What’s Included
Identity Features
- ASP.NET Core Identity with login, registration, and email confirmation
- Role-based access with admin or tenant isolation RBAC
- Azure AD B2C for external login and MFA
- Secure password storage ( PBKDF2 / peppering support)
- Optional OAuth / OpenID login (Google, Microsoft, etc.)
Whether you need a custom login for your internal users, or enterprise SSO with Azure B2C, we can help you implement it securely and smoothly.
Glossary
While we try to avoid jargon, sometimes it's the clearest way to explain technical concepts. Here's a brief glossary of terms used on this page.
Security & Compliance
- GDPR
- General Data Protection Regulation – EU/UK law on personal data.
- reCAPTCHA
- Google service that protects websites from bots and abuse.
- OAuth
- Open Authorization – a secure way for apps to access user data without sharing passwords.
- API Key
- Unique identifier used to authenticate a request to an API, often used for basic access control.
- JWT
- JSON Web Token – a compact, secure way to transmit identity and claims between systems.
- 2FA
- Two-Factor Authentication – adds an extra layer of security by requiring a second form of verification.
- RBAC
- Role-Based Access Control – restricts system access based on a user's role (e.g. admin, editor, viewer).
- Key Vault
- Azure service for securely storing secrets, certificates, and encryption keys, often used in secure infrastructure deployments.
- B2C
- Azure Active Directory B2C – a Microsoft identity service for customer-facing apps, supporting social and enterprise logins.
- PBKDF2
- Password-Based Key Derivation Function 2 – a secure hashing algorithm commonly used to store user passwords.
- MFA
- Multi-Factor Authentication – requires two or more verification methods to enhance login security.
- OpenID
- OpenID Connect – an identity layer on top of OAuth 2.0 used for federated authentication.
- SSO
- Single Sign-On – allows users to log in once and gain access to multiple systems without re-authenticating.
- DNSSEC
- Domain Name System Security Extensions – protects DNS from spoofing by digitally signing DNS data to verify its authenticity.
- Security Headers
-
Common HTTP headers used to harden apps:
- CORS
- (Cross-Origin Resource Sharing) – restricts cross-origin access to APIs.
- HSTS
- (Strict Transport Security) – enforces HTTPS connections.
- CSP
- (Content Security Policy) – limits executable scripts and resources.
- X-Frame Options
- – prevents clickjacking by disallowing iframes.
Secure Logins & Role-Based Access
Modern identity for websites and apps — with custom registration, MFA, role-based access, and seamless external login options.