security
ASP.NET Core and .NET Security Articles, Tutorials & News
ASP.NET Core and .NET Security articles, tutorials, and news from the DotNetNews archive.
504 articles Updated
This DotNetNews topic collects ASP.NET Core security material from the daily archive. ASP.NET Core and .NET Security sits in the ASP.NET Core and broader Microsoft web stack that most C# services use. The page is for people who already ship C# and need a faster way to find relevant posts.
Expect publisher tutorials, release notes, architecture write-ups, and field notes linked from DotNetNews issues. Start here is a short editorial shortlist for ASP.NET Core and .NET Security; the archive list is chronological and larger. Nothing here claims every article was production-tested by the editors.
Recurring subtopics in recent issues include ASP.NET Core security, .NET security, secure coding C#, and ASP.NET Core hardening. Secondary angles such as ASP.NET Core security and .NET security appear when the archive actually covered them. Related hubs such as ASP.NET Core Authentication and ASP.NET Core Authorization cover adjacent problems.
Each card points at the original publisher URL and the DotNetNews issue that carried it, so you can read the article in context or jump straight to the source.
Start here
Editor picks for Security
-
Implementing Passkey Authentication in ASP.NET Core Applications
c-sharpcorner.com Issue #502
Passkeys keep moving from nice-to-have to baseline. Good starter piece for WebAuthn in ASP.NET Core.
-
OWASP Top 10 for .NET Developers - Part 8: Preventing Software and Data Integrity Failures
medium.com Issue #497
A worthwhile security reminder that clean scans and passing tests do not cover supply-chain and integrity failure risks.
-
Why and When We Need to Use [CustomAuthorize] in ASP.NET
masumkazi.medium.com Issue #497
Custom authorization is easy to overuse, so the "when" is the important part of this discussion.
-
How to Implement Passkey Authentication in ASP.NET Core Applications
c-sharpcorner.com Issue #491
Implement secure passkey authentication in ASP.NET Core apps.
-
How Hidden Security Vulnerabilities Turn Into Business-Critical Incidents in Modern Applications
medium.com Issue #490
Less framework-specific, but the business framing around hidden vulnerabilities and incident cost is still relevant for engineering leads.
-
Elsa 3.8 Preview: Secrets, State Machines, and a Security Hardening Pass
topuzas.medium.com Issue #489
Worth a skim if Elsa is on your radar and you care about security posture.
-
Building for the agentic web with .NET 11
youtube.com Issue #472
Agentic web apps on .NET 11 shift from request-response to autonomous agent patterns.
-
Stop prompt injection from hijacking your agent, new security capabilities now released within Agent Framework
devblogs.microsoft.com Issue #465
Prompt injection is still the biggest agent risk, so I'm glad to see more concrete platform defenses landing here.
Archive
Page 1 of 21
Newest first
-
Massive AutoMapper Vulnerability in .NET
youtube.com Issue #544
Get every Dometrain 30% off with code HANDSON30: https://dometrain.com/courses/?ref=nick-chapsas&promo=youtube&coupon_code=HANDSON30 Hello, everybody. I'm Nick, and in this video, I will talk about th...
-
Can You Trust an LLM to Fix a Broken Locator?
medium.com Issue #542
A measured study of multi-provider LLM consensus as a locator-healing signal — and why Automation Sandbox keeps the LLM out of the…
-
GitHub Copilot Agent Plugins: Testing Plugin Trust Across VS Code and Copilot CLI
c-sharpcorner.com Issue #542
Learn how to test GitHub Copilot agent plugins across VS Code and Copilot CLI, focusing on trust, permissions, reproducibility, tool access, and security controls.
-
Let Postgres Enforce Tenant Isolation
milanjovanovic.tech Issue #542
EF Core query filters can be bypassed. PostgreSQL row-level security enforces tenant isolation on reads and writes, if you connect with the right database role…
-
GitHub Copilot Agent Plugins: Testing Plugin Trust Across VS Code and Copilot CLI
c-sharpcorner.com Issue #541
Learn how to test GitHub Copilot agent plugin trust across VS Code and Copilot CLI, including permissions, tool access, security, and reproducibility.
