title: Always enter credentials without "prompt=login" in IdentityServer4
body: <p>This is similar to <a href="https://stackoverflow.com/questions/48681426/identityserver4-force-user-to-re-enter-credentials">IdentityServer4 Force User to re-enter credentials</a>, but the solution there says to use <code>prompt=login</code> query string in the <code>/authorize</code> URL, which works, but also allows for sneaky users to remove it. Also, seeing as I'm not using <code>.AddOpenIdConnect()</code> the suggestion to use <code>OnRedirectToIdentityProvider</code> doesn't apply to me.</p>
  
  <p>So how can we force the user to always enter credentials without relying on the <code>prompt=login</code> in the query string?</p>
  
  <hr>
  
  <p>Here's my basic IdentityServer4 setup:</p>
  
  <pre class="lang-cs prettyprint-override"><code>public void ConfigureServices(IServiceCollection services)
  {
      services.AddMvc();
  
      var builder = services.AddIdentityServer()
          .AddInMemoryIdentityResources(Config.GetIdentityResources())
          .AddInMemoryApiResources(Config.GetApis())
          .AddInMemoryClients(Config.GetClients());
  
      builder.AddDeveloperSigningCredential();
  }
  
  public void Configure(IApplicationBuilder app, IHostingEnvironment env)
  {
      app.UseHttpsRedirection();
      app.UseFileServer();
      app.UseIdentityServer();
      app.UseMvc();
  }
  </code></pre>
  
  <p>Where my login page only has an "OK" and "Cancel" button (I don't care which user logs on yet, only that authentication was OK or not), and the controller does the following when it is authenticating the user:</p>
  
  <pre class="lang-cs prettyprint-override"><code>public async Task&lt;IActionResult&gt; Post(AuthenticateViewModel model, string button)
  {
      var context = await _interaction.GetAuthorizationContextAsync(model.ReturnUrl);
  
      if (button == "authCancel")
      {
          if (context != null)
          {
              await _interaction.GrantConsentAsync(context, ConsentResponse.Denied);
              return Redirect(model.ReturnUrl);
          }
  
          return Redirect("~/");
      }
  
      if (button == "authOk" &amp;&amp; ModelState.IsValid)
      {
          if (context != null)
          {
              await _events.RaiseAsync(new UserLoginSuccessEvent("provider", "userId", "subjectId", "name"));
              await HttpContext.SignInAsync("subject", "name", new AuthenticationProperties());
              return Redirect(model.ReturnUrl);
          }
      }
  
      return Redirect("~/");
  }
  </code></pre>