security
ASP.NET Core and .NET Security Articles, Tutorials & News
ASP.NET Core and .NET Security articles, tutorials, and news from the DotNetNews archive.
483 articles Updated
This DotNetNews topic collects ASP.NET Core security material from the daily archive. ASP.NET Core and .NET Security sits in the ASP.NET Core and broader Microsoft web stack that most C# services use. The page is for people who already ship C# and need a faster way to find relevant posts.
Expect publisher tutorials, release notes, architecture write-ups, and field notes linked from DotNetNews issues. Start here is a short editorial shortlist for ASP.NET Core and .NET Security; the archive list is chronological and larger. Nothing here claims every article was production-tested by the editors.
Recurring subtopics in recent issues include ASP.NET Core security, .NET security, secure coding C#, and ASP.NET Core hardening. Secondary angles such as ASP.NET Core security and .NET security appear when the archive actually covered them. Related hubs such as ASP.NET Core Authentication and ASP.NET Core Authorization cover adjacent problems.
Each card points at the original publisher URL and the DotNetNews issue that carried it, so you can read the article in context or jump straight to the source.
Start here
Editor picks for Security
-
Implementing Passkey Authentication in ASP.NET Core Applications
c-sharpcorner.com Issue #502
Passkeys keep moving from nice-to-have to baseline. Good starter piece for WebAuthn in ASP.NET Core.
-
OWASP Top 10 for .NET Developers - Part 8: Preventing Software and Data Integrity Failures
medium.com Issue #497
A worthwhile security reminder that clean scans and passing tests do not cover supply-chain and integrity failure risks.
-
Why and When We Need to Use [CustomAuthorize] in ASP.NET
masumkazi.medium.com Issue #497
Custom authorization is easy to overuse, so the "when" is the important part of this discussion.
-
How to Implement Passkey Authentication in ASP.NET Core Applications
c-sharpcorner.com Issue #491
Implement secure passkey authentication in ASP.NET Core apps.
-
How Hidden Security Vulnerabilities Turn Into Business-Critical Incidents in Modern Applications
medium.com Issue #490
Less framework-specific, but the business framing around hidden vulnerabilities and incident cost is still relevant for engineering leads.
-
Elsa 3.8 Preview: Secrets, State Machines, and a Security Hardening Pass
topuzas.medium.com Issue #489
Worth a skim if Elsa is on your radar and you care about security posture.
-
Building for the agentic web with .NET 11
youtube.com Issue #472
Agentic web apps on .NET 11 shift from request-response to autonomous agent patterns.
-
Stop prompt injection from hijacking your agent, new security capabilities now released within Agent Framework
devblogs.microsoft.com Issue #465
Prompt injection is still the biggest agent risk, so I'm glad to see more concrete platform defenses landing here.
Archive
Page 1 of 20
Newest first
-
Fixing .NET SslException on Linux Container
blog.dotnetframework.org Issue #529
.NET 8 / C# LINUX / OPENSSL GOOGLE CLOUD RUNFixing .NET SslException on Linux ContainerDeployments: The ‘RequireEncryption’ Policy PitfallAuthor: DevOps & Software Architecture Engineering Category: T...
-
NuGet Package Source Mapping: Preventing Dependency Confusion in .NET
c-sharpcorner.com Issue #529
Learn how NuGet Package Source Mapping prevents dependency confusion attacks in .NET applications by controlling package sources and securing software supply chains.
-
Use Aspire to implement and deploy the BFF security architecture
damienbod.com Issue #527
This blog demonstrates how to use Aspire to set up a solution for developing and deploying an ASP.NET Core web application with Auth0 as the identity provider and a downstream API. The application use...
-
The Lazy Engineer’s Blueprint, Part 7: Security
medium.com Issue #526
Part 7: authenticate a person or a machine, project the caller into a module without the host, and authorize with policies off the handler.
-
Security Headers and CSP for Blazor: One Middleware, Every Host
medium.com Issue #526
Every client-facing host must stamp the same hardened response headers, but a Blazor host needs a Content-Security-Policy no static string…
-
Building a Reliable and Scalable AI-Powered ATS with .NET and Angular
c-sharpcorner.com Issue #525
Explore how to build a reliable and scalable AI-powered ATS with .NET and Angular, covering AI integration, security, observability, asynchronous processing, and human oversight.
