Visualizing Claude Code MCP Requests with Coding Agent Explorer
See the MCP traffic between Claude Code and any HTTP MCP server: set up the MCP Observer in my open-source Coding Agent Explorer and inspect each JSON-RPC call.
Read more →Tore Nestenius
Under the hood of .NET, identity and security
I'm a Microsoft .NET MVP, consultant and trainer in Göteborg, Sweden, specializing in authentication, identity and security in .NET. Here I share what I learn when I dig into how things really work.
Latest posts
-
-
Exploring Claude Code Hooks with the Coding Agent Explorer (.NET)
What Claude Code hooks are, how a PreToolUse hook can block a tool call, and how to watch every hook event live with my open-source Coding Agent Explorer.
Read more → -
Introducing the Coding Agent Explorer (.NET)
The Coding Agent Explorer is my open-source .NET tool that shows what Claude Code does: every API request, tool call and token count, live in a dashboard.
Read more → -
Duende IdentityServer 7: A Complete Setup Guide for ASP.NET Core
A step-by-step guide to setting up Duende IdentityServer 7 from scratch in ASP.NET Core: middleware, the sample UI, test users, configuration and logging.
Read more → -
BFF in ASP.NET Core #7 - Introducing the Duende BFF Library
How to replace a custom BFF in ASP.NET Core with the Duende BFF library: setup, management endpoints, local and remote APIs and sign-out. Part 7 of the series.
Read more → -
BFF in ASP.NET Core #6 - Securing our BFF with CORS
How CORS protects a Backend-for-Frontend (BFF) in ASP.NET Core from cross-origin attacks: simple and preflight requests, and a required X-CSRF header.
Read more → -
BFF in ASP.NET Core #5 - Automatic Token Renewal
How to add automatic access token renewal to a BFF in ASP.NET Core with refresh tokens and the Duende.AccessTokenManagement library, so users stay signed in.
Read more → -
BFF in ASP.NET Core #4 - Implementing a BFF from scratch
How to build a minimal Backend-for-Frontend (BFF) in ASP.NET Core from scratch: login, logout and session endpoints, OpenID Connect and a proxy for remote APIs.
Read more → -
BFF in ASP.NET Core #3 - The BFF Pattern Explained
How to secure the BFF session cookie in ASP.NET Core with HTTPS, HttpOnly, Secure, SameSite and the __Host- prefix, plus security headers for extra protection.
Read more → -
BFF in ASP.NET Core #2 - The BFF Pattern Explained
What the Backend-for-Frontend (BFF) pattern is, where it comes from, how it keeps tokens out of the browser and what is inside a BFF: sessions and an API proxy.
Read more → -
Implementing BFF Pattern in ASP.NET Core for SPAs
Why OpenID Connect tokens in the browser put single-page applications at risk, and how the BFF pattern in ASP.NET Core fixes it. Part 1 of a 7-part series.
Read more → -
How to Use KurrentDB for Event Sourcing in C# on Azure
How to deploy KurrentDB (formerly EventStoreDB) to Azure Container Instances, then append and read events from C#, for hands-on event sourcing in .NET.
Read more → -
Configuring ASP.NET Core Forwarded Headers Middleware
How to configure the ASP.NET Core Forwarded Headers Middleware behind a reverse proxy: which headers to process, which proxies to trust, and AllowedHosts.
Read more → -
Exploring the Forwarded Headers Middleware in ASP.NET Core
What the ASP.NET Core Forwarded Headers Middleware does behind a proxy, and how the X-Forwarded headers restore the client IP, scheme and host of each request.
Read more → -
AdditionalAuthorizationParameters in ASP.NET Core 9
How AdditionalAuthorizationParameters in ASP.NET Core 9 adds custom parameters to OpenID Connect authorization requests, without workarounds and also with PAR.
Read more → -
IdentityServer In Docker Containers – Handle Logout (Part 4)
How to fix logout for IdentityServer in Docker containers: sign-out redirects, id_token_hint and the IDX10205 issuer error, solved with a static IssuerUri.
Read more →
