Provide stronger guidance for using identity cookies over tokens for security

[halter73]

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/security/authentication/identity-api-authorization.md	How to use Identity to secure a Web API backend for SPAs

[tdykstra]

Looks good, I just left a suggestion to avoid future tense.

[tdykstra]

Suggested change

[ASP.NET Core Identity](xref:security/authentication/identity) provides APIs that handle authentication, authorization, and identity management. The APIs make it possible to secure endpoints of a Web API backend with cookie-based authentication. There's a token-based option for clients that can't use cookies, but you must be careful not to leak tokens. We recommend using cookies in browser-based applications, because the browser will automatically handle them without exposing them to JavaScript by default.

[ASP.NET Core Identity](xref:security/authentication/identity) provides APIs that handle authentication, authorization, and identity management. The APIs make it possible to secure endpoints of a Web API backend with cookie-based authentication. There's a token-based option for clients that can't use cookies, but you must be careful not to leak tokens. We recommend using cookies in browser-based applications, because the browser automatically handles them without exposing them to JavaScript by default.

[blowdart]

Perhaps even more forceful?

ASP.NET Core Identity provides APIs that handle authentication, authorization, and identity management. The APIs make it possible to secure endpoints of a Web API backend with cookie-based authentication. A token-based option is available for clients that can't use cookies, but in using this you are responsible for ensuring the tokens are kept secure. We recommend using cookies for browser-based applications, because, by default, the browser automatically handles them without exposing them to JavaScript.

[tdykstra]

Suggested change

	For clients that don't support cookies, the login API provides a parameter to request tokens, but you must be careful not to leak tokens. We recommend using cookies in browser-based applications, because the browser will automatically handle them without exposing them to JavaScript by default.
	For clients that don't support cookies, the login API provides a parameter to request tokens, but you must be careful not to leak tokens. We recommend using cookies in browser-based applications, because the browser automatically handles them without exposing them to JavaScript by default.

[blowdart]

Same sort of forcefulness as above, and swap around where by default lands.

We recommend using cookies in browser-based applications, because, by default the browser automatically handles them without exposing them to JavaScript.