-
Stopping copy-paste of Frontegg auth across 15 .NET services
medium.com Issue #525
We had a simple goal: around a dozen .NET applications on our platform needed to integrate with Frontegg, and nobody wanted to implement…
-
Building Reproducible .NET Builds with Locked Dependency Graphs
c-sharpcorner.com Issue #525
Build reproducible .NET applications with locked dependency graphs to control transitive packages, prevent unexpected dependency changes, and improve build integrity across environments.
-
CodeAct + Hyperlight: Sandboxed Code Execution in the Microsoft Agent Framework
medium.com Issue #525
What happens when you stop handing your agent ten tools and start letting it write the code itself — and where that code actually runs.
-
Field-Level Encryption in EF Core: AES-GCM for PII Columns
medium.com Issue #524
Transparent database encryption protects the file, then decrypts for anyone who can query it. When a column holds data sensitive enough…
-
Managing Secrets in Microsoft Agent Framework
jesseliberty.com Issue #524
In the realm of software development, managing configuration values and sensitive information is a critical aspect that can significantly impact the security and functionality of applications. Develop...
-
Building Scalable Enterprise Architectures with the Backend for Frontend (BFF) Pattern in C#
c-sharpcorner.com Issue #524
Unlock scalable enterprise architectures with the Backend for Frontend (BFF) pattern in C#. Optimize performance, security, and client experience.
-
CSP Nonces vs Hashes: Lessons I Learned Securing an ASP.NET Core Application
c-sharpcorner.com Issue #524
Master CSP nonces vs hashes for ASP.NET Core security. Learn when to use each to prevent XSS and secure your application effectively.
-
C# 15 Memory Safety: Auditing Unsafe Code Contracts
c-sharpcorner.com Issue #523
C# 15 enhances memory safety by making unsafe code boundaries explicit, shifting focus from pointer syntax to actual memory access for better auditing.
-
Detecting .NET Security Regressions Before Production Deployment
c-sharpcorner.com Issue #522
Create a CI/CD security regression gate for .NET applications that validates runtime and framework updates before deployment and detects security issues early.
-
Auditing AI-Generated C# for Unsafe Code Contracts
c-sharpcorner.com Issue #522
Audit AI-generated C# unsafe code. C# 15's new model clarifies safety contracts, making review critical for pointer, stackalloc, and interop code.
-
REST API Security Best Practices in ASP.NET Core
medium.com Issue #521
It does not matter how clean your architecture is or how fast your queries run — if an attacker can read another user’s orders or forge a… Continue reading on CodeX »
-
Securing ZIP-Based .NET Applications with Password-Protected Archives
c-sharpcorner.com Issue #521
Explore password-protected ZIP archives in .NET and learn how to securely package, transfer, and protect application data using the latest ZIP security capabilities.
-
Your .NET API Works. But Is It Actually Production-Ready?
medium.com Issue #521
A practical guide to taking an ASP.NET Core API from “it works on my machine” to something you can confidently deploy.
-
Building Secure and Scalable Multi-Tenant SaaS Applications with .NET and Angular
c-sharpcorner.com Issue #520
Learn how to build secure and scalable multi-tenant SaaS applications with .NET and Angular, covering tenant isolation, database architecture, authentication, scalability, monitoring, and DevOps.
-
Modern authentication in ASP.NET Core with 2FA and passkey
blog.elmah.io Issue #519
This walkthrough builds a .NET 10 ASP.NET Core Web API (TwoFaNET10) implementing two-factor authentication and WebAuthn/FIDO2 passkey login, using Microsoft.AspNetCore.Identity.EntityFrameworkCore wit...
-
Implementing JWT Authentication with Secure Refresh Tokens in .NET Core
c-sharpcorner.com Issue #519
Implement secure JWT authentication with refresh tokens in .NET Core. Learn to generate, validate, and refresh tokens for stateless API security.
-
Automated Governance and Dynamic Routing in Enterprise LangGraph RAG
c-sharpcorner.com Issue #519
Automate RAG tool registration and enforce Pydantic schemas in enterprise LangGraph with Python metaclasses for scalable, secure multi-agent AI.
-
Building Distributed Rate Limiting with Redis and YARP Reverse Proxy
c-sharpcorner.com Issue #518
Learn to build robust distributed rate limiting for ASP.NET Core apps using Redis and YARP. Protect APIs from traffic spikes and abuse.
-
JWT Session 15: Implement Logout and Refresh Token Revocation in ASP.NET Core Web API
c-sharpcorner.com Issue #518
Secure your JWT-based ASP.NET Core API by implementing robust logout and refresh token revocation to prevent session hijacking and unauthorized access.