In .Net 4.6 my team used Microsoft's built in authentication/authorization systems primarily through its Owin tools. In .Net Core Microsoft decided NOT to port that segment of tools. So, we made the decision to write our own auth middleware to generate, authenticate, and authorize JWTs in our .Net Core apps.
Note: We were careful to ensure we followed OAuth standard very closely
Is there any 'stamp of approval' for our custom auth middleware we could have to assure client's our application security is trustworthy?
The idea is that a client could come to us and say 'what kind of security are you using on our app?' We would explain the security pipeline used in there app and include our custom auth in that response. Then they could likely respond 'Custom auth middleware? That sounds dangerous, how can you assure us its secure?'
What were searching for might be a certificate, it might be just to say that our auth system follows a particular standard. Or maybe, there is nothing at all and the best we can do is just say 'trust us, weve done this before... -_-'.