
• Integrating with a remote server instance

To contribute a new OpenIddict provider, visit Contributing a new Web provider.

Providers

Links to the latest stable and nightly NuGet packages for each provider, as well as a link to their integration documentation are listed in the table below.

Documentation for the providers' settings can be found here.

If a provider you're looking for does not exist, consider making a PR to add one.

| Provider | Stable | Nightly | Documentation | |:-:|:-:|:-:|:-:| | AdobeIO | | | Documentation | | Airtable | | | Documentation | | Alipay | [](https://www.nuget.org/packages/AspNet.Security.OAuth.Alipay/ "Download AspNet.Security.OAuth