Security

How a request proves who it is, and what it may then do.

Start with Authentication to set up sign-in, then The current user for reading the signed-in user in a handler. CSRF protection is already on in a scaffolded project; read it when a form starts returning 419.