It’s VisugXL week! That’s all. That’s the post. 😎 Make sure to grab your tickets now (only a few seats left) 👉 www.visug.be/Events/102

Worked on a good longread: simplify your identity mess! Learn how a Federation Gateway orchestrates all your IdPs (Entra ID, Google, SAML). Must-read architecture deep dive! duende.link/8aefizq #IdentityOrchestration #SSO #Security #dotnet

It’s VisugXL week! 🎉 Thanks to our amazing partners, we we can keep this event completely FREE! And guess what? There are still some seats left! Grab yours now! 👉 www.visug.be/Events/102

December 2nd is #VISUG time! 🎉 Join us at ChipSoft in Antwerp as we’re diving into distributed coordination (aka “chaos but make it elegant”) and Infrastructure as Code (aka “stop clicking around in portals like it’s 2009”). Grab your FREE ticket 👉 www.visug.be/Events/105

In this video, Christian Wenz dives deep into Cross-Site Request Forgery (CSRF), a simple yet devastating attack that has plagued web applications for years. Learn what CSRF is, how it works, and how to defend against it in #aspnetcore youtu.be/WUJrKw05YfI #dotnet

🎤 Meet one of our VISUG XL 2025 speakers: 𝐒𝐡𝐚𝐮𝐧 𝐋𝐚𝐰𝐫𝐞𝐧𝐜𝐞! We’re excited to welcome 𝐒𝐡𝐚𝐮𝐧 this year at Visug XL, our yearly, free, community-driven .NET conference. 📅 November 28, 2025 📍 UCLL Leuven 👉 More information and tickets: www.visug.be/Events/102 #VisugXL #DotNet #Community #Conference

Claims and scopes describe user information in OpenID Connect. Let's see how Duende IdentityServer handles consent, different client types, required vs. optional scopes, and what happens when a client doesn't get everything it asked for. duende.link/97aeqlj 👀 #dotnet #aspnetcore

Pssst... We at VISUG know it's "Herfstvakantie" and how challenging it can be with the kids. 🤪 So, here's a escape for all the parents out there: this Thursday at Spoor 18 in Mechelen, we've got food, drinks and sessions! (Not looking for an escape? You're welcome as well 😉) www.visug.be/Events/104

Adding .NET 10 Passkey Support to Duende IdentityServer 👉 duende.link/berqe86 Learn how to add #dotnet 10 passkey support to a non-Blazor project such as MVC or Razor Pages. #security #aspnetcore #identity #webauthn

Our next livestream with Active Solution is coming up soon! Custom Authentication in #aspdotnet Core Go beyond the built-in authentication handlers in ASP.NET and learn about a RemoteAuthenticationHandler. Register 👉 t.co/jgxpGooTE7 #dotnet #security #identity

🎤 Meet one of our VISUG XL 2025 speakers: 𝐀𝐧𝐣𝐮𝐥𝐢 𝐉𝐡𝐚𝐤𝐫𝐲! We’re excited to welcome 𝐀𝐧𝐣𝐮𝐥𝐢 this year at Visug XL, our yearly, free, community-driven .NET conference. 📅 November 28, 2025 📍 UCLL Leuven 👉 More information and tickets: www.visug.be/Events/102 #VisugXL #DotNet #Community #Conference

The server's origin is used to generate passkey credentials, making them resistant to phishing. A credential signed for one app can't be used elsewhere. What about subdomains? Or multiple domains? In this post, we'll explore some options. duende.link/igeq87f #dotnet #security #passkeys #webauthn

We're happy to start sponsoring the Spectre.Console project! It is a #dotnet library that makes it easier to create beautiful console applications by giving you access to standard components you may find in a CLI experience. Go check it out! duende.link/sp3ctr3

Say goodbye ✋ to passwords, and hello 👋 to secure, phishing-resistant logins: passkey credentials. Part 1 of our 4-part blog series covers password and authentication evolution. Longread ahead! 👀 duende.link/p455k3y #passkeys #webauthn #dotnet #security #aspnetcore

Discover a key update in #dotnet 10 that improves local development! 🔥 In this blog post, we explain how a new TLS certificate and unique local domains can solve cookie conflicts and better mimic production environments. duende.link/arbgu89 #aspnetcore #security

Hey @jetbrains.com, I'm getting an "Error 403: Not Authorized" error when completing the JetBrains Developer Recognition Program form. I tried signing in first with my account, same result.

Let's explore the world of OpenID Connect with a focus on claims, scopes, and how Duende IdentityServer facilitates authentication in #dotnet applications. Learn how apps request necessary claim information! 👩🏼‍🏫 duende.link/j28b2bw #security #identity #aspnetcore

Brace yourself, w̶i̶n̶t̶e̶r̶ #dotnet 10 is coming! ⛄️ Let's look at the new capabilities and features we are excited about for the upcoming .NET release in November. Expect passkeys, #opentelemetry additions,TLS for *.localhost, and more. 👀 duende.link/qet4wp9 #aspnetcore

Roland's video series continues! Let's see how to protect SPAs with OpenID Connect created with libraries like #Angular and #React or plain javascript. We'll see why you want to use a BFF & how this pattern makes secure API access less cumbersome youtu.be/pSTMCyQH_E4 #dotnet #identity #aspnetcore

HttpClient is at the heart of many projects. DelegatingHandlers let you intercept and modify requests and responses, extending base functionality. In this blog post, we'll look at DelegatingHandler and how it can make HttpClient even more powerful! 💪 duende.link/78qe4kj #dotnet #aspnetcore

We're hiring! At @duendesoftware.com, we're looking for someone to join our Customer Success team. It's a 100% remote position but we are looking for someone based in the US East Coast region for time zone reasons. If you're interested, visit duendesoftware.com/careers/cust... for details! #hiring

Holy moly! Lervig has some crazy beers in their rack house line!

