Security
11 articles tagged with Security.
Cookie consent on a static blog
Measure the cookies a static site really sets, see what the rules ask of a blog, and load Google Analytics only after consent, with a small store, a fair banner and tests that check it.
7 min read
A Content Security Policy for an Astro site
Add a Content Security Policy to a static Astro site with security.csp: hashed inline scripts, third parties, why strict-dynamic broke the islands, and tests that fail on any violation.
5 min read
Expose your ASP.NET Core API as an MCP server
Learn how to let agents read and change what their user can through an MCP server in ASP.NET Core, with OAuth, scopes, a per-organization switch and rate limits.
8 min read
SSO and SCIM 2.0 for a B2B SaaS in ASP.NET Core
Learn how to let each customer sign in through its own identity provider and provision its people with SCIM 2.0, in ASP.NET Core, with no third-party service.
8 min read
Signed outgoing webhooks in ASP.NET Core
Learn how to send signed outgoing webhooks from ASP.NET Core: a stable envelope, an HMAC signature a subscriber can verify, durable retries, delivery history and redelivery.
7 min read
A strict Content Security Policy for an Angular SPA served by ASP.NET Core
Learn how to send a real Content Security Policy from ASP.NET Core in front of an Angular application, and which concessions you cannot avoid.
7 min read
Personal access tokens in ASP.NET Core: reference tokens, not hashes
Learn how to give users personal access tokens for their scripts and agents, minted by OpenIddict as reference tokens and introspected by an ASP.NET Core API.
7 min read
Caching authenticated API responses in ASP.NET Core without leaking data
Learn how to cache authenticated responses in an ASP.NET Core API without serving one user's data to another, or to a user whose access was revoked.
7 min read
SSRF-proof outgoing HTTP calls in .NET: resolve, check, then connect
Learn how to call URLs your users type (webhooks, imports, metadata documents) without letting them reach your own network, with a SocketsHttpHandler that checks the address it actually connects to.
8 min read
Moving from Duende IdentityServer to OpenIddict in ASP.NET Core
Learn how to replace Duende IdentityServer with OpenIddict while keeping the same OpenID Connect shape for your gateway, your API and your other clients.
8 min read
Keep the access token out of the browser: a BFF for Angular with ASP.NET Core and YARP
Learn how to build a Backend-for-Frontend with ASP.NET Core and YARP so that your Angular application never holds an access token.
8 min read