--- title: "Tore Nestenius" description: "Under the hood of .NET, identity and security. Tore Nestenius writes about ASP.NET Core, C#, OpenID Connect, OAuth, IdentityServer and Azure." url: https://nestenius.se/ type: hub lang: en site: https://nestenius.se/ --- # Tore Nestenius Under the hood of .NET, identity and security I'm a Microsoft .NET MVP, consultant and trainer in Göteborg, Sweden, specializing in authentication, identity and security in .NET. Here I share what I learn when I dig into how things really work. ## Latest posts - October 25, 2026 **[What's new in ASP.NET Core authentication in .NET 11](https://nestenius.se/net/whats-new-in-asp-net-core-authentication-in-net-11/)** What changed in ASP.NET Core authentication, authorization and Data Protection in .NET 11 RC2 and the .NET 10 updates, found by comparing the source code. - April 16, 2026 **[Visualizing Claude Code MCP Requests with Coding Agent Explorer](https://nestenius.se/ai/visualizing-claude-code-mcp-requests-with-coding-agent-explorer/)** See the MCP traffic between Claude Code and any HTTP MCP server: set up the MCP Observer in my open-source Coding Agent Explorer and inspect each JSON-RPC call. - March 20, 2026 **[Exploring Claude Code Hooks with the Coding Agent Explorer (.NET)](https://nestenius.se/ai/exploring-claude-code-hooks-with-the-coding-agent-explorer-net/)** Claude Code hooks explained: events (PreToolUse, PostToolUse, UserPromptSubmit, Stop), how a hook blocks a tool call with an exit code, and how to watch them. - February 14, 2026 **[Introducing the Coding Agent Explorer (.NET)](https://nestenius.se/ai/introducing-the-coding-agent-explorer-net/)** The Coding Agent Explorer is my open-source .NET tool that shows what Claude Code does: every API request, tool call and token count, live in a dashboard. - January 22, 2026 **[Duende IdentityServer 7: A Complete Setup Guide for ASP.NET Core](https://nestenius.se/net/duende-identityserver-7-a-complete-setup-guide-for-asp-net-core/)** A step-by-step guide to setting up Duende IdentityServer 7 from scratch in ASP.NET Core: middleware, the sample UI, test users, configuration and logging. - August 20, 2025 **[BFF in ASP.NET Core #7 - Introducing the Duende BFF Library](https://nestenius.se/net/bff-in-asp-net-core-7-introducing-the-duende-bff-library/)** How to replace a custom BFF in ASP.NET Core with the Duende BFF library: setup, management endpoints, local and remote APIs and sign-out. Part 7 of the series. - August 14, 2025 **[BFF in ASP.NET Core #6 - Securing our BFF with CORS](https://nestenius.se/net/bff-in-asp-net-core-6-securing-our-bff-with-cors/)** How CORS protects a Backend-for-Frontend (BFF) in ASP.NET Core from cross-origin attacks: simple and preflight requests, and a required X-CSRF header. - August 6, 2025 **[BFF in ASP.NET Core #5 - Automatic Token Renewal](https://nestenius.se/net/bff-in-asp-net-core-5-automatic-token-renewal/)** How to add automatic access token renewal to a BFF in ASP.NET Core with refresh tokens and the Duende.AccessTokenManagement library, so users stay signed in. - July 30, 2025 **[BFF in ASP.NET Core #4 - Implementing a BFF from scratch](https://nestenius.se/net/bff-in-asp-net-core-4-implementing-a-bff-from-scratch/)** How to build a minimal Backend-for-Frontend (BFF) in ASP.NET Core from scratch: login, logout and session endpoints, OpenID Connect and a proxy for remote APIs. - July 23, 2025 **[BFF in ASP.NET Core #3 - The BFF Pattern Explained](https://nestenius.se/net/bff-in-asp-net-core-3-the-bff-pattern-explained/)** How to secure the BFF session cookie in ASP.NET Core with HTTPS, HttpOnly, Secure, SameSite and the \__Host- prefix, plus security headers for extra protection. - July 17, 2025 **[BFF in ASP.NET Core #2 - The BFF Pattern Explained](https://nestenius.se/net/bff-in-asp-net-core-2-the-bff-pattern-explained/)** What the Backend-for-Frontend (BFF) pattern is, where it comes from, how it keeps tokens out of the browser and what is inside a BFF: sessions and an API proxy. - July 9, 2025 **[Implementing BFF Pattern in ASP.NET Core for SPAs](https://nestenius.se/net/implementing-bff-pattern-in-asp-net-core-for-spas/)** Why OpenID Connect tokens in the browser put single-page applications at risk, and how the BFF pattern in ASP.NET Core fixes it. Part 1 of a 7-part series. - May 13, 2025 **[How to Use KurrentDB for Event Sourcing in C# on Azure](https://nestenius.se/net/how-to-use-kurrentdb-for-event-sourcing-in-c-on-azure/)** How to deploy KurrentDB (formerly EventStoreDB) to Azure Container Instances, then append and read events from C#, for hands-on event sourcing in .NET. - April 10, 2025 **[Configuring ASP.NET Core Forwarded Headers Middleware](https://nestenius.se/net/configuring-asp-net-core-forwarded-headers-middleware/)** Configure ASP.NET Core Forwarded Headers behind a reverse proxy: headers to process, proxies to trust, ASPNETCORE_FORWARDEDHEADERS_ENABLED and AllowedHosts. - January 22, 2025 **[Exploring the Forwarded Headers Middleware in ASP.NET Core](https://nestenius.se/net/exploring-the-forwarded-headers-middleware-in-asp-net-core/)** What the ASP.NET Core Forwarded Headers Middleware does behind a proxy, and how the X-Forwarded headers restore the client IP, scheme and host of each request. - December 30, 2024 **[AdditionalAuthorizationParameters in ASP.NET Core 9](https://nestenius.se/net/additionalauthorizationparameters-in-asp-net-core-9/)** How AdditionalAuthorizationParameters in ASP.NET Core 9 adds custom parameters to OpenID Connect authorization requests, without workarounds and also with PAR. ## About me Hi, I'm Tore Nestenius, a consultant and trainer in Göteborg, Sweden. I specialize in authentication, identity and security in .NET, and help teams with software architecture and Azure. I have worked with .NET since 2002. [![Microsoft Most Valuable Professional (MVP) badge](https://nestenius.se/_astro/microsoft-mvp-badge.BZMWQT9U_dBFrM.webp)](https://mvp.microsoft.com/en-US/mvp/profile/5150f7cb-54d8-48d8-a450-46b2b677d634) [Read more about me →](https://nestenius.se/about/) ## My Dometrain courses [![Getting Started: OpenID Connect, a Dometrain course by Tore Nestenius](https://nestenius.se/_astro/getting-started-openid-connect-thumbnail.BKepI2R0_Z10O631.webp)](https://dometrain.com/course/getting-started-openid-connect/) [![Getting Started: Authentication and Authorization in .NET, a Dometrain course by Tore Nestenius](https://nestenius.se/_astro/getting-started-authentication-and-authorization-in-dotnet-thumbnail.CZ0_PMy1_Z2lFmgK.webp)](https://dometrain.com/course/getting-started-authentication-and-authorization-in-dotnet/) ## Work with me Need a hand with authentication, architecture or a hard .NET problem? I offer consulting, coaching and training for development teams. [Learn more →](https://nestenius.se/services/)