security
ASP.NET Core and .NET Security Articles, Tutorials & News
ASP.NET Core and .NET Security articles, tutorials, and news from the DotNetNews archive.
495 articles Updated
This DotNetNews topic collects ASP.NET Core security material from the daily archive. ASP.NET Core and .NET Security sits in the ASP.NET Core and broader Microsoft web stack that most C# services use. The page is for people who already ship C# and need a faster way to find relevant posts.
Expect publisher tutorials, release notes, architecture write-ups, and field notes linked from DotNetNews issues. Start here is a short editorial shortlist for ASP.NET Core and .NET Security; the archive list is chronological and larger. Nothing here claims every article was production-tested by the editors.
Recurring subtopics in recent issues include ASP.NET Core security, .NET security, secure coding C#, and ASP.NET Core hardening. Secondary angles such as ASP.NET Core security and .NET security appear when the archive actually covered them. Related hubs such as ASP.NET Core Authentication and ASP.NET Core Authorization cover adjacent problems.
Each card points at the original publisher URL and the DotNetNews issue that carried it, so you can read the article in context or jump straight to the source.
Start here
Editor picks for Security
-
Implementing Passkey Authentication in ASP.NET Core Applications
c-sharpcorner.com Issue #502
Passkeys keep moving from nice-to-have to baseline. Good starter piece for WebAuthn in ASP.NET Core.
-
OWASP Top 10 for .NET Developers - Part 8: Preventing Software and Data Integrity Failures
medium.com Issue #497
A worthwhile security reminder that clean scans and passing tests do not cover supply-chain and integrity failure risks.
-
Why and When We Need to Use [CustomAuthorize] in ASP.NET
masumkazi.medium.com Issue #497
Custom authorization is easy to overuse, so the "when" is the important part of this discussion.
-
How to Implement Passkey Authentication in ASP.NET Core Applications
c-sharpcorner.com Issue #491
Implement secure passkey authentication in ASP.NET Core apps.
-
How Hidden Security Vulnerabilities Turn Into Business-Critical Incidents in Modern Applications
medium.com Issue #490
Less framework-specific, but the business framing around hidden vulnerabilities and incident cost is still relevant for engineering leads.
-
Elsa 3.8 Preview: Secrets, State Machines, and a Security Hardening Pass
topuzas.medium.com Issue #489
Worth a skim if Elsa is on your radar and you care about security posture.
-
Building for the agentic web with .NET 11
youtube.com Issue #472
Agentic web apps on .NET 11 shift from request-response to autonomous agent patterns.
-
Stop prompt injection from hijacking your agent, new security capabilities now released within Agent Framework
devblogs.microsoft.com Issue #465
Prompt injection is still the biggest agent risk, so I'm glad to see more concrete platform defenses landing here.
Archive
Page 1 of 20
Newest first
-
Bot protection that outlives your provider
davitp.medium.com Issue #535
Adding captcha to a .NET API — and what happens when one provider stops being enough.
-
AI Integration in .NET
medium.com Issue #534
How to use provider-neutral abstractions, structured outputs, tool calling, resilience, observability, evaluation, and secure application…
-
Passkeys in ASP.NET Core 10
csharpdigest.net Issue #534
how registration and sign-in actually work under the hood
-
Limit what NuGet packages can do in your project
meziantou.net Issue #534
When you add a NuGet package to a project, you often think about the runtime library only. In reality, packages can also import MSBuild props/targets and Roslyn analyzers. Those assets run during rest...
-
How to Validate Configuration in ASP.NET Core
antondevtips.com Issue #533
Bad configuration should crash your app at startup, not deep in a request. Learn how to validate configuration in ASP.NET Core with Data Annotations and FluentValidation, and fail fast with ValidateOn
-
Grand Larceny Auto: Manually Unpacking a ConfuserEx-Protected .NET/Godot CTF Challenge
medium.com Issue #533
A hands-on walkthrough of defeating rename obfuscation, control-flow flattening, caller-bound string encryption, and a logic bug in a…
-
.NET 10 RDP Honeypot: Logging Source IPs, Usernames, and Login Attempts
donmahsu.medium.com Issue #532
I wrote this article before:
-
How to Scan and Sanitize File Uploads Before Storage in ASP.NET Core
cloudmersive.medium.com Issue #532
Virus scanning a file upload can tell us whether it contains a known threat, but it doesn’t change anything about the dangerous content…
-
C# 15 Unsafe Model: Auditing Existing Native Interop Code for .NET 11
c-sharpcorner.com Issue #532
Learn how to audit existing C# native interop and unsafe code for C# 15 and .NET 11, focusing on compatibility, safety, migration risks, and best practices.
