Substantive.AspNetCore.Authentication.QuickUI 9.17.34-build20260919r3

AuthenticationQuickUI is a lightweight library that provides a minimal authentication UI for ASP.NET Core applications that use Razor Pages. It is built on top of ASP.NET Core Identity and uses an in-memory database for credential storage, making it suitable for internal tools, admin portals, and non-public workloads where simplicity is preferred over persistence.

Installation

Follow these steps to integrate AuthenticationQuickUI into your ASP.NET Core application.

1. Add configuration to appsettings.json

First, you need to add the necessary configuration for AuthenticationQuickUI in your appsettings.json file. This configuration allows you to customize the library according to your needs.

Add the following configuration:

  "AuthenticationQuickUIOptions": {
    "ApplicationTitle": "Login Title",
    "AuthenticationUsers": [
      {
        "Username": "admin1",
        "Password": "somepassword"
      },
      {
        "Username": "admin2",
        "Password": "somepassword"
      },
    ]
  },

⚠️ The in-memory store is reset on application restart. This library is not intended for scenarios that require durable user storage.

2. Register services in Program.cs

In your Program.cs, load the configuration from appsettings.json and add the necessary dependencies.

// Load configuration
AuthenticationQuickUIOptions quickUiOptions = new();
builder.Configuration.GetSection(nameof(AuthenticationQuickUIOptions)).Bind(quickUiOptions);

// Register AuthenticationQuickUI services
builder.Services.AddAuthenticationQuickUI(quickUiOptions.ToAction());

3. Configure the middleware pipeline

// use AuthenticationQuickUI
app.UseAuthenticationQuickUI(quickUiOptions.ToAction());

ℹ️ The middleware must be registered after routing so endpoint metadata (such as [AllowAnonymous]) is available.

Security considerations

AuthenticationQuickUI is configured to be secure-by-default:

• Authentication cookies are marked as HttpOnly
• Cookies are sent over HTTPS only (SecurePolicy = Always)
• SameSite=Strict is enforced to reduce CSRF risk
• Cookie names and paths are scoped per application to avoid conflicts behind reverse proxies (for example YARP)

If the application is hosted behind a reverse proxy with a path base, configure HostPathBase accordingly.

Reverse proxy support

When running behind a reverse proxy that rewrites paths (such as YARP), set:

"HostPathBase": "/my-app"

This ensures:

• Redirects to the sign-in page use a consistent base path
• Authentication cookies are correctly scoped and isolated

FAQs and Troubleshoots

Q: Is this intended for production use?
A: It is intended for internal or low-risk applications. It is not a replacement for a full identity provider.