BarakoCMS.ExternalAuth 4.3.0

.NET 10.0 This package targets .NET 10.0. The package is compatible with this framework or higher.
There is a newer version of this package available.
See the version list below for details. 
dotnet add package BarakoCMS.ExternalAuth --version 4.3.0
                    


                    

                
NuGet\Install-Package BarakoCMS.ExternalAuth -Version 4.3.0
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="BarakoCMS.ExternalAuth" Version="4.3.0" />
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="BarakoCMS.ExternalAuth" Version="4.3.0" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="BarakoCMS.ExternalAuth" />
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add BarakoCMS.ExternalAuth --version 4.3.0
                    


                    

                
#r "nuget: BarakoCMS.ExternalAuth, 4.3.0"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package BarakoCMS.ExternalAuth@4.3.0
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=BarakoCMS.ExternalAuth&version=4.3.0
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=BarakoCMS.ExternalAuth&version=4.3.0
                    


                            Install as a Cake Tool

<div align="center"> <img src="https://raw.githubusercontent.com/BaryoDev/barakoCMS/master/assets/icon.png" width="96" height="96" alt="BarakoCMS.ExternalAuth logo" /> <h1>BarakoCMS.ExternalAuth</h1> <p><em>Continue with Google, GitHub, Facebook or LinkedIn.</em></p> </div>

OAuth sign-in for barakoCMS. A user arriving through a provider is matched to a global user by verified email and issued exactly the same tenant-scoped, device-bound token as the built-in flows — social sign-in is another way in, not a second, weaker way in.

Enable it

dotnet add package BarakoCMS.ExternalAuth

builder.Services.AddBarakoCMS(builder.Configuration);

var app = builder.Build();
app.UseBarakoCMS();

The package reference plus a restart is the install. AddBarakoCMS finds every module in the application's dependency context, and BarakoCMS:Modules:Enabled decides which of them run (BarakoCMS__Modules__Enabled=ExternalAuth). Unset, every referenced module runs and the API logs one warning saying so. To name it by hand instead, put modules.Add(new BarakoCMS.ExternalAuth.ExternalAuthModule()) in the AddBarakoCMS callback; discovery skips a type the host already added. See MODULES.md in the repository.

Endpoints

Method & path Purpose
GET /api/auth/providers Which providers are configured, for rendering buttons
GET /api/auth/{provider}/start Begin the OAuth handshake
GET /api/auth/{provider}/callback Provider redirect target
GET /api/me/profile Profile details captured from the provider

{provider} is google, github, facebook or linkedin. Only configured providers are advertised or accepted.

Configuration

{
  "ExternalAuth": {
    "Google": { "ClientId": "...", "ClientSecret": "..." },
    "GitHub": { "ClientId": "...", "ClientSecret": "..." }
  }
}

Omit a provider to leave it disabled.

Security notes

  • Matching is on a verified email only. Matching on an unverified one would let anyone who can claim an address at a provider take over the matching account. Take 0.4.0 or later: this was the documented intent from the start and the enforcement was missing, so Google, LinkedIn and Facebook never read a verification flag, and GitHub read one only for accounts whose address was private on their profile.

    What each provider is asked for now:

    Provider Source of truth Behaviour
    Google email_verified on the OIDC userinfo response Refused when absent or false
    LinkedIn email_verified on /userinfo Refused when absent or false
    GitHub verified on /user/emails Only the verified primary is used; the unflagged profile email is ignored
    Facebook none exists Refused unless Facebook:TrustUnverifiedEmail is set

  • Facebook is opt-in. The Graph API exposes no per-field verification flag, so there is nothing to check and no honest way to claim the address is verified. Setting Facebook:TrustUnverifiedEmail to true says you have decided Facebook's own verification is good enough for your deployment, and accepts that a Facebook account asserting an address becomes a login for the local account holding it. It defaults to off, which refuses the sign-in.

  • If the account has MFA enrolled, the provider callback issues an MFA challenge rather than a session token. Take 0.1.6 or later: earlier versions minted a token directly, so a provider-account takeover skipped the second factor entirely.

Part of barakoCMS

This is an optional module for barakoCMS, an open-source headless CMS for .NET 10. Every module is published under the barakocms-module tag, so a single search on nuget.org returns the whole set.

Contributions are welcome — including a module icon or other design work. See CONTRIBUTING.md.

Licensed under MPL-2.0.

If barakoCMS is useful to you, a star on the repository helps other people find it.

Product Compatible and additional computed target framework versions.
.NET net10.0 is compatible.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
4.8.0 44 10/23/2026
4.7.0 82 10/20/2026
4.6.0 94 10/14/2026
4.5.0 81 10/12/2026
4.4.0 97 10/4/2026
4.3.1 106 9/29/2026
4.3.0 102 9/21/2026
4.2.1 114 9/18/2026
4.1.1 100 9/18/2026
4.0.0 110 9/7/2026
0.2.0 129 8/20/2026
0.1.8 132 8/16/2026
0.1.7 131 8/15/2026
0.1.6 192 8/8/2026
0.1.5 133 8/3/2026
0.1.4 137 7/22/2026
0.1.3 125 7/21/2026
0.1.2 101 7/17/2026
0.1.1 98 7/17/2026
0.1.0 106 7/16/2026