What's new in ASP.NET Core authentication in .NET 11
What changed in ASP.NET Core authentication, authorization and Data Protection in .NET 11 RC2 and the .NET 10 updates, found by comparing the source code.
Read more →Tore Nestenius
Under the hood of .NET, identity and security
I'm a Microsoft .NET MVP, consultant and trainer in Göteborg, Sweden, specializing in authentication, identity and security in .NET. Here I share what I learn when I dig into how things really work.
Latest posts
-
-
Visualizing Claude Code MCP Requests with Coding Agent Explorer
See the MCP traffic between Claude Code and any HTTP MCP server: set up the MCP Observer in my open-source Coding Agent Explorer and inspect each JSON-RPC call.
Read more → -
Exploring Claude Code Hooks with the Coding Agent Explorer (.NET)
What Claude Code hooks are, how a PreToolUse hook can block a tool call, and how to watch every hook event live with my open-source Coding Agent Explorer.
Read more → -
Introducing the Coding Agent Explorer (.NET)
The Coding Agent Explorer is my open-source .NET tool that shows what Claude Code does: every API request, tool call and token count, live in a dashboard.
Read more → -
Duende IdentityServer 7: A Complete Setup Guide for ASP.NET Core
A step-by-step guide to setting up Duende IdentityServer 7 from scratch in ASP.NET Core: middleware, the sample UI, test users, configuration and logging.
Read more → -
BFF in ASP.NET Core #7 - Introducing the Duende BFF Library
How to replace a custom BFF in ASP.NET Core with the Duende BFF library: setup, management endpoints, local and remote APIs and sign-out. Part 7 of the series.
Read more → -
BFF in ASP.NET Core #6 - Securing our BFF with CORS
How CORS protects a Backend-for-Frontend (BFF) in ASP.NET Core from cross-origin attacks: simple and preflight requests, and a required X-CSRF header.
Read more → -
BFF in ASP.NET Core #5 - Automatic Token Renewal
How to add automatic access token renewal to a BFF in ASP.NET Core with refresh tokens and the Duende.AccessTokenManagement library, so users stay signed in.
Read more → -
BFF in ASP.NET Core #4 - Implementing a BFF from scratch
How to build a minimal Backend-for-Frontend (BFF) in ASP.NET Core from scratch: login, logout and session endpoints, OpenID Connect and a proxy for remote APIs.
Read more → -
BFF in ASP.NET Core #3 - The BFF Pattern Explained
How to secure the BFF session cookie in ASP.NET Core with HTTPS, HttpOnly, Secure, SameSite and the __Host- prefix, plus security headers for extra protection.
Read more → -
BFF in ASP.NET Core #2 - The BFF Pattern Explained
What the Backend-for-Frontend (BFF) pattern is, where it comes from, how it keeps tokens out of the browser and what is inside a BFF: sessions and an API proxy.
Read more → -
Implementing BFF Pattern in ASP.NET Core for SPAs
Why OpenID Connect tokens in the browser put single-page applications at risk, and how the BFF pattern in ASP.NET Core fixes it. Part 1 of a 7-part series.
Read more → -
How to Use KurrentDB for Event Sourcing in C# on Azure
How to deploy KurrentDB (formerly EventStoreDB) to Azure Container Instances, then append and read events from C#, for hands-on event sourcing in .NET.
Read more → -
Configuring ASP.NET Core Forwarded Headers Middleware
How to configure the ASP.NET Core Forwarded Headers Middleware behind a reverse proxy: which headers to process, which proxies to trust, and AllowedHosts.
Read more → -
Exploring the Forwarded Headers Middleware in ASP.NET Core
What the ASP.NET Core Forwarded Headers Middleware does behind a proxy, and how the X-Forwarded headers restore the client IP, scheme and host of each request.
Read more → -
AdditionalAuthorizationParameters in ASP.NET Core 9
How AdditionalAuthorizationParameters in ASP.NET Core 9 adds custom parameters to OpenID Connect authorization requests, without workarounds and also with PAR.
Read more →