How to test your #IdentityServer? In this post, we demonstrate how to setup and run automated tests with your favorite test framework. #mstest #xunit #nunit #dotnet #security duende.link/a4rs979

What are Best Practices of Web Application Security in 2025? This post focuses on key security and authentication flows using OAuth 2.0 and OpenID Connect, flows to avoid, security measures to implement, and IETF Best Current Practices. duende.link/iyqe3fk #security #dotnet

Fresh post on external providers in #aspnetcore We cover initial setup, the connection between external and cookie authentication, and discusses why alternatives might be better for production apps. duende.link/q24tubs #security #identity #dotnet

Coming to an ASP.NET Core HTTPS development certificate near you soon...

Check out the freshly deployed IdentityServer 7.3.0 Release Candidate 1. It brings FAPI 2.0 profile certification, JWT response from the introspection endpoint, diagnostics data, OpenTelemetry updates, and more! duende.link/is73rc1 #dotnet #security

The agenda for #CloudBrew is ready! Why not join us in December? Early Bird tickets are now also available! 👉 www.cloudbrew.be #dotnet #azure

How I got involved in the Backend for Frontend (BFF) spec? @philippederyck.bsky.social built a demo to show how insecure single-page applications can be! Full interview: youtu.be/urS9wstmN2U More on Backend for Frontend: duende.link/bff #dotnet #security #bff #oauth2

The #dotnet 8.0.17 upgrade fixed validation of forwarded headers and proxy server configuration in load balanced scenarios. Great! Or not 🤔 This patch may affect your #aspnetcore app. 😱 Check our blog post for background and fix: duende.link/0mgnet8

Got a killer dev talk? Bring it to the stage at VisugXL 2025! 🎤 We’re talking .NET, Azure, OSS, real-world code — the good stuff. 📅 Nov 28 – Leuven, Belgium Hit us with your best shot 👉 sessionize.com/visugxl-2025 #VisugXL2025 #CallForSpeakers #dotnet #Azure #DevRockstars

Terms like "client" in OpenID Connect and OAuth 2.0 are clear for security folks, but non-technical people are sometimes confused. In this post, let's clarify what a "client" means in application security. duende.link/m8tyde4 #dotnet #security #identity

Me while I'm waiting for my Keychron keyboard order status to switch to "shipped".

WiFi 7 🏎️💨!

Cheers to the weekend 🍻

Sometimes, I see errors or bugs that are so obviously trivial to fix (or even worse, regression bugs), that make me think two things: 1. Is everyone really just using AI to code these days or did the average developer become soo lax? 2. Give me an hour and I’ll fix it for you. Sheesh.

Tonight, it is time to assemble a new gaming rig 🥳 #gaming #desktop

Did you see #dotnet run app.cs was announced at #MSBuild for .NET 10? We've been trying it out to test the #IdentityServer login flow, and it's quite nice! In this post we'll see how to test first-party logins work properly, entirely through .NET code. duende.link/qhr2shs

In ASP.NET Core, you may need to include extra information like user actions or custom parameters in user authentication. This post explains how to use the AuthenticationProperties class for this purpose. duende.link/i3g4trw #dotnet #security #aspnetcore

What are key moments in the OAuth and OpenID Connect timeline? In this article, we look back at the past 15 years to explore how the IETF and OpenID Foundation have set standards that shaped OAuth and OpenID Connect today. duende.link/q39aegk #dotnet #security #ietf #oidc

Visit @duendesoftware.com at @techorama.bsky.social ! Come say hi, talk about IdentityServer, BFF and OpenIdConnect, and you can win a Lego set! #techorama #techoramabe

If you’re at #NDCOslo, come and ask us your authentication and authorisation questions!

Alright folks, any tips or must-have software for a (mostly) .NET developer who just received a MacBook as a work laptop coming from Windows? I already have my JetBrains tools, oh my zsh and homebrew installed.

OAuth 2.0 is powerful, but simple when it comes to dealing with multiple clients. @vandervalk.pro talks on .NET Rocks at www.dotnetrocks.com/details/1950 about using the Backend for Frontend (BFF) Security Framework to simplify your OAuth 2.0 implementation!

Absolutely honored to have been on the Dotnet Rocks show with @richcampbell.bsky.social and @carlfranklin.bsky.social to talk about the BFF security pattern. Check it out at: www.dotnetrocks.com/details/1950

IdentityServer can use OpenTelemetry and share metrics, traces, and logs to help monitor and troubleshoot applications. In this post, we'll see how to surface this data in the .NET Aspire dashboard! 🧐 duende.link/xa5p1r3 #dotnet #aspire #identityserver #otel

<perfection.gif>

Amager doesn’t disappoint!

That feeling when your @ubiquiti.bsky.social order status says "shipped" 🚀

In recent weeks, some of our customers reported performance degradations. You won't believe what happened next 😱 Clickbait aside, #efcore, SqlClient, and transient retries don't always go well together. More on our blog! duende.link/1khti3w #dotnet #identityserver #azure