security
ASP.NET Core and .NET Security Articles, Tutorials & News
ASP.NET Core and .NET Security articles, tutorials, and news from the DotNetNews archive.
447 articles Updated
This DotNetNews topic collects ASP.NET Core security material from the daily archive. ASP.NET Core and .NET Security sits in the ASP.NET Core and broader Microsoft web stack that most C# services use. The page is for people who already ship C# and need a faster way to find relevant posts.
Expect publisher tutorials, release notes, architecture write-ups, and field notes linked from DotNetNews issues. Start here is a short editorial shortlist for ASP.NET Core and .NET Security; the archive list is chronological and larger. Nothing here claims every article was production-tested by the editors.
Recurring subtopics in recent issues include ASP.NET Core security, .NET security, secure coding C#, and ASP.NET Core hardening. Secondary angles such as ASP.NET Core security and .NET security appear when the archive actually covered them. Related hubs such as ASP.NET Core Authentication and ASP.NET Core Authorization cover adjacent problems.
Each card points at the original publisher URL and the DotNetNews issue that carried it, so you can read the article in context or jump straight to the source.
Start here
Editor picks for Security
-
Implementing Passkey Authentication in ASP.NET Core Applications
c-sharpcorner.com Issue #502
Passkeys keep moving from nice-to-have to baseline. Good starter piece for WebAuthn in ASP.NET Core.
-
OWASP Top 10 for .NET Developers - Part 8: Preventing Software and Data Integrity Failures
medium.com Issue #497
A worthwhile security reminder that clean scans and passing tests do not cover supply-chain and integrity failure risks.
-
Why and When We Need to Use [CustomAuthorize] in ASP.NET
masumkazi.medium.com Issue #497
Custom authorization is easy to overuse, so the "when" is the important part of this discussion.
-
How to Implement Passkey Authentication in ASP.NET Core Applications
c-sharpcorner.com Issue #491
Implement secure passkey authentication in ASP.NET Core apps.
-
How Hidden Security Vulnerabilities Turn Into Business-Critical Incidents in Modern Applications
medium.com Issue #490
Less framework-specific, but the business framing around hidden vulnerabilities and incident cost is still relevant for engineering leads.
-
Elsa 3.8 Preview: Secrets, State Machines, and a Security Hardening Pass
topuzas.medium.com Issue #489
Worth a skim if Elsa is on your radar and you care about security posture.
-
Building for the agentic web with .NET 11
youtube.com Issue #472
Agentic web apps on .NET 11 shift from request-response to autonomous agent patterns.
-
Stop prompt injection from hijacking your agent, new security capabilities now released within Agent Framework
devblogs.microsoft.com Issue #465
Prompt injection is still the biggest agent risk, so I'm glad to see more concrete platform defenses landing here.
Archive
Page 1 of 18
Newest first
-
Authentication in ASP.NET Core: JWT vs Cookies vs OAuth 2.0 Explained
c-sharpcorner.com Issue #514
Master ASP.NET Core authentication: JWT vs Cookies vs OAuth 2.0. Choose the right strategy for security, scalability, and user experience.
-
Building Production-Ready Rate Limiting in ASP.NET Core 10
c-sharpcorner.com Issue #513
Master ASP.NET Core 10 rate limiting for production. Learn strategies, policies, and best practices to protect your APIs from abuse and traffic spikes.
-
One rotating refresh token, and reuse detection that makes theft self-limiting
medium.com Issue #513
A stateless JWT you cannot revoke has to be short-lived, which forces a refresh token, which is a long-lived bearer credential that can be…
-
Secure File Uploads in ASP.NET Core: Validation, Storage, and Best Practices
c-sharpcorner.com Issue #513
Master secure file uploads in ASP.NET Core. Learn validation, storage, and best practices to prevent security risks and ensure robust applications.
-
Secure Secrets Management in ASP.NET Core: User Secrets, Azure Key Vault, and Production Best Practices
c-sharpcorner.com Issue #512
Secure ASP.NET Core secrets with User Secrets, Azure Key Vault, and best practices. Protect your app from development to production.
-
Device Code Flow: The Gift That Keeps on Giving — To Attackers
techcommunity.microsoft.com Issue #512
PENDING REVIEW: MICROSOFT ARTICLE UNRETRIEVABLE (HTTP 403). Tags: Microsoft Entra ID, Conditional Access, Device Code Flow, OAuth, Azure Arc, Azure Migrate, Identity Security, Zero Trust Introduction ...
-
Building Secure File Upload APIs in ASP.NET Core 10
c-sharpcorner.com Issue #512
Build secure ASP.NET Core file upload APIs. Learn validation, size limits, safe storage, and best practices to prevent vulnerabilities.
