diff --git a/zero.Core/Api/AuthenticationApi.cs b/zero.Core/Api/AuthenticationApi.cs
index 216cb6f2..d58d12fa 100644
--- a/zero.Core/Api/AuthenticationApi.cs
+++ b/zero.Core/Api/AuthenticationApi.cs
@@ -1,4 +1,5 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Identity;
 using Raven.Client.Documents;
 using System.Collections.Generic;
@@ -103,6 +104,7 @@ namespace zero.Core.Api
         return result;
       }
 
+
       SignInResult signInResult = await SignInManager.PasswordSignInAsync(email, password, isPersistent, true);
 
       if (!signInResult.Succeeded)
diff --git a/zero.Debug/Controllers/AccountController.cs b/zero.Debug/Controllers/AccountController.cs
new file mode 100644
index 00000000..fe5938b7
--- /dev/null
+++ b/zero.Debug/Controllers/AccountController.cs
@@ -0,0 +1,60 @@
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Mvc;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Claims;
+using System.Threading.Tasks;
+using zero.Debug.Models;
+
+namespace zero.Debug.Controllers
+{
+  public class AccountController : Controller
+  {
+    [HttpGet]
+    public IActionResult Index()
+    {
+      return View();
+    }
+
+
+    [HttpPost]
+    public async Task<IActionResult> Index(LoginModel model)
+    {
+      model.Posted = true;
+
+      if (ModelState.IsValid)
+      {
+        var isValid = (model.Username == "username" && model.Password == "password");
+
+        if (!isValid)
+        {
+          ModelState.AddModelError("", "username or password is invalid");
+          return View("Index", model);
+        }
+
+        var identity = new ClaimsIdentity(CookieAuthenticationDefaults.AuthenticationScheme, ClaimTypes.Name, ClaimTypes.Role);
+        identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, model.Username));
+        identity.AddClaim(new Claim(ClaimTypes.Name, model.Username));
+        var principal = new ClaimsPrincipal(identity);
+        await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal, new AuthenticationProperties { IsPersistent = model.RememberMe });
+
+        return View("Index", model);
+      }
+      else
+      {
+        ModelState.AddModelError("", "username or password is blank");
+        return View("Index", model);
+      }
+    }
+
+
+    [HttpPost]
+    public async Task<IActionResult> Logout()
+    {
+      await HttpContext.SignOutAsync();
+      return Redirect("/Account/Index");
+    }
+  }
+}
\ No newline at end of file
diff --git a/zero.Debug/Controllers/HomeController.cs b/zero.Debug/Controllers/HomeController.cs
new file mode 100644
index 00000000..af0f60c7
--- /dev/null
+++ b/zero.Debug/Controllers/HomeController.cs
@@ -0,0 +1,17 @@
+using Microsoft.AspNetCore.Mvc;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+
+namespace zero.Debug.Controllers
+{
+  public class HomeController : Controller
+  {
+    [HttpGet]
+    public IActionResult Index()
+    {
+      return View();
+    }
+  }
+}
\ No newline at end of file
diff --git a/zero.Debug/Models/LoginModel.cs b/zero.Debug/Models/LoginModel.cs
new file mode 100644
index 00000000..33d75004
--- /dev/null
+++ b/zero.Debug/Models/LoginModel.cs
@@ -0,0 +1,17 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace zero.Debug.Models
+{
+  public class LoginModel
+  {
+    [Required]
+    public string Username { get; set; }
+
+    [Required, DataType(DataType.Password)]
+    public string Password { get; set; }
+
+    public bool RememberMe { get; set; }
+
+    public bool Posted { get; set; }
+  }
+}
diff --git a/zero.Debug/Startup.cs b/zero.Debug/Startup.cs
index 211f3f98..b79868e9 100644
--- a/zero.Debug/Startup.cs
+++ b/zero.Debug/Startup.cs
@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Http;
@@ -23,8 +24,19 @@ namespace zero.Debug
     // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
     public void ConfigureServices(IServiceCollection services)
     {
+      services.AddAuthentication(options =>
+      {
+        options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
+        options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
+        options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
+      }).AddCookie(options =>
+      {
+        options.LoginPath = "/Account/Index";
+      });
+
       services.AddZero(Configuration);
       services.AddMvc();
+
       services.Configure<IISOptions>(opts => opts.AutomaticAuthentication = false);
     }
 
