Duende IdentityServer 7: A Complete Setup Guide for ASP.NET Core
A step-by-step guide to setting up Duende IdentityServer 7 from scratch in ASP.NET Core: middleware, the sample UI, test users, configuration and logging.
Read more →.NET
-
-
BFF in ASP.NET Core #7 - Introducing the Duende BFF Library
How to replace a custom BFF in ASP.NET Core with the Duende BFF library: setup, management endpoints, local and remote APIs and sign-out. Part 7 of the series.
Read more → -
BFF in ASP.NET Core #6 - Securing our BFF with CORS
How CORS protects a Backend-for-Frontend (BFF) in ASP.NET Core from cross-origin attacks: simple and preflight requests, and a required X-CSRF header.
Read more → -
BFF in ASP.NET Core #5 - Automatic Token Renewal
How to add automatic access token renewal to a BFF in ASP.NET Core with refresh tokens and the Duende.AccessTokenManagement library, so users stay signed in.
Read more → -
BFF in ASP.NET Core #4 - Implementing a BFF from scratch
How to build a minimal Backend-for-Frontend (BFF) in ASP.NET Core from scratch: login, logout and session endpoints, OpenID Connect and a proxy for remote APIs.
Read more → -
BFF in ASP.NET Core #3 - The BFF Pattern Explained
How to secure the BFF session cookie in ASP.NET Core with HTTPS, HttpOnly, Secure, SameSite and the __Host- prefix, plus security headers for extra protection.
Read more → -
BFF in ASP.NET Core #2 - The BFF Pattern Explained
What the Backend-for-Frontend (BFF) pattern is, where it comes from, how it keeps tokens out of the browser and what is inside a BFF: sessions and an API proxy.
Read more → -
Implementing BFF Pattern in ASP.NET Core for SPAs
Why OpenID Connect tokens in the browser put single-page applications at risk, and how the BFF pattern in ASP.NET Core fixes it. Part 1 of a 7-part series.
Read more → -
How to Use KurrentDB for Event Sourcing in C# on Azure
How to deploy KurrentDB (formerly EventStoreDB) to Azure Container Instances, then append and read events from C#, for hands-on event sourcing in .NET.
Read more → -
Configuring ASP.NET Core Forwarded Headers Middleware
How to configure the ASP.NET Core Forwarded Headers Middleware behind a reverse proxy: which headers to process, which proxies to trust, and AllowedHosts.
Read more → -
Exploring the Forwarded Headers Middleware in ASP.NET Core
What the ASP.NET Core Forwarded Headers Middleware does behind a proxy, and how the X-Forwarded headers restore the client IP, scheme and host of each request.
Read more → -
AdditionalAuthorizationParameters in ASP.NET Core 9
How AdditionalAuthorizationParameters in ASP.NET Core 9 adds custom parameters to OpenID Connect authorization requests, without workarounds and also with PAR.
Read more → -
IdentityServer In Docker Containers – Handle Logout (Part 4)
How to fix logout for IdentityServer in Docker containers: sign-out redirects, id_token_hint and the IDX10205 issuer error, solved with a static IssuerUri.
Read more → -
IdentityServer in Docker Containers: HTTPS and SameSite (Part 3)
Why the IdentityServer login fails over HTTP in Docker (SameSite and Secure cookies) and how to fix it with HTTPS and the ASP.NET Core dev certificate. Part 3.
Read more → -
IdentityServer in Docker Containers: Networking (Part 2)
How to fix networking between IdentityServer and a client in Docker Compose: service names, internal ports, MetadataAddress and the issuer mismatch. Part 2.
Read more → -
IdentityServer in Docker Containers - Part 1
How to run Duende IdentityServer and an ASP.NET Core client in separate Docker containers with Docker Compose, and why localhost fails between them. Part 1.
Read more → -
Pushed Authorization Requests (PAR) in ASP.NET Core 9
What Pushed Authorization Requests (PAR) are, why they make OpenID Connect sign-in safer, and how to use them in ASP.NET Core 9 with Duende IdentityServer.
Read more → -
Discovering .NET codebases using code coverage and NCrunch
How to learn an unfamiliar .NET codebase by running a single test with NCrunch code coverage and Runtime Data Inspection, shown on the MSAL.NET library.
Read more → -
Introducing the Data Protection API Key Ring Debugger
A small ASP.NET Core debugger I wrote to look inside the Data Protection key ring: create and revoke keys, and view the encryptor, repository and stored keys.
Read more → -
Persisting the ASP.NET Core Data Protection Key Ring in Azure Key Vault
How to persist the ASP.NET Core Data Protection key ring in Azure Key Vault with a custom IXmlRepository, what the key ring does, and the Key Vault size limit.
Read more → -
Improving ASP.NET Core Security By Putting Your Cookies On A Diet
How to shrink the ASP.NET Core authentication cookie with a session store (ITicketStore), and why it is safer: a stolen cookie can't be reused after sign-out.
Read more → -
Demystifying OpenID Connect's State and Nonce Parameters in ASP.NET Core
What is inside the OpenID Connect state and nonce parameters in ASP.NET Core? I decrypt the state, add custom properties and show how the nonce is used.
Read more → -
Exploring what is inside the ASP.NET Core cookies
What the ASP.NET Core authentication, session and antiforgery cookies contain, how the Data Protection API protects them, and how to look inside them yourself.
Read more → -
Debugging cookie problems in ASP.NET Core
How to debug cookie problems in ASP.NET Core: cookies the browser rejects, cookies missing from requests, lost cookies and the SameSite rules behind them.
Read more → -
BearerToken: The new Authentication handler in ASP.NET Core 8
How the BearerToken authentication handler in ASP.NET Core 8 works, what its access and refresh tokens contain, and how it compares to Cookie and JwtBearer.
Read more → -
Debugging JwtBearer Claim Problems in ASP.NET Core
Debug missing claims in ASP.NET Core JwtBearer: inspect the access token, MapInboundClaims, the name and role claim types, and a claims diagnostic endpoint.
Read more → -
Debugging OpenID Connect Claim Problems in ASP.NET Core
How to fix missing OpenID Connect claims in ASP.NET Core: check the ID token and UserInfo, claim actions, claim mapping, and the name and role claims.
Read more → -
Troubleshooting JwtBearer authentication issues in ASP.NET Core
How to troubleshoot JwtBearer authentication in ASP.NET Core APIs: 401 vs 403, middleware order, the WWW-Authenticate error details and the authentication logs.
Read more → -
IdentityServer - IdentityResource vs. ApiResource vs. ApiScope
The difference between IdentityResource, ApiResource and ApiScope in IdentityServer, and how identity scopes, access scopes and API resources shape tokens.
Read more → -
ASP.NET Core 6 - JwtBearer library: what’s new?
What changed in the ASP.NET Core JwtBearer library from 3.1 to 6: MapInboundClaims, a custom back-channel HttpClient, refresh intervals and token validation.
Read more → -
TNValidate is now open source
TNValidate, a C# validation library with a fluent interface for defining validation rules, is now open source on GitHub. A short look at how to use it.
Read more →
