security
ASP.NET Core and .NET Security Articles, Tutorials & News
ASP.NET Core and .NET Security articles, tutorials, and news from the DotNetNews archive.
520 articles Updated
This DotNetNews topic collects ASP.NET Core security material from the daily archive. ASP.NET Core and .NET Security sits in the ASP.NET Core and broader Microsoft web stack that most C# services use. The page is for people who already ship C# and need a faster way to find relevant posts.
Expect publisher tutorials, release notes, architecture write-ups, and field notes linked from DotNetNews issues. Start here is a short editorial shortlist for ASP.NET Core and .NET Security; the archive list is chronological and larger. Nothing here claims every article was production-tested by the editors.
Recurring subtopics in recent issues include ASP.NET Core security, .NET security, secure coding C#, and ASP.NET Core hardening. Secondary angles such as ASP.NET Core security and .NET security appear when the archive actually covered them. Related hubs such as ASP.NET Core Authentication and ASP.NET Core Authorization cover adjacent problems.
Each card points at the original publisher URL and the DotNetNews issue that carried it, so you can read the article in context or jump straight to the source.
Start here
Editor picks for Security
-
Implementing Passkey Authentication in ASP.NET Core Applications
C# Corner Issue #502
Passkeys keep moving from nice-to-have to baseline. Good starter piece for WebAuthn in ASP.NET Core.
-
OWASP Top 10 for .NET Developers - Part 8: Preventing Software and Data Integrity Failures
Medium Issue #497
A worthwhile security reminder that clean scans and passing tests do not cover supply-chain and integrity failure risks.
-
Why and When We Need to Use [CustomAuthorize] in ASP.NET
Medium Issue #497
Custom authorization is easy to overuse, so the "when" is the important part of this discussion.
-
How to Implement Passkey Authentication in ASP.NET Core Applications
C# Corner Issue #491
Implement secure passkey authentication in ASP.NET Core apps.
-
How Hidden Security Vulnerabilities Turn Into Business-Critical Incidents in Modern Applications
Medium Issue #490
Less framework-specific, but the business framing around hidden vulnerabilities and incident cost is still relevant for engineering leads.
-
Elsa 3.8 Preview: Secrets, State Machines, and a Security Hardening Pass
Medium Issue #489
Worth a skim if Elsa is on your radar and you care about security posture.
-
Building for the agentic web with .NET 11
YouTube Issue #472
Agentic web apps on .NET 11 shift from request-response to autonomous agent patterns.
-
Stop prompt injection from hijacking your agent, new security capabilities now released within Agent Framework
Microsoft Dev Blogs Issue #465
Prompt injection is still the biggest agent risk, so I'm glad to see more concrete platform defenses landing here.
Archive
Page 1 of 21
Newest first
-
What’s Inside That Bearer Token? A Practical Guide to Encrypted JWTs (JWE) in .NET
Medium - Robert Dennyson Issue #559
How to recognize a JWE, inspect its header, and decrypt it safely with .NET when you own the right key.
-
Multi-tenant reporting in ASP.NET Core: row-level security your users can’t bypass
Medium - Dotnet Report Builder Issue #559
By Razi Syed. Sample code for this article: github.com/dotnetreport/dotnetreport-multitenant-rls
-
The 2 AM Bug That Taught Me How Obfuscation Actually Breaks Your Code
Medium - Skater .NET Obfuscator Issue #559
I used to think obfuscation was a “flip the switch and ship it” kind of tool. Then I spent a night debugging a TypeLoadException in a…
-
What Changes When an AI Agent Runs Without a User?
C# Corner - Aarav Patel Issue #557
-
GitHub Copilot Agent Mode: How to Control What an AI Coding Agent Can Do
C# Corner - Aarav Patel Issue #557
-
Building NotchX: A Privacy-First “Dynamic Island” for Windows
Medium - Navneetbhogal Issue #556
How I turned a Mac app I loved into a Windows tool - and why I treated a desktop utility like privileged software.
-
GitHub App Tokens Are Getting Longer: What Should Developers Check?
