# nestenius.se

> Personal blog of Tore Nestenius, an independent software consultant and trainer based in Helsingborg, Sweden. The site publishes technical articles on .NET, C#, ASP.NET Core, web security, authentication (OAuth, OpenID Connect, JWT, IdentityServer), software architecture, Azure, AI coding agents, and retro-hardware reverse engineering. URL shape is `/{category}/{slug}/`; the RSS feed is at `/rss`.

## About the author

- [About](https://nestenius.se/about/): Bio, career timeline, popular blog posts, open source projects, and personal history (Atari ST demo scene, Sega Mega Drive reverse engineering, Programmers Heaven).
- [Services](https://nestenius.se/services/): Consulting, training, and coaching offerings on .NET and architecture.
- [Contact](https://nestenius.se/contact/): Email, phone, LinkedIn, Twitter, GitHub.

## Browse the blog

- [Home page](https://nestenius.se/): Lists the 16 most recent articles.
- [RSS feed](https://nestenius.se/rss): Full-content RSS 2.0 with `<content:encoded>` and `<dc:creator>`.
- [Sitemap](https://nestenius.se/sitemap-index.xml): Machine-readable list of every page.

## Posts by category

### .NET

Index: https://nestenius.se/net/

- [Duende IdentityServer 7: A Complete Setup Guide for ASP.NET Core](https://nestenius.se/net/duende-identityserver-7-a-complete-setup-guide-for-asp-net-core/): Duende IdentityServer is the leading OpenID Connect and OAuth 2 server for .NET. In this tutorial, I'll walk you through setting up Duende IdentityServer
- [BFF in ASP.NET Core #7 - Introducing the Duende BFF Library](https://nestenius.se/net/bff-in-asp-net-core-7-introducing-the-duende-bff-library/): In the previous blog posts in this series, we built our own Backend-for-Frontend (BFF) implementation in ASP.NET Core from scratch. Now, you might be
- [BFF in ASP.NET Core #6 - Securing our BFF with CORS](https://nestenius.se/net/bff-in-asp-net-core-6-securing-our-bff-with-cors/): In this post, we take the next step in securing our Backend-for-Frontend (BFF) by adding robust Cross-Origin Resource Sharing (CORS) protection. CORS is
- [BFF in ASP.NET Core #5 - Automatic Token Renewal](https://nestenius.se/net/bff-in-asp-net-core-5-automatic-token-renewal/): Nobody wants to sign in every hour. Yet that's exactly what happens when access tokens expire in applications without proper token management. The good
- [BFF in ASP.NET Core #4 - Implementing a BFF from scratch](https://nestenius.se/net/bff-in-asp-net-core-4-implementing-a-bff-from-scratch/): In this blog post, we'll implement a minimal yet complete Backend-for-Frontend (BFF) in ASP.NET Core. By starting with a simple foundation and adding
- [BFF in ASP.NET Core #3 - The BFF Pattern Explained](https://nestenius.se/net/bff-in-asp-net-core-3-the-bff-pattern-explained/): The BFF pattern eliminates many SPA security risks, but it introduces a new critical component: the session cookie. This cookie becomes the key to your
- [BFF in ASP.NET Core #2 - The BFF Pattern Explained](https://nestenius.se/net/bff-in-asp-net-core-2-the-bff-pattern-explained/): How do you secure a Single-Page Application without storing tokens in the browser? The answer lies in the Backend-for-Frontend (BFF) pattern. This
- [Implementing BFF Pattern in ASP.NET Core for SPAs](https://nestenius.se/net/implementing-bff-pattern-in-asp-net-core-for-spas/): This multi-part blog series will show you how to implement secure authentication for Single-Page Applications using the Backend-for-Frontend (BFF) pattern
- [How to Use KurrentDB for Event Sourcing in C# on Azure](https://nestenius.se/net/how-to-use-kurrentdb-for-event-sourcing-in-c-on-azure/): In this blog post, you will learn how to deploy a test instance of KurrentDB to Azure and access it from a console application in .NET.
- [Configuring ASP.NET Core Forwarded Headers Middleware](https://nestenius.se/net/configuring-asp-net-core-forwarded-headers-middleware/): In my previous blog post, I explained what the Forwarded Headers Middleware does and why it matters. In this post, I will show you how to add it to your
- [Exploring the Forwarded Headers Middleware in ASP.NET Core](https://nestenius.se/net/exploring-the-forwarded-headers-middleware-in-asp-net-core/): Proxies are vital for load balancing and security, but they obscure the actual client IP, scheme, and domain, causing broken links, inaccurate logging
- [AdditionalAuthorizationParameters in ASP.NET Core 9](https://nestenius.se/net/additionalauthorizationparameters-in-asp-net-core-9/): A practical look at AdditionalAuthorizationParameters in ASP.NET Core 9. How it simplifies customizing OAuth/OIDC authorization requests and how it works with PAR.
- [IdentityServer In Docker Containers – Handle Logout (Part 4)](https://nestenius.se/net/identityserver-in-docker-containers-part-4/): In this final post in this series, we’ll now resolve logout challenges you might run into with IdentityServer, ensure proper sign-out redirects, and
