Modern authentication in ASP.NET Core: 2FA and passkeys

On the elmah.io blog, Ali Hamza Ansari walks through implementing two modern security mechanisms in ASP.NET Core on .NET 10: two-factor authentication (2FA) and passkey login built on the WebAuthn/FIDO2 standards. For 2FA, he covers registration and login, QR code generation for authenticator apps, TOTP one-time-code verification, recovery codes, and account lockout after failed attempts. The passkey section covers credential registration (attestation) and passwordless login (assertion) with biometric or PIN verification, plus key storage and signature-counter validation. It's built on ASP.NET Core Identity, Entity Framework Core, the Fido2NetLib package, and PostgreSQL. The approach markedly reduces risk compared to plain passwords while making login easier for users.