Over a million developers have joined DZone.

Authentication Using Facebook in ASP.NET Core 2.0

DZone's Guide to

Authentication Using Facebook in ASP.NET Core 2.0

In this post, we'll learn how to create an authentication mechanism for our web application using Facebook's developer resources.

· Security Zone ·
Free Resource

Secure and manage your open source software with Flexera.

Sometimes, we want users to log into our application using their existing credentials from third-party applications such as Facebook, Twitter, Google, etc.. In this article, we are going to look into the authentication of an ASP.NET Core app using a Facebook account.


  • Install .NET Core 2.0.0 or above SDK from here.
  • Install the latest version of Visual Studio 2017 Community Edition from here.

Create an MVC Web Application

  • Open Visual Studio and select File >> New >> Project.
  • After selecting the project, a "New Project" dialog will open.
  • Select .NET Core inside the Visual C# menu in the left-hand panel. Then, select "ASP.NET Core Web Application" from the available project types.
  • Set the name of the project as FacebookAuth and press OK.

  • After clicking on OK, a new dialog will open asking you to select the project template. You will see two drop-down menus at the top left corner of the template window.
  • Select ".NET Core" and "ASP.NET Core 2.0" from these dropdowns.
  • Then, select "Web application(Model-View-Controller)" template.
  • Click on the Change Authentication button, and a Change Authentication dialog box will open.
  • Select "Individual User Account" and click OK.
  • Now, click OK again to create our web app.

Before running the application, we need to apply migrations to our app. Navigate to Tools >> NuGet Package Manager >> Package Manager Console.

It will open the Package Manager Console. Put in the Update-Database command and hit Enter. This will update the database using Entity Framework Code First Migrations.

Press F5 to run the application. You will see a homepage, as shown below.

Note the URL from the browser address bar. In this case, the URL is http://localhost:54575/. We need this URL to configure our Facebook app which we will be doing in our next section.

Create a Facebook App

  • Navigate to https://developers.facebook.com/apps/ and sign in using your Facebook account.
  • If you do not have a Facebook account, you need to create one. You cannot proceed without a Facebook account.
  • Once you have logged in, you will be redirected to a page similar to the one shown below.

Click on the Create a New App button on the top right corner. It will open a Create a New App ID form similar to the one shown below.

Here, you need to furnish the details in two fields

  • Display Name: Give an appropriate name.

Important Note: - Do not use the word "Facebook" in the display name. You will get an error (Refer to the image below).

  • Contact Email: Give your email address/id. If you do not want to provide your personal email, then you can also you any dummy email address such as xzy@gmail.com.

Do keep in mind that both the fields of this form are required so you need to provide appropriate values to all of them. Once you have furnished all the details click on the Create App ID button. If there is no error in the form, your Facebook app will be created successfully and you will be redirected to the application Dashboard as shown in the image below. Here you can see a list of products that you can add to your App. Click on Set Up on the Facebook Login card. Refer to the image below.

A QuickStart wizard will be launched asking you to select a platform for the app. Skip this wizard and click on Facebook Login > Settings from the navigation menu on the left.

This will take you to the Client OAuth Settings page. In the Valid OAuth redirect URIs field enter the base URL of your application with /signin-facebook appended to it. For this tutorial, the URL will be http://localhost:54575/signin-facebook. Click on Save Changes. Refer to the image below.

Now click on Settings > Basic on the navigation menu. You will see the App ID and App Secret values for the Facebook app we have just created. Click on the show button inside the App secret field to see the value. Take note of both values as we will need them to configure Facebook authentication in our web app.

Configure Web App to Use Facebook Authentication

We need to store the App ID and App Secret field values in our application. We will use the Secret Manager tool for this purpose. The Secret Manager tool is a project tool that can be used to store secrets such as passwords, API keys, etc. for a .NET Core project during the development process. With the Secret Manager tool, we can associate app secrets with a specific project and can share them across multiple projects.

Open our web application once again and right-click the project in Solution Explorer and select Manage User Secrets from the context menu.

A secrets.json file will open. Put the following code in it.

  "Authentication:Facebook:AppId": "Your AppId here",  
  "Authentication:Facebook:AppSecret": "Your AppSecret here"  

Now open the Startup.cs file and put the following code into the ConfigureServices method.

services.AddAuthentication().AddFacebook(facebookOptions =>    
    facebookOptions.AppId = Configuration["Authentication:Facebook:AppId"];    
    facebookOptions.AppSecret = Configuration["Authentication:Facebook:AppSecret"];    

In this code section, we are reading AppId and AppSecret from the secrets.json file for the purpose of authentication.

So, finally, Startup.cs will look like this.

using System;  
using System.Collections.Generic;  
using System.Linq;  
using System.Threading.Tasks;  
using Microsoft.AspNetCore.Builder;  
using Microsoft.AspNetCore.Identity;  
using Microsoft.EntityFrameworkCore;  
using Microsoft.AspNetCore.Hosting;  
using Microsoft.Extensions.Configuration;  
using Microsoft.Extensions.DependencyInjection;  
using FacebookAuth.Data;  
using FacebookAuth.Models;  
using FacebookAuth.Services;  

namespace FacebookAuth  
    public class Startup  
        public Startup(IConfiguration configuration)  
            Configuration = configuration;  

        public IConfiguration Configuration { get; }  

        // This method gets called by the runtime. Use this method to add services to the container.  
        public void ConfigureServices(IServiceCollection services)  
            services.AddDbContext<ApplicationDbContext>(options =>  

            services.AddIdentity<ApplicationUser, IdentityRole>()  

            services.AddAuthentication().AddFacebook(facebookOptions =>  
                facebookOptions.AppId = Configuration["Authentication:Facebook:AppId"];  
                facebookOptions.AppSecret = Configuration["Authentication:Facebook:AppSecret"];  

            // Add application services.  
            services.AddTransient<IEmailSender, EmailSender>();  


        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.  
        public void Configure(IApplicationBuilder app, IHostingEnvironment env)  
            if (env.IsDevelopment())  



            app.UseMvc(routes =>  
                    name: "default",  
                    template: "{controller=Home}/{action=Index}/{id?}");  

And with this, our application is ready.

Execution Demo

Launch the application and click Login on the top right corner of the homepage.

You will be redirected to http://localhost:54575/Account/Login page, where you can see the option to login using Facebook on the right-hand side of the page.

Clicking on the Facebook button will take you to the Facebook authorization page where you will be asked to fill in your Facebook credentials and authorize the Facebook app to use your Facebook account.

Put in your Facebook credentials and click on the Login button. You will now see a confirmation page as shown below. Click on the Continue as <name> button.

The application will take a few moments to authenticate your Facebook account and upon successful authentication with Facebook, you will be redirected to a registration page inside our application where you need to fill in an email id to tag with your account. The email id that you have used to login to Facebook will be populated in the Email id field. If you want to use another email you can change it.

Click register. You will be redirected to the homepage again but this time you can also see your registered email is in the top right corner.

See Also


We have successfully created a Facebook app and used it to authenticate our ASP.NET Core application.

You can get the source code from GitHub.

Please note that the secrets.json file contains dummy values. Hence, you'll need to replace the values with the keys of your Google app before executing it.

You can also find this article at C# Corner.

You can check my other articles on ASP .NET Core here.

Security vulnerabilities put your data and your customer’s data at risk. Find out how FlexNet Code Insight integrates into your SDLC and makes monitoring open source security a breeze, so you can worry less and build more.  Brought to you in partnership with Flexera.

security ,authentication ,web application security ,asp.net core 2.0

Published at DZone with permission of

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}