- [IdentityServer in Docker Containers: HTTPS and SameSite (Part 3)](https://nestenius.se/net/identityserver-in-docker-containers-part-3/): In this third part of the series, we tackle login issues in IdentityServer caused by cookie restrictions in HTTP and show how to resolve them by
- [IdentityServer in Docker Containers: Networking (Part 2)](https://nestenius.se/net/identityserver-in-docker-containers-part-2/): This is part 2 of a blog series on containerizing a Duende IdentityServer and a client application. In this post, we resolve communication challenges that
- [IdentityServer in Docker Containers - Part 1](https://nestenius.se/net/identityserver-in-docker-containers-part-1/): Getting Duende IdentityServer and a client application up and running in separate containers can be challenging. This blog post will provide a
- [Pushed Authorization Requests (PAR) in ASP.NET Core 9](https://nestenius.se/net/pushed-authorization-requests-par-in-asp-net-core-9/): ASP.NET Core 9 introduces support for Pushed Authorization Requests (PAR) in its OpenIdConnect authentication handler. But what exactly is PAR, and why
- [Discovering .NET codebases using code coverage and NCrunch](https://nestenius.se/net/discovering-net-codebases-using-code-coverage-and-ncrunch/): Exploring and discovering unfamiliar codebases is always a challenge. In this blog post, I will introduce a novel way to explore a new codebase by looking
- [Introducing the Data Protection API Key Ring Debugger](https://nestenius.se/net/introducing-the-data-protection-api-key-ring-debugger/): When you’re working with the Data Protection API in ASP.NET, you quickly notice how powerful and simple this service is. At the same time, you have little
- [Persisting the ASP.NET Core Data Protection Key Ring in Azure Key Vault](https://nestenius.se/net/persisting-the-asp-net-core-data-protection-key-ring-in-azure-key-vault/): The ASP.NET Core Data Protection API (DPAPI) is an essential service in ASP.NET Core that is often overlooked. This post will give an overview of what it
- [Improving ASP.NET Core Security By Putting Your Cookies On A Diet](https://nestenius.se/net/improving-asp-net-core-security-by-putting-your-cookies-on-a-diet/): In this blog post, we’ll explore a practical way to enhance the security of your ASP.NET Core applications by reducing the size of authentication cookies
- [Demystifying OpenID Connect's State and Nonce Parameters in ASP.NET Core](https://nestenius.se/net/demystifying-openid-connects-state-and-nonce-parameters-in-asp-net-core/): In the world of web application security, OpenID Connect plays a key role in streamlining authentication processes. But what makes it really tick? In this
- [Exploring what is inside the ASP.NET Core cookies](https://nestenius.se/net/exploring-what-is-inside-the-asp-net-core-cookies/): ASP.NET Core generates various types of cookies, such as authentication, antiforgery, and session cookies. In this blog post, we’ll take a closer look at
- [Debugging cookie problems in ASP.NET Core](https://nestenius.se/net/debugging-cookie-problems/): Having answered over 1000 questions on Stack Overflow, I’ve found that cookie-related issues are a frequent challenge for developers using ASP.NET Core
- [BearerToken: The new Authentication handler in ASP.NET Core 8](https://nestenius.se/net/bearertoken-the-new-authentication-handler-in-net-8/): Microsoft introduced the new BearerToken authentication handler in ASP.NET Core 8 as part of an initiative to streamline and modernize authentication
- [Debugging JwtBearer Claim Problems in ASP.NET Core](https://nestenius.se/net/debugging-jwtbearer-claim-problems-in-asp-net-core/): A common problem when protecting your ASP.NET Core APIs is that expected claims are not found in the user object. In this blog post, I will give you some
- [Debugging OpenID Connect Claim Problems in ASP.NET Core](https://nestenius.se/net/missing-openid-connect-claims-in-asp-net-core/): Missing claims in the ClaimsPrincipal user object is a frequent problem when using OpenID Connect authentication in ASP.NET Core. In this blog post, we'll
- [Troubleshooting JwtBearer authentication issues in ASP.NET Core](https://nestenius.se/net/troubleshooting-jwtbearer-authentication-problems-in-asp-net-core/): One of the most frequent questions I encounter on Stack Overflow is how to troubleshoot JwtBearer authentication issues in ASP.NET Core. In this post
- [IdentityServer - IdentityResource vs. ApiResource vs. ApiScope](https://nestenius.se/net/identityserver-identityresource-vs-apiresource-vs-apiscope/): Understanding the differences between IdentityResource, ApiResource, and ApiScope in Duende IdentityServer is a common question among developers, often
- [ASP.NET Core 6 - JwtBearer library: what’s new?](https://nestenius.se/net/asp-net-core-jwtbearer-library-whats-new/): As a developer and trainer, it is hard to keep up with all the changes in all the libraries. In this blog post, I will summarize the recent key changes
- [TNValidate is now open source](https://nestenius.se/net/tnvalidate-is-now-open-source/): Our internal validation library TNValidate is now available as a project on GitHub. We released this as open source because we wanted to let others take

