Announcement Discussion: AuthenticationHandler<T> is now only async, AuthenticateCore() renamed to HandleAuthenticateAsync()

[blowdart]

Authentication handlers have now dropped their synchronous methods and are fully async

In addition to this there has been method renames;

protected override AuthenticationTicket AuthenticateCore()

has now become

protected override async Task<AuthenticationTicket> HandleAuthenticateAsync()

protected override void ApplyResponseChallenge()

has been split and now becomes

protected override async Task<bool> HandleUnauthorizedAsync(ChallengeContext context)
protected override async Task<bool> HandleForbiddenAsync(ChallengeContext context)

[kspearrin]

You might want to point out that ApplyResponseChallenge was also dropped in favor of methods like HandleUnauthorizedAsync and HandleForbiddenAsync.

ref 3a8ea67

[kevinchalet]

@blowdart you should try to make shorter announcements 😄

The fact authentication handlers are now async is clearly not the most important change. The most important thing to note is that ChallengeAsync/SignInAsync/SignOutAsync are now immediate and not deferred like they used to be in Katana 3, which has different implications in everyday's code: #257 (comment) and #313 (comment).

You should really write some serious documentation about this important change.

[blowdart]

SignInAsync is not a middleware signature, it's a separate announcement.

[kevinchalet]

True, but it has a direct impact on how AuthenticationHandler's methods are invoked.

[kevinchalet]

BTW, there's an awful typo in the title... aynsc -> async 😄

[jods4]

Just saying: the naming of HandleUnauthorizedAsync and HandleForbiddenAsync is not great. To me Unauthorized is pretty much a synonym of Forbidden so I'm clueless as to what the difference between the two might be (I guess I'll have to read the documentation -- then the issue becomes remembering which is which).

[blowdart]

We're using the same names as HTTP uses, and the wording are the generally accepted industry terms.

Unauthorized = There is no identity
Forbidden = There is an identity already, but it doesn't meet the requirements of the system.

The wording is unlikely to change.

[artganify]

@blowdart +1

There is a clear difference between 'Unauthorized' and 'Forbidden' though I agree that the names can be confusing - but that's the fault of the HTTP standard. ASP / any other http-related platform have always made that distinction so thank you for providing both seperatetly.