-
A Small HTML Attribute That Makes MFA Much Better
medium.com Issue #538
Discover how one HTML attribute can make MFA faster, simpler, and more user-friendly in your .NET applications.
-
How Can Enterprises Secure ASP.NET Core APIs in Production?
medium.com Issue #537
APIs have become the connective tissue of modern enterprise applications. They connect web and mobile applications, cloud services…
-
️ Global Error Handling in ASP.NET Core Done Right — IExceptionHandler
medium.com Issue #537
For a long time, I handled errors the same way in almost every ASP.NET Core project.
-
How to Secure an Email Attachment Intake Service in C#
cloudmersive.medium.com Issue #536
Email attachment intake applications tend to move content quickly from inbox to storage, document processing, or other automated workflows.
-
Bot protection that outlives your provider
davitp.medium.com Issue #535
Adding captcha to a .NET API — and what happens when one provider stops being enough.
-
AI Integration in .NET
medium.com Issue #534
How to use provider-neutral abstractions, structured outputs, tool calling, resilience, observability, evaluation, and secure application…
-
Passkeys in ASP.NET Core 10
csharpdigest.net Issue #534
how registration and sign-in actually work under the hood
-
Limit what NuGet packages can do in your project
meziantou.net Issue #534
When you add a NuGet package to a project, you often think about the runtime library only. In reality, packages can also import MSBuild props/targets and Roslyn analyzers. Those assets run during rest...
-
How to Validate Configuration in ASP.NET Core
antondevtips.com Issue #533
Bad configuration should crash your app at startup, not deep in a request. Learn how to validate configuration in ASP.NET Core with Data Annotations and FluentValidation, and fail fast with ValidateOn
-
Grand Larceny Auto: Manually Unpacking a ConfuserEx-Protected .NET/Godot CTF Challenge
medium.com Issue #533
A hands-on walkthrough of defeating rename obfuscation, control-flow flattening, caller-bound string encryption, and a logic bug in a…
-
.NET 10 RDP Honeypot: Logging Source IPs, Usernames, and Login Attempts
donmahsu.medium.com Issue #532
I wrote this article before:
-
How to Scan and Sanitize File Uploads Before Storage in ASP.NET Core
cloudmersive.medium.com Issue #532
Virus scanning a file upload can tell us whether it contains a known threat, but it doesn’t change anything about the dangerous content…
-
C# 15 Unsafe Model: Auditing Existing Native Interop Code for .NET 11
c-sharpcorner.com Issue #532
Learn how to audit existing C# native interop and unsafe code for C# 15 and .NET 11, focusing on compatibility, safety, migration risks, and best practices.
-
Stop ignoring API failures. Use Polly
roundthecode.com Issue #530
API calls fail. Learn how to add Polly to an ASP.NET Core Web API to handle retries, circuit breakers and timeouts.
-
How to implement HMAC authentication in ASP.NET Core - InfoWorld
infoworld.com Issue #530
How to implement HMAC authentication in ASP.NET Core InfoWorld
-
Fixing .NET SslException on Linux Container
blog.dotnetframework.org Issue #529
.NET 8 / C# LINUX / OPENSSL GOOGLE CLOUD RUNFixing .NET SslException on Linux ContainerDeployments: The ‘RequireEncryption’ Policy PitfallAuthor: DevOps & Software Architecture Engineering Category: T...
-
NuGet Package Source Mapping: Preventing Dependency Confusion in .NET
c-sharpcorner.com Issue #529
Learn how NuGet Package Source Mapping prevents dependency confusion attacks in .NET applications by controlling package sources and securing software supply chains.
-
Use Aspire to implement and deploy the BFF security architecture
damienbod.com Issue #527
This blog demonstrates how to use Aspire to set up a solution for developing and deploying an ASP.NET Core web application with Auth0 as the identity provider and a downstream API. The application use...
-
The Lazy Engineer’s Blueprint, Part 7: Security
medium.com Issue #526
Part 7: authenticate a person or a machine, project the caller into a module without the host, and authorize with policies off the handler.
-
Security Headers and CSP for Blazor: One Middleware, Every Host
medium.com Issue #526
Every client-facing host must stamp the same hardened response headers, but a Blazor host needs a Content-Security-Policy no static string…