### Azure

Index: https://nestenius.se/azure/

- [Introducing the Cloud Debugger for Azure](https://nestenius.se/azure/introducing-the-cloud-debugger-for-azure/): The Cloud Debugger is an open-source tool for Azure developers to explore, learn, and troubleshoot their Azure cloud environments. Whether preparing for
- [User Delegation SAS Tokens In Azure Explained](https://nestenius.se/azure/user-delegation-sas-tokens-in-azure-explained/): I discovered many interesting Azure features while studying for the AZ-204 certification. One of these features is User Delegation SAS tokens, a way to
- [Running Docker in an Azure Windows Virtual Machine – Not so fast!](https://nestenius.se/azure/running-docker-in-an-azure-windows-virtual-machine-not-so-fast/): This blog post describes getting Docker up and running inside an Azure Windows Virtual Machine. This might sound like a simple task, but trust me, there
- [Deploy Container to Azure App Services with System-Assigned Identity](https://nestenius.se/azure/deploy-a-container-to-azure-app-services-using-a-system-assigned-identity/): In this blog post, I will guide you through deploying a custom container image to Azure App Services from a private container registry using a
- [Deploy containers Azure App Services using user-assigned managed identity](https://nestenius.se/azure/deploy-a-container-to-azure-app-services-using-azure-cli-and-user-assigned-managed-identity/): This blog post describes my approach to successfully deploying a custom container image to Azure App Services from a private container registry, using a
- [DefaultAzureCredentials Under the Hood](https://nestenius.se/azure/default-azure-credentials-under-the-hood/): The DefaultAzureCredentials is key for using Azure services, but how exactly does it work and when should you use it? In this post, we’ll break down how

### AI

Index: https://nestenius.se/ai/

- [Visualizing Claude Code MCP Requests with Coding Agent Explorer](https://nestenius.se/ai/visualizing-claude-code-mcp-requests-with-coding-agent-explorer/): Learn how to use the MCP Observer in the Coding Agent Explorer to intercept and visualize all traffic between Claude Code and any MCP server in a real-time dashboard.
- [Exploring Claude Code Hooks with the Coding Agent Explorer (.NET)](https://nestenius.se/ai/exploring-claude-code-hooks-with-the-coding-agent-explorer-net/): Ever wondered what Claude Code is actually doing while it works? Every file it reads, every command it runs, every permission it requests. Claude Code
- [Introducing the Coding Agent Explorer (.NET)](https://nestenius.se/ai/introducing-the-coding-agent-explorer-net/): I'm excited to introduce you to the Coding Agent Explorer, a new open-source .NET teaching tool I've created that lets you see exactly what happens under

### Hardware

Index: https://nestenius.se/hardware/

- [How I built my own Sega Mega Drive hardware dev kit from scratch](https://nestenius.se/hardware/how-i-built-my-own-sega-mega-drive-hardware-dev-kit-from-scratch/): Over 30 years ago, I decided to take on the challenge of building my own Sega Mega Drive hardware dev kit from scratch. At the time, I was eager to