@@ -38,15 +50,13 @@ namespace zero.Debug
       }
 
       app.UseRouting();
+      app.UseAuthentication();
 
       app.UseZero();
 
       app.UseEndpoints(endpoints =>
       {
-        endpoints.MapGet("/", async context =>
-        {
-          await context.Response.WriteAsync("Hello World!");
-        });
+        endpoints.MapDefaultControllerRoute();
       });
     }
   }
diff --git a/zero.Debug/Views/Account/Index.cshtml b/zero.Debug/Views/Account/Index.cshtml
new file mode 100644
index 00000000..0e1bd8df
--- /dev/null
+++ b/zero.Debug/Views/Account/Index.cshtml
@@ -0,0 +1,45 @@
+@addTagHelper *, Microsoft.AspNetCore.Mvc.TagHelpers
+@model zero.Debug.Models.LoginModel
+@{ Layout = null; }
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta name="robots" content="noindex,nofollow">
+  <meta name="author" content="brothers">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta http-equiv="content-type" content="text/html; charset=utf-8">
+  <meta http-equiv="expires" content="0">
+  <base href="~/">
+  <title>zero frontend</title>
+</head>
+<body>
+  <div id="app">
+    @if (User != null)
+    {
+      <p>
+        User: @User.Identity.Name
+      </p>
+    }
+    <form method="post" action="~/Account/Index">
+        <div asp-validation-summary="All" class="text-danger"></div>
+        Posted: @Model?.Posted<br/>
+        Username: <input asp-for="Username" /><br/>
+        Password: <input asp-for="Password" /><br />
+        Remember me: <input asp-for="RememberMe" type="checkbox" /><br />
+        <input type="submit" value="Login" />
+        @Html.AntiForgeryToken()
+    </form>
+
+    <form method="post" action="~/Account/Logout">
+       <button type="submit">Logout</button>
+    </form>
+
+    <pre>
+<code>
+@Json.Serialize(User.Identities, new Newtonsoft.Json.JsonSerializerSettings() { Formatting = Newtonsoft.Json.Formatting.Indented, ReferenceLoopHandling = Newtonsoft.Json.ReferenceLoopHandling.Ignore })
+</code>
+</pre>
+  </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/zero.Debug/Views/Home/Index.cshtml b/zero.Debug/Views/Home/Index.cshtml
new file mode 100644
index 00000000..cd84c33d
--- /dev/null
+++ b/zero.Debug/Views/Home/Index.cshtml
@@ -0,0 +1,23 @@
+@addTagHelper *, Microsoft.AspNetCore.Mvc.TagHelpers
+@{ Layout = null; }
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta name="robots" content="noindex,nofollow">
+  <meta name="author" content="brothers">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta http-equiv="content-type" content="text/html; charset=utf-8">
+  <meta http-equiv="expires" content="0">
+  <base href="~/">
+  <title>zero frontend</title>
+</head>
+<body>
+  <div id="app">
+    <ul>
+      <li><a href="~/Account/Index">Account</a></li>
+      <li><a href="~/zero">Backoffice</a></li>
+    </ul>
+  </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/zero.Debug/zero.Debug.csproj b/zero.Debug/zero.Debug.csproj
index 41646f52..f4565b1f 100644
--- a/zero.Debug/zero.Debug.csproj
+++ b/zero.Debug/zero.Debug.csproj
@@ -9,8 +9,4 @@
     <ProjectReference Include="..\zero.Web\zero.Web.csproj" />
   </ItemGroup>
 
-  <ItemGroup>
-    <Folder Include="wwwroot\" />
-  </ItemGroup>
-
 </Project>
diff --git a/zero.Web/ZeroApplicationBuilderExtensions.cs b/zero.Web/ZeroApplicationBuilderExtensions.cs
index 971fec11..450fefad 100644
--- a/zero.Web/ZeroApplicationBuilderExtensions.cs
+++ b/zero.Web/ZeroApplicationBuilderExtensions.cs
@@ -21,7 +21,6 @@ namespace zero.Web
       app.UseStaticFiles();
 
       // map backoffice
-      //app.UseWhen()
       app.UseWhen(ctx => ctx.Request.Path.ToString().StartsWith(path), builder =>
       {
         builder.UseRouting();