I'm currently building a new application and trying to apply some of the principles of Clean Architecture. One of my first roadblocks is implementing my own
Identity system (to avoid being tightly coupled to the
One of my concerns is password hashing and generation. I'm looking at following a similar or the same process as the AspNetCore.Identity Password Hasher, but I'm not quite sure where I should handle this logic.
My initial thought is since this is pertaining to my domain entities, I should put this in my
Domain layer. However, I'm concerned that this will create headaches and scattered logic in the future as I validate passwords. On the other hand, I could define my own
IPasswordHasher interface in my application layer, but this has the negative consequence of my application layer dictating my hashing and validation scheme. In the event I share these entities with another application in the future, I would have to ensure that the hashing algorithm is the same.
But by that same token, it would be great to simply use the
IPasswordHasher interface that's already defined in
Microsoft.AspNetCore.Identity, but I don't want to have that tight coupling.
So what would be the ideal approach to implementing some sort of hashing logic (potentially even just using the PasswordHasher defined in AspNetCore) without having to reference the AspNetCore library in my application/domain layers? And where should I actually implement my password hashing, at the domain layer or the application layer?