In this post I look at the new experimental support for DBSC provided by the Microsoft.AspNetCore.Authentication.DeviceBoundSessions package

In this post I provide an introduction to Device Bound Session Credentials, I look at how DBSC protects against session hijacking, and how the protocol works

In this post I discuss the System.Text.Json support for unions and closed hierarchies coming in .NET 11, the decisions made, and some of the sharp edges I hit

Multiple line secrets or configuration do not work in Aspire per default. An example of this is using a PEM file for certificates. This posts shows how the multiple line configuration parameters ca…

This blog demonstrates how to use Aspire to set up a solution for developing and deploying an ASP.NET Core web application with Auth0 as the identity provider and a downstream API. The application …

This post should how to implement a web application which needs secure access and secure identities. The application uses Angular as the UI tech, ASP.NET Core as the backend tech and a backend for …

This article shows how to implement a SAML federation from an ASP.NET Core Identity application using Sustainsys.Saml2.AspNetCore2. Entra ID is used to implement the SAML authentication and the use…

This issue includes bits of AI, software development, C++, C#, diagnostics, architecture and of course .NET and .NET Internals.

in this post I take a short look at the new MoveChunks API, explore how it works, what it's for, and how the new API provides opportunities for public APIs

Was mir zuletzt auffällt und zunehmend auf den Keks geht: KI-generierte Texte, KI-generierte Plakate, KI-generierte Geburtstagskärtchen. Dabei meine ich nicht den ganzen Fake-SEO-Content oder die Scam...

Block AI crawlers from wasting your server resources with a lightweight ASP.NET Core middleware that enforces robots.txt rules at the HTTP level.

Boost app security with new Sign in with Google session metadata. Use OIDC claims like auth_time and amr to verify login freshness and authentication methods (MFA, hardware keys) for dynamic, risk-bas...

This is a bit of rambling from me and what I believe is a good setup for developing software together with AI tools. I believe the AI tools are good, which will help good developers produce better …

SAML 2.0 is now in Duende IdentityServer! Easily integrate SAML-only SaaS apps like HubSpot and Salesforce into your existing SSO setup.

I was recommended NCronJob for implementing a background worker in ASP.NET Core and so I decided to give it a try, read the docs and learn this. This NuGet package is open source and works great. I…

In this post I discuss the support for union types released in .NET 11, how they're implemented, the choices made, and how to create your own

This issue includes bits of AI (too much AI), C#, software development, architecture, Windows, security, NTFS and of course .NET and .NET Internals.

This week, I was updating my Aspire applications after the latest release and I ran into a deployment bug for my test deployments. I could no longer deploy the database to Azure SQL. I got the foll…

Backend for frontend security using Angular CLI and ASP.NET Core backend - damienbod/bff-aspnetcore-angular

In Azure DevOps organizations that are connected to Microsoft Entra, you may spot (duplicated) users with email prefixed with OIDCONFLICT_UpnReuse_{OID_HERE} (i.e. when trying to give them access or when mentioning them): Such users are neither visible in the Azure DevOps Web UI under Organization settings > General > Users nor when querying all users via graph or via the Azure DevOps CLI.

Configurable token lifetimes in the Microsoft identity platform went GA and I thought I would look at implementing this using a .NET console application using Microsoft Graph . This article looks a…

Certificate Manager in .NET Core for creating and using X509 certificates - damienbod/AspNetCoreCertificates

This article shows how to remove the sign-up flow from Entra External ID user flows. This is required because SMS and Phone validation can be abused by bots to run up costs on the tenant. The bots …

Using Damien Bowden's secure ASP.NET Core and Angular BFF template as a starting point, this post shows how to integrate Aspire to improve local development and prepare the application for containeriz...

In this post I take a brief look at the Microsoft.Extensions.Options.Contextual package to understand what it's for, how to use it, and whether to use it or not

The Axios NPM package has been compromised and the maintainer of the project has been locked out of their account. This will go down in history as one of the most successful software supply chain attacks ever

This post looks at implementing a guest user invite in a cross tenant setup. This is useful when creating partner tenants using an Entra ID MAU license for all partner guests and members. This make…

OpenIddict backend for frontend security using Angular CLI and ASP.NET Core backend - damienbod/bff-openiddict-aspnetcore-angular

In this post I show how you can use MeterListener to listen to Instrument measurements, how to trigger Observable measurements, and how to aggregate values.

OpenIddict with Angular and Blazor WASM BFF OpenID Connect Code Flow with PKCE clients and ASP.NET Core APIs - GitHub - damienbod/AspNetCoreOpenIddict: OpenIddict with Angular and Blazor WASM BFF ...

The number of DDoS attacks more than doubled in 2025. The network layer is under particular threat as hyper-volumetric attacks grew 700%.

The article looks at implementing security using OAuth for the swiyu Public Beta Trust Infrastructure generic containers. The container provides endpoint for OpenID verification and the management …

This post looks at hardening the security for the swiyu public beta infrastructure. The generic containers provide both management APIs and wallet APIs which support the OpenID for Verifiable Prese…

In this post I provide an introduction to the System.Diagnostics.Metrics API, and show how to create a custom metric and read it with dotnet-coutners

This post looks at implement client assertions in an ASP.NET Core application OpenID Connect client using OAuth Demonstrating Proof of Possession (DPoP) and OAuth Pushed Authorization Requests (PAR…

**5th February - DotNet Zurich @ Isolutions** *Join us in person at Isolutions!!* This event will happen at Isolutions, The Circle. **Agenda:** * 17:45 Reception open &

Experimental alternative flow for OAuth First-Party Applications - damienbod/OAuthClientAssertionsPerInstance

The post shows how to implement a step up authorization using the OAuth 2.0 Step Up Authentication Challenge Protocol RFC 9470. The application uses ASP.NET Core to implement the API, the web appli…

This article explores how to implement Level of Identification (LOI) in an ASP.NET Core application. The solution uses Duende IdentityServer as the OpenID Connect provider and ASP.NET Core Identity…

In this post we start creating a TypeInfoResolver modifier in System.Text.Json to encrypt and decrypt JSON properties during serialisation.

This post shows how to implement an application which requires a user to authenticate using passkeys. The identity provider returns three claims to prove the authentication level (loa), the identit…

**5th February - DotNet Zurich @ Isolutions** *Join us in person at Isolutions!!* This event will happen at Isolutions, The Circle. **Agenda:** * 17:45 Reception open &