-
Stop ignoring API failures. Use Polly
roundthecode.com Issue #530
API calls fail. Learn how to add Polly to an ASP.NET Core Web API to handle retries, circuit breakers and timeouts.
-
How to implement HMAC authentication in ASP.NET Core - InfoWorld
infoworld.com Issue #530
How to implement HMAC authentication in ASP.NET Core InfoWorld
-
Fixing .NET SslException on Linux Container
blog.dotnetframework.org Issue #529
.NET 8 / C# LINUX / OPENSSL GOOGLE CLOUD RUNFixing .NET SslException on Linux ContainerDeployments: The ‘RequireEncryption’ Policy PitfallAuthor: DevOps & Software Architecture Engineering Category: T...
-
NuGet Package Source Mapping: Preventing Dependency Confusion in .NET
c-sharpcorner.com Issue #529
Learn how NuGet Package Source Mapping prevents dependency confusion attacks in .NET applications by controlling package sources and securing software supply chains.
-
Use Aspire to implement and deploy the BFF security architecture
damienbod.com Issue #527
This blog demonstrates how to use Aspire to set up a solution for developing and deploying an ASP.NET Core web application with Auth0 as the identity provider and a downstream API. The application use...
-
The Lazy Engineer’s Blueprint, Part 7: Security
medium.com Issue #526
Part 7: authenticate a person or a machine, project the caller into a module without the host, and authorize with policies off the handler.
-
Security Headers and CSP for Blazor: One Middleware, Every Host
medium.com Issue #526
Every client-facing host must stamp the same hardened response headers, but a Blazor host needs a Content-Security-Policy no static string…
-
Building a Reliable and Scalable AI-Powered ATS with .NET and Angular
c-sharpcorner.com Issue #525
Explore how to build a reliable and scalable AI-powered ATS with .NET and Angular, covering AI integration, security, observability, asynchronous processing, and human oversight.
-
Stopping copy-paste of Frontegg auth across 15 .NET services
medium.com Issue #525
We had a simple goal: around a dozen .NET applications on our platform needed to integrate with Frontegg, and nobody wanted to implement…
-
Building Reproducible .NET Builds with Locked Dependency Graphs
c-sharpcorner.com Issue #525
Build reproducible .NET applications with locked dependency graphs to control transitive packages, prevent unexpected dependency changes, and improve build integrity across environments.
-
CodeAct + Hyperlight: Sandboxed Code Execution in the Microsoft Agent Framework
medium.com Issue #525
What happens when you stop handing your agent ten tools and start letting it write the code itself — and where that code actually runs.
-
Field-Level Encryption in EF Core: AES-GCM for PII Columns
medium.com Issue #524
Transparent database encryption protects the file, then decrypts for anyone who can query it. When a column holds data sensitive enough…
-
Managing Secrets in Microsoft Agent Framework
jesseliberty.com Issue #524
In the realm of software development, managing configuration values and sensitive information is a critical aspect that can significantly impact the security and functionality of applications. Develop...
-
Building Scalable Enterprise Architectures with the Backend for Frontend (BFF) Pattern in C#
c-sharpcorner.com Issue #524
Unlock scalable enterprise architectures with the Backend for Frontend (BFF) pattern in C#. Optimize performance, security, and client experience.
-
CSP Nonces vs Hashes: Lessons I Learned Securing an ASP.NET Core Application
c-sharpcorner.com Issue #524
Master CSP nonces vs hashes for ASP.NET Core security. Learn when to use each to prevent XSS and secure your application effectively.
-
C# 15 Memory Safety: Auditing Unsafe Code Contracts
c-sharpcorner.com Issue #523
C# 15 enhances memory safety by making unsafe code boundaries explicit, shifting focus from pointer syntax to actual memory access for better auditing.