Problem
The IdentityController has inefficient authentication patterns:
- Redundant database lookups: Using
PasswordSignInAsync(userName, password, ...) causes extra FindByNameAsync queries when we already have the user object
- Unnecessary
UserManager.UpdateAsync: Calling UpdateAsync before SaveChangesAsync adds redundant validation and database round-trips when only updating TwoFactorTokenRequestedOn
- Inefficient security stamp validation:
ValidateSecurityStampAsync(principal) makes extra database queries to fetch the user we already have from the session query
Impact: Multiple unnecessary database queries per authentication request, reduced performance