Three Predicates, One Flag
Three components decide independently whether a route needs authentication, only one of them consults auth.enabled - and the combination that turns a public route into a 403.
Archive
Every article
Newest first, grouped by year. Search or filter by topic.
- 556 articles
- 6 matching
All
.NET
AI Engineering
Architecture
Azure & DevOps
Data Warehousing
Engineering Practice
Microservices
Web APIs
authentication ×
Sign-In Is Impossible If You Capitalise
Trill's User constructor stores the name trimmed but not lower-cased, and the repository looks it up lower-cased. Any account with a capital letter in its name can never be found, which means it can never sign in - and the test fixture is all lowercase.
Revoking the Irrevocable
DShop.Common makes a stateless JWT revocable with a Redis deny-list and a per-request round-trip - plus an iat claim in milliseconds and two validators that disagree.
JWTs and the Blacklist Problem
Convey's auth packages in two acts - a JWT layer that turns one config section into token issuing and validation, and the uncomfortable question every stateless system meets on logout day.
JWTs, Refresh Tokens, and Revocation Without the Ceremony
The FastEndpoints.Security package covers the token lifecycle end to end - creation with symmetric or RSA keys, an abstract refresh-token service that is secretly an endpoint, and a revocation middleware that makes you pay the lookup tax honestly. Part 8 of FastEndpoints in Depth.
Logging In with CAS When Everyone Uses OAuth
A 2004-vintage SSO protocol wired into ASP.NET Core - ticket validation, roles derived from the database at login time, and single sign-out through a WordPress front door.