Contributions
Article
Proxies are vital for load balancing and security, but they obscure the actual client IP, scheme, and domain, causing broken links, inaccurate logging, and other headaches. In this post, we’ll look at how ASP.NET Core’s Forwarded Headers Middleware restores these details so your services behave as though they’re directly on the public internet.
Article
Learn how AdditionalAuthorizationParameters in ASP.NET Core 9 simplify adding custom
parameters to OAuth and OpenID Connect flows.
parameters to OAuth and OpenID Connect flows.
Tutorial
In this final post in this series, we’ll now resolve logout challenges you might run into with IdentityServer, ensure proper sign-out redirects, and summarize the key takeaways from the series.
Article
In this third part of the series, we tackle login issues in IdentityServer caused by
cookie restrictions in HTTP and show how to resolve them by implementing HTTPS. We’ll
guide you through securing communication between the host, client, and IdentityServer
containers and configuring HTTPS in Docker to ensure everything runs smoothly.
cookie restrictions in HTTP and show how to resolve them by implementing HTTPS. We’ll
guide you through securing communication between the host, client, and IdentityServer
containers and configuring HTTPS in Docker to ensure everything runs smoothly.
Article
This is part 2 of a blog series on containerizing a Duende IdentityServer and a client application.
In this post, we resolve communication challenges that arise when these applications run in separate
Docker containers. You’ll learn how to fix back-channel issues, handle localhost conflicts, and
establish proper networking between the client and IdentityServer.
In this post, we resolve communication challenges that arise when these applications run in separate
Docker containers. You’ll learn how to fix back-channel issues, handle localhost conflicts, and
establish proper networking between the client and IdentityServer.
Tutorial
Getting Duende IdentityServer and a client application up and running in separate containers can be challenging. This blog post will provide a step-by-step guide for a smooth setup and show you how to resolve common challenges along the way. We will also learn about security, cookies, ports, containers, and certificates.
Article
ASP.NET Core 9 introduces support for Pushed Authorization Requests (PAR) in its OpenIdConnect authentication handler. But what exactly is PAR, and why does it matter? In this post, I’ll explain what PAR is, how it works and how to use it.
Article
The blog post explains how User Delegation SAS tokens enhance Azure Blob Storage security by allowing applications to create tokens tied to Azure Active Directory identities, offering better access control without using sensitive storage account keys.
Library
CloudDebugger - the exploration tool for Azure cloud developers
Article
Exploring and discovering unfamiliar codebases is always a challenge. In this blog post, I will introduce a novel way to explore a new codebase by looking at the code coverage using NCrunch.NET.
Article
The DefaultAzureCredentials is key for using Azure services, but how exactly does it work and when should you use it? In this post, we’ll break down how it operates, its challenges, and other ways to access Azure services. This guide will help you get a clearer picture of how to handle Azure authentication simply and effectively.
Article
When you’re working with the Data Protection API in ASP.NET, you quickly notice how powerful and simple this service is. At the same time, you have little insight into how it operates. In this blog post, I will introduce a simple debugger tool for this API.
Article
The Data Protection API (DPAPI) is an essential service in ASP.NET Core that is often overlooked. This post will give an overview of what it does and how we can store its encryption keys in Azure Key Vault.
Article
This blog post explores how we can improve the security of your ASP.NET Core authentication security by reducing the size of our cookies.
Article
In this blog post, we dive deep into two critical security features of OpenID Connect – the state and nonce parameters – and how they are used in ASP.NET Core.
Article
ASP.NET Core issues several cookies, including authentication, antiforgery, and session cookies. This blog post will explore what these cookies contain and how they are protected.
Article
Dealing with cookie problems? I’ve written a handy step-by-step troubleshooting guide for ASP.Net Core! It walks you through how to fix browser omissions and rejections, and lost cookies.
Article
In ASP.NET Core 8, Microsoft added a new authentication handler named BearerToken. In this blog post, I will explain how it works and its purpose.
Tutorial
Struggling to solve missing JwtBearer claims in ASP.Net Core? I’ve written an easy step-by-step diagnostic guide that can help you.
Article
A common issue with OpenID Connect authentication in ASP.NET Core is that expected claims are missing from the ClaimsPrincipal user object. In this blog post, I will provide some ideas for how to diagnose these types of problems.
Tutorial
Struggled to troubleshoot Jwtbearer authentication problems in ASP.NET? I’ve written about some of
the best step-by step ways to do so in this blog post.
the best step-by step ways to do so in this blog post.
Article
This blog post clarifies the various resource concepts in Duende IdentityServer, including IdentityResources,
ApiResources and ApiScopes.
ApiResources and ApiScopes.