在WebAPI项目中使用Identity.UI实现登录注册是否合理？

Hey there! Let's walk through your question step by step—you're on the right track with using Identity for authentication, but there are definitely tweaks we can make to fit the WebAPI scenario better.

你的当前实现是否正确？ #

It works, but it's not the most optimal approach for a WebAPI. Using Microsoft.AspNetCore.Identity.UI gets you up and running quickly, but that package is designed for MVC/Razor Pages applications (which need built-in UI for login/register pages). Since you're building a WebAPI, you don't need those UI components, so including this package brings unnecessary baggage.

这种方式的主要弊端 #

• 冗余的代码与路由: The UI package adds a bunch of Razor pages (like /Account/Login, /Account/Register) and related routes that you'll never use. This clutters your project and could lead to accidental exposure of unused endpoints.
• 不必要的依赖: The UI package pulls in Razor, MVC, and other UI-related libraries that your WebAPI doesn't need. This increases your project's size, dependency chain, and potential for version conflicts down the line.
• 不符合WebAPI设计范式: Identity.UI is built for server-side rendered apps with page redirects, while WebAPIs are stateless and return JSON responses. Your custom login logic already bypasses the UI flow, so the package's core value (pre-built UI) is completely wasted on you.

更简洁的WebAPI专属实现方式 #

Instead of using the UI package, stick to the core Identity libraries tailored for backend authentication. Here's how to adjust:

1. 替换依赖包 #

Remove Microsoft.AspNetCore.Identity.UI and only keep Microsoft.AspNetCore.Identity.EntityFrameworkCore—this is the lightweight core package that handles Identity's database interactions without any UI fluff.

2. 轻量化配置Identity #

Instead of AddDefaultIdentity() (which enables UI features by default), use AddIdentityCore() to set up only the backend Identity services:

services.AddIdentityCore<IdentityUser>(options =>
{
    // Configure your password/lockout settings here
    options.Password.RequireDigit = true;
    options.Password.RequireLowercase = true;
})
.AddEntityFrameworkStores<ApplicationDbContext>()
.AddDefaultTokenProviders(); // For password reset/email confirmation tokens if needed

Don't forget to add JWT authentication (since you're using tokens):

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = Configuration["Jwt:Issuer"],
            ValidAudience = Configuration["Jwt:Audience"],
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:Key"]))
        };
    });

// Make sure to add authorization middleware
services.AddAuthorization();

3. 手动实现登录/注册API端点 #

You already started this with your login code—just refine it to handle edge cases (like non-existent users) and keep it focused on JSON responses:

登录端点示例

[HttpPost("login")]
public async Task<IActionResult> Login([FromBody] LoginRequest model)
{
    if (!ModelState.IsValid)
        return BadRequest(ModelState);

    var user = await _userManager.FindByEmailAsync(model.Email);
    if (user == null)
        return Unauthorized("Invalid email or password");

    var passwordIsValid = await _userManager.CheckPasswordAsync(user, model.Password);
    if (!passwordIsValid)
        return Unauthorized("Invalid email or password");

    var token = _tokenService.BuildToken(user.Email);
    return Ok(new { Token = token });
}

// Helper model
public class LoginRequest
{
    [Required]
    [EmailAddress]
    public string Email { get; set; }

    [Required]
    public string Password { get; set; }
}

注册端点示例

[HttpPost("register")]
public async Task<IActionResult> Register([FromBody] RegisterRequest model)
{
    if (!ModelState.IsValid)
        return BadRequest(ModelState);

    var user = new IdentityUser { UserName = model.Email, Email = model.Email };
    var createResult = await _userManager.CreateAsync(user, model.Password);

    if (!createResult.Succeeded)
    {
        foreach (var error in createResult.Errors)
        {
            ModelState.AddModelError(error.Code, error.Description);
        }
        return BadRequest(ModelState);
    }

    // Optional: Send confirmation email here if needed
    return Ok(new { Message = "User registered successfully", UserId = user.Id });
}

// Helper model
public class RegisterRequest
{
    [Required]
    [EmailAddress]
    public string Email { get; set; }

    [Required]
    [StringLength(100, ErrorMessage = "The {0} must be at least {2} characters long.", MinimumLength = 6)]
    public string Password { get; set; }
}

4. 清理多余文件 #

Since you removed the UI package, you can delete any auto-generated Pages/Account folders that were added when you first included Identity.UI—you won't need them anymore.

Final Takeaway #

Your initial approach works, but it's carrying extra weight that's not needed for a WebAPI. By switching to the core Identity package and building your own API endpoints, you'll have a cleaner, lighter, and more WebAPI-aligned authentication system that fits your needs perfectly.

内容的提问来源于stack exchange，提问作者A.A