Newest first, grouped by year. Search or filter by topic.
FastEndpoints ships a CSRF middleware that is opt-in per endpoint, only inspects form posts, and refuses to start your app if you wired it up wrong. It earned a single clause in seventeen parts - here is the whole story. Part 3 of FastEndpoints — The Missing Chapters.
The rewrite multiplied the JWT lifetime by ten and deleted the only way to revoke a token early - one change in a JSON file, the other an absent folder, and neither visible in any diff of the domain.
DShop puts all its authorization at the gateway and none in the services behind it - then publishes every service port to the host. The compose file quietly defeats the entire security model.
The Identity service gets the hard parts of auth genuinely right - issue, refresh, revoke - and then commits its signing key to source control and ships a CORS policy the spec forbids. Part 13 of Nine Services and a Message Bus.
DShop.Common's error middleware maps every exception to HTTP 400, computes a safe message, then throws it away and serialises the raw exception text to the caller.
DShop.Common makes a stateless JWT revocable with a Redis deny-list and a per-request round-trip - plus an iat claim in milliseconds and two validators that disagree.
Convey's certificate middleware authenticates machines instead of users - a forwarded-cert header, a subject ACL, and two defaults that look like security and aren't.
Permissions(), Claims() and Scopes() in Configure() feel like magic until you read the mapping code - every endpoint gets its own named authorization policy built from closures at startup, and roles ride a plain AuthorizeAttribute. Part 7 of FastEndpoints in Depth.
The complete honest ledger for a Key Vault-backed service discovery layer after years in production - the debts I would pay tomorrow, the trade-offs I would sign again, and the concrete signals that it is time to graduate to App Configuration, APIM, Dapr or a mesh. Part 8, the finale of Service Discovery Without a Service Mesh.
The same database solves the same sortable-paging problem twice - once by concatenating user input straight into EXEC, once with a CASE whitelist, QUOTENAME and sp_executesql. A side-by-side of the wrong and right answer.
One class bridging the legacy ADAL KeyVaultClient and the modern SecretClient, three coexisting secret postures - managed identity, a service-principal password in config, a committed key file - and a migration frozen mid-flight.
A work-from-home swipe modelled as a state machine, a stop-from-email deep link, the estate's one deliberate IDOR guard that compares instead of overwrites, and a DbContext constructed by hand inside the action.
Every controller wrapped its Authorize attribute in
