Tutorials ASP.NET Core MVC Tutorial
Cookie Authentication — Complete Guide
Cookie Authentication — Complete Guide: free step-by-step lesson with examples, common mistakes, and interview tips — part of ASP.NET Core MVC Tutorial on Toolliyo Academy.
On this page
ASP.NET Core MVC Tutorial · Lesson 143 of 200
Cookie Authentication
Getting Started ✓ → Core MVC ✓ → Data & Security ✓ → Production ✓ → Career ✓
Interview Ready · 10 — Interview Prep · ~10 min · Section 16: Authentication
What is this?
A login system shows email/password fields, checks credentials against ASP.NET Core Identity, and sets a secure cookie so the user stays signed in.
Why should you care?
Account pages, checkout, and admin must know who is visiting. Login is the front door.
See it live — copy this example
Create an MVC project (dotnet new mvc), add the code, and run dotnet run.
[HttpPost]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Login(LoginViewModel model)
{
if (!ModelState.IsValid) return View(model);
var result = await _signInManager.PasswordSignInAsync(
model.Email, model.Password, model.RememberMe, lockoutOnFailure: false);
if (!result.Succeeded) { ModelState.AddModelError("", "Invalid login."); return View(model); }
return RedirectToAction("Index", "Home");
}
Run Example »
Edit the code and click Run — like W3Schools Try it Yourself.
What happened?
- SignInManager comes from Identity.
- PasswordSignInAsync checks hashed password.
- Success redirects home; failure shows error without revealing which field was wrong.
Try it yourself
- Scaffold Identity or add packages per Microsoft docs.
- Create Login view with email, password, Remember me.
- Register a user, log in, confirm cookie in browser dev tools.
- Change text or labels in the example and run again — watch the browser update.
- Break the code on purpose (remove a semicolon), read the error message, then fix it.
Remember
Identity + SignInManager + LoginViewModel. POST + anti-forgery on login form. Redirect after success.