Authentication & Authorization Core Principles 1. Use ASP.NET Identity for user management — Don't build your own user store. Identity handles password hashing, lockout, two-factor, email confirmation, and (since .NET 10) built-in passkey/WebAuthn support for passwordless login. 2. JWT for APIs, cookies for web apps — APIs use Bearer token authentication; Blazor/MVC apps use cookie authentication. 3. Policy-based authorization over roles — Policies are testable, composable, and more expressive than . 4. Never store secrets in code — Use user secrets in development, Azure Key Vault / environme…