-
API Gateway Patterns in ASP.NET Core with YARP: Routing, Security, and Load Balancing
c-sharpcorner.com Issue #512
Build production-ready API Gateways in ASP.NET Core with YARP for routing, security, load balancing, and scalable microservices.
-
Prioritize exposure resolution with a new dashboard experience (public preview)
techcommunity.microsoft.com Issue #512
PENDING REVIEW: MICROSOFT ARTICLE UNRETRIEVABLE (HTTP 403). Cut Through the Noise and Focus on What Matters Most Security teams face a constant challenge: too many findings, too many dashboards, and n...
-
Debugging .NET “Broken Pipe” SSL Errors on macOS
medium.com Issue #512
One of the more frustrating .NET errors on macOS is:
-
AI Governance and Autonomous AI Agent Governance: From Controlling Models to Governing Digital Actors - Human-in-the-Loop Is Not Enough
c-sharpcorner.com Issue #512
AI governance evolves from model control to governing autonomous digital actors, emphasizing identity, authorization, and accountability for responsible operations.
-
How Nationwide stays ahead of attackers with Project Perception
techcommunity.microsoft.com Issue #512
PENDING REVIEW: MICROSOFT ARTICLE UNRETRIEVABLE (HTTP 403). Nationwide, the world’s largest building society, is among the first organizations to put Microsoft’s new...
-
Rate Limiting in ASP.NET Core: Protecting APIs from Abuse and Traffic Spikes
c-sharpcorner.com Issue #511
Protect ASP.NET Core APIs from abuse & traffic spikes with built-in rate limiting. Implement policies for robust security & performance.
-
Secure Secrets Management in ASP.NET Core: User Secrets, Azure Key Vault, and Environment Variables
c-sharpcorner.com Issue #510
Secure your ASP.NET Core apps! Learn User Secrets, Azure Key Vault, & Env Vars for robust secrets management. Avoid breaches.
-
Understanding the Fetch Metadata HTTP headers: Sec-Fetch-Site and friends
andrewlock.net Issue #510
In this post I describe the Fetch Metadata HTTP headers like Sec-Fetch-Site and Sec-Fetch-Mode which give information to a server about the context of a request
-
MCP Security Best Practices: Authentication, Authorization, and Secure Tooling
c-sharpcorner.com Issue #509
Secure your .NET MCP implementations with best practices for authentication, authorization, and tool design to protect AI integrations and enterprise data.
-
Securing ASP.NET Core APIs with Microsoft Entra ID Authentication
c-sharpcorner.com Issue #508
Secure ASP.NET Core APIs with Microsoft Entra ID. Learn authentication, configuration, and best practices for robust API security.
-
GitHub Copilot Enterprise Best Practices for .NET Teams
c-sharpcorner.com Issue #508
Unlock GitHub Copilot Enterprise for .NET teams! Master best practices for AI-assisted coding, ensuring quality, security, and maintainability.
-
Rate Limiting in ASP.NET Core APIs: Best Practices for Scalable and Secure Applications
c-sharpcorner.com Issue #507
Master ASP.NET Core rate limiting for scalable, secure APIs. Learn best practices, algorithms (fixed, sliding, token bucket), and middleware for robust traffic control.
-
Secure Secrets Management in .NET with Azure Key Vault
c-sharpcorner.com Issue #507
Secure your .NET apps with Azure Key Vault. Learn to manage secrets, keys, and certs centrally, avoiding hardcoding and enhancing security.
-
Secure AI Applications in ASP.NET Core: Preventing Prompt Injection and Data Leakage
c-sharpcorner.com Issue #506
Secure ASP.NET Core AI apps against prompt injection & data leakage. Learn best practices for LLM security, RAG, and tool access.
-
Migrate Legacy ASP.NET Apps to .NET 10
c-sharpcorner.com Issue #506
Migrate legacy ASP.NET apps to .NET 10 for improved performance, security, and modern features. Learn the process and best practices.
-
Implementing Rate Limiting in ASP.NET Core for Secure and Scalable APIs
c-sharpcorner.com Issue #506
Secure your ASP.NET Core APIs with rate limiting. Learn to implement fixed window, sliding window, and token bucket strategies for robust protection.
-
Building Secure REST APIs with ASP.NET Core and API Versioning Best Practices
c-sharpcorner.com Issue #505
Build secure, versioned REST APIs in ASP.NET Core. Learn JWT auth, HTTPS, validation, and versioning best practices for reliable apps.
-
Password hashing done right: PBKDF2-SHA512, 600k iterations, timing-safe
medium.com Issue #504
Storing a password is a solved problem, and almost every breach headline is someone who solved it the wrong way. Here are the four…