JWTs and the Blacklist Problem
Convey's auth packages in two acts - a JWT layer that turns one config section into token issuing and validation, and the uncomfortable question every stateless system meets on logout day.
Archive
Every article
Newest first, grouped by year. Search or filter by topic.
- 388 articles
- 4 matching
All
.NET
AI Engineering
Architecture
Azure & DevOps
Data Warehousing
Engineering Practice
Microservices
Web APIs
authentication ×
Cards
List
JWTs, Refresh Tokens, and Revocation Without the Ceremony
The FastEndpoints.Security package covers the token lifecycle end to end - creation with symmetric or RSA keys, an abstract refresh-token service that is secretly an endpoint, and a revocation middleware that makes you pay the lookup tax honestly. Part 8 of FastEndpoints in Depth.
Revoking the Irrevocable
DShop.Common makes a stateless JWT revocable with a Redis deny-list and a per-request round-trip - plus an iat claim in milliseconds and two validators that disagree.
Logging In with CAS When Everyone Uses OAuth
A 2004-vintage SSO protocol wired into ASP.NET Core - ticket validation, roles derived from the database at login time, and single sign-out through a WordPress front door.