Difference between CookieAuthentication and WindowsAzureADAuthentication Options - azure

Question

Hi I am trying a simple authentication of a webapi using AzureAD. In that when we add the connected services using the Azure AD, the Startup.cs class adds the below code
app.UseWindowsAzureActiveDirectoryBearerAuthentication(
new WindowsAzureActiveDirectoryBearerAuthenticationOptions
{
Tenant = ConfigurationManager.AppSettings["ida:Tenant"],
TokenValidationParameters = new TokenValidationParameters
{
ValidAudience = ConfigurationManager.AppSettings["ida:Audience"]
},
});
When i went through some of the authentication tutorial, i am seeing people are asking to use some thing like the one shown below
app.UseCookieAuthentication(new CookieAuthenticationOptions());
app.UseOpenIdConnectAuthentication(
new OpenIdConnectAuthenticationOptions{....
}
What's the difference between these 2, aren't we supposed to be using AzureAD options going by the name and since we are using the AzureAD Connected Services for Authentication of the webApi. Can some one clarify the same?

Answer 1

Cookie Authentication
Cookie authentication uses HTTP cookies to authenticate client requests and maintain session information. It works as follows:
The client sends a login request to the server.
On the successful login, the server response includes the Set-Cookie
header that contains the cookie name, value, expiry time and some
other info
The client needs to send this cookie in the Cookie header in all
subsequent requests to the server.
On the logout operation, the server sends back the Set-Cookie header
that causes the cookie to expire
Note: Cookie authentication is vulnerable to Cross-Site Request Forgeries (CSRF) attacks, so it should be used together with other
security measures, such as CSRF tokens. For more details you could take a look here
Azure Active directory Authentication:
As you know Azure Active Directory is a modern Token based authentication which provides Single Sign-On (SSO) that allows a user to use one password (or smart card) to authenticate to multiple servers on a network without reentering credentials. This is an obvious convenience for users, who don’t have to remember multiple passwords or keep going through the authentication process over and over to access different resources.
Main thing is AAD uses JSON Web Token(JWT). On receiving the credentials from client the server validates the credentials and generates a signed JWT which contains the user information.
Its also support most popular modern authentication protocol as following.
OAuth 2.0
OpenID Connect
WS-Federation
SAML 2.0
Note: the token will never get stored in server(stateless).
So the main difference is cookie based authentication usually stores your user sensitive information on server because it maintains session which seems vulnerable on the other hand token based authentication is secure and don't preserve sensitive information.
see the basic difference of these tow architecture below:
Select Right Authentication:
Here I am showing you a flow chart which enhance your idea to choose right authentication for your application. Take a look below:
You could also have a look here for better clarity. Thank you very much. happy coding!