SignalR Authentication Refresh in .NET 11: No More Forced Reconnects on Token Expiry
.NET 11 lets SignalR clients swap in a fresh access token on a live connection instead of forcing a reconnect when the old one expires. Here's how to configure it on the server and client, and where the guardrails are.
ASP.NET Core Ditches CSRF Tokens for Fetch Metadata in .NET 11
.NET 11 introduces an automatic CSRF protection middleware that uses browser Fetch Metadata headers instead of tokens. It's on by default, requires no code changes, and fundamentally changes how cross-site request forgery is handled in ASP.NET Core.
Blazor SSR Finally Gets Client-Side Validation in .NET 11
With .NET 11 Preview 5, Blazor SSR forms gain automatic client-side validation and a new async validation pipeline, closing the biggest gap between static rendering and interactive modes.
HTTP QUERY: The New Method That Fixes What GET and POST Got Wrong
.NET 11 Preview 4 adds first-class support for the HTTP QUERY method -- a safe, idempotent verb that accepts request bodies. Here is how it works in ASP.NET Core, why it matters for API design, and where the ecosystem stands today.
[PersistentState] in .NET 10: Blazor Finally Solves the Prerendering State Problem
.NET 10 introduces the [PersistentState] attribute, replacing dozens of lines of manual serialisation boilerplate with a single attribute. It also extends state persistence to services, enhanced navigation, and circuit reconnection.
WebSocketStream in .NET 10: Treating WebSockets Like Any Other Stream
The new WebSocketStream class in .NET 10 wraps a WebSocket in a standard System.IO.Stream, eliminating the frame-management boilerplate that has plagued WebSocket code for years and unlocking the entire stream ecosystem for WebSocket transports.
Global Exception Handling in ASP.NET Core with IExceptionHandler
IExceptionHandler gives ASP.NET Core apps a structured, testable, and chainable way to handle exceptions globally — replacing hand-rolled middleware and scattered try-catch blocks with a first-class framework feature.
A2A v1 in .NET: Cross-Platform Agent Communication Without the Glue Code
The A2A protocol gives AI agents a standard way to discover and talk to each other across frameworks, languages, and vendors. With v1 shipping in the Microsoft Agent Framework for .NET, here is how to expose and consume agents over A2A using familiar ASP.NET Core patterns.
PostgreSQL as a Distributed Cache in .NET: One Database, Two Jobs
Microsoft's new Caching.Postgres package turns your existing PostgreSQL instance into a distributed cache. Combined with HybridCache, it delivers a tiered caching architecture without adding Redis to your infrastructure.
CVE-2026-40372: The ASP.NET Core Data Protection Flaw That Demands More Than a Patch
A critical HMAC validation bug in Microsoft.AspNetCore.DataProtection lets attackers forge authentication cookies and decrypt protected payloads. Upgrading to 10.0.7 fixes the code, but key rotation and artifact auditing are essential to close the window fully.
Asp.Versioning Meets Built-In OpenAPI: Versioned API Documentation in .NET 10
Asp.Versioning v10.0.0 brings first-class integration with .NET 10's built-in OpenAPI library, replacing the Swashbuckle-era workarounds with a single AddOpenApi call, automatic per-version documents, and RFC 9745 deprecation headers.
CVE-2026-40372: The Data Protection HMAC Bug That Made Cookie Forgery Trivial on Linux
Microsoft's emergency .NET 10.0.7 out-of-band update patches a CVSS 9.1 flaw in the Data Protection managed encryptor. If you run ASP.NET Core on Linux, your HMAC validation was effectively broken since .NET 10 shipped.
Blazor's Virtualize Component Finally Handles Variable-Height Items in .NET 11
.NET 11 Preview 3 reworks the Virtualize component to measure actual item heights at runtime using a running average, eliminating the broken spacing and scroll jumps that plagued lists with variable-height content since the component shipped in .NET 5.
Full-Text Search in EF Core 11: Ranked Results Without Leaving LINQ
EF Core 11 finally brings first-class full-text search support for SQL Server, including migration-managed catalogs and indexes, and FREETEXTTABLE/CONTAINSTABLE translation with ranking scores baked into your LINQ queries.
Orleans: The Virtual Actor Framework That Makes Distributed .NET Feel Like Local Code
Orleans turns distributed systems into a problem you already know how to solve. Its virtual actor model lets you write single-server C# that the runtime scales across a cluster, handling activation, placement, and fault recovery behind the scenes.
TypedResults: The Minimal API Return Type That Writes Your OpenAPI Spec for You
TypedResults and the Results<T1, T2> union pattern give Minimal API endpoints compile-time safety, automatic OpenAPI metadata, and cleaner unit tests. Here is how to use them properly and why they should be your default.
Keyed Services in .NET: The Built-In DI Feature You're Probably Not Using Yet
Keyed services bring named registrations to .NET's built-in dependency injection container, replacing custom factories and IEnumerable filtering with a clean, attribute-driven approach that works across the entire ASP.NET Core stack.
Passkeys in ASP.NET Core 10: Phishing-Resistant Auth Without the Third-Party Dependency
ASP.NET Core 10 ships with built-in passkey support in Identity, bringing WebAuthn registration and authentication into the framework. Here's how it works, what the API surface looks like, and where you'll still need a third-party library.
Kiota: Microsoft's OpenAPI Client Generator That Understands Your API's Shape
Kiota generates strongly typed API clients from OpenAPI specs using a hierarchical request builder pattern. Here's how to use it, wire it into DI, and avoid the pitfalls that trip up most teams.
ASP.NET Core 2.3 End of Support: The Clock Is Ticking on .NET Framework's Last Bridge
Microsoft has announced that ASP.NET Core 2.3 on .NET Framework reaches end of support on April 7, 2027. Here is what that means, why the version number is stranger than it looks, and how to plan your migration.
Microsoft Agent Framework 1.0: Building AI Agents in .NET Without the Guesswork
Microsoft Agent Framework 1.0 merges Semantic Kernel and AutoGen into a single, production-ready SDK for building AI agents in .NET. Here is what the unified model looks like, how tools and middleware work, and where workflows fit in.
HybridCache: The .NET Caching API That Should Have Existed Years Ago
HybridCache combines in-process and distributed caching behind a single API, with built-in stampede protection, tag-based invalidation, and zero-allocation reads for immutable types. Here is how to use it and why it replaces most hand-rolled IDistributedCache code.
Blazor Finally Gets TempData: Flash Messages and PRG Without the Workarounds
.NET 11 Preview 2 brings TempData to Blazor static SSR as a cascading parameter, enabling flash messages, one-time notifications, and the POST-Redirect-GET pattern without custom state hacks.
Server-Sent Events in ASP.NET Core: Native Streaming Arrives in .NET 10
.NET 10 adds first-class Server-Sent Events support with TypedResults.ServerSentEvents, SseItem<T>, and a client-side SseParser. No more hand-rolled text/event-stream responses -- here is how the new API works from endpoint to EventSource.
Native OpenTelemetry Tracing in ASP.NET Core: .NET 11 Drops the External Dependency
ASP.NET Core in .NET 11 Preview 2 natively populates OpenTelemetry semantic convention attributes on HTTP server activities, eliminating the need for the OpenTelemetry.Instrumentation.AspNetCore package. Here is what changed, how to migrate, and what to watch out for.