C# Corner - Aarav Patel Issue #555
-
Experimental support for Device Bound Session Credentials (DBSC) in ASP.NET Core: Exploring the .NET 11 preview - Part 8
Andrew Lock | .NET Escapades Issue #554
In this post I look at the new experimental support for DBSC provided by the Microsoft.AspNetCore.Authentication.DeviceBoundSessions package
-
My coding agent wrote outside the repo. Nothing stopped it.
Goat Review - Cyril Canovas Issue #553
You let a coding agent loose on a repository. It reads what it needs, then writes — a file two directories up, a ~/.config it had no business in, a /tmp script it runs next. When you look at how, the ...
-
VS Code Learn: Extending Agents
YouTube - Visual Studio Code Issue #553
Checkout key aspects of AI Agents with Tools, Tool sets, Permissions and Sandboxing. We'll also look at MCP (Model Context Protocol) and how to use it to connect your agents to external data sources. ...
-
CORS in ASP.NET Core (.NET 10) - Cross-Origin Done Right
codewithmukesh Issue #552
Configure CORS in ASP.NET Core .NET 10. Preflight, named policies, the AllowAnyOrigin + AllowCredentials trap, 7 misconfigurations, and a production checklist.
-
Foundry hosted agent isolation with Microsoft Agent Framework
Microsoft Dev Blogs - Roger Barreto Issue #550
Foundry hosted agent isolation exposes two independent controls. User isolation identifies whose data may be used. At the same time, Foundry hosted session isolation identifies where code and files co...
-
What .NET Code Protection Actually Does (And Why Decompilers Make It Necessary)
Medium Issue #549
.NET code protection exists because of a structural property of the platform: assemblies compile to CIL, an intermediate language that…
-
Protecting File Access in the wwwroot Folder in ASP.NET
Rick Strahl's Weblog Issue #547
In many of my applications I have a few files that are dynamically created as part of administrative tasks. These files tend to be cumulative and contain data that can be accessed directly from the fi...
-
SSH Is Not a Desktop
Rockford Lhotka's Blog Issue #545
I work across three physical PCs. Two of them (I’ll call them devbox1 and devbox2 ) are powerful desktop machines that sit in my office and run all the time. The third is my laptop, which goes with me...
-
PDF Security in .NET: Encryption, Redaction, and Digital Signatures
Medium Issue #545
PDF security is not limited to putting a password on a file.
-
Massive AutoMapper Vulnerability in .NET
YouTube Issue #544
Get every Dometrain 30% off with code HANDSON30: https://dometrain.com/courses/?ref=nick-chapsas&promo=youtube&coupon_code=HANDSON30 Hello, everybody. I'm Nick, and in this video, I will talk about th...
-
Can You Trust an LLM to Fix a Broken Locator?
Medium Issue #542
A measured study of multi-provider LLM consensus as a locator-healing signal — and why Automation Sandbox keeps the LLM out of the…
-
GitHub Copilot Agent Plugins: Testing Plugin Trust Across VS Code and Copilot CLI
C# Corner Issue #542
Learn how to test GitHub Copilot agent plugins across VS Code and Copilot CLI, focusing on trust, permissions, reproducibility, tool access, and security controls.
-
Let Postgres Enforce Tenant Isolation
Milan's .NET Weekly Issue #542
EF Core query filters can be bypassed. PostgreSQL row-level security enforces tenant isolation on reads and writes, if you connect with the right database role…
-
GitHub Copilot Agent Plugins: Testing Plugin Trust Across VS Code and Copilot CLI
C# Corner Issue #541
Learn how to test GitHub Copilot agent plugin trust across VS Code and Copilot CLI, including permissions, tool access, security, and reproducibility.
-
A Small HTML Attribute That Makes MFA Much Better
Medium Issue #538
Discover how one HTML attribute can make MFA faster, simpler, and more user-friendly in your .NET applications.
-
How Can Enterprises Secure ASP.NET Core APIs in Production?
Medium Issue #537
APIs have become the connective tissue of modern enterprise applications. They connect web and mobile applications, cloud services…
-
️ Global Error Handling in ASP.NET Core Done Right — IExceptionHandler
Medium Issue #537
For a long time, I handled errors the same way in almost every ASP.NET Core project.
-
How to Secure an Email Attachment Intake Service in C#
Medium Issue #536
Email attachment intake applications tend to move content quickly from inbox to storage, document processing, or other automated workflows.