SignalR Authentication Refresh in .NET 11: No More Forced Reconnects on Token Expiry
.NET 11 lets SignalR clients swap in a fresh access token on a live connection instead of forcing a reconnect when the old one expires. Here's how to configure it on the server and client, and where the guardrails are.
ASP.NET Core Ditches CSRF Tokens for Fetch Metadata in .NET 11
.NET 11 introduces an automatic CSRF protection middleware that uses browser Fetch Metadata headers instead of tokens. It's on by default, requires no code changes, and fundamentally changes how cross-site request forgery is handled in ASP.NET Core.
Governing MCP Tool Calls in .NET with the Agent Governance Toolkit
The Agent Governance Toolkit gives .NET developers policy-based control over MCP tool execution, from prompt injection detection to privilege rings. Here is how to lock down your AI agents before they reach production.
CVE-2026-40372: The ASP.NET Core Data Protection Flaw That Demands More Than a Patch
A critical HMAC validation bug in Microsoft.AspNetCore.DataProtection lets attackers forge authentication cookies and decrypt protected payloads. Upgrading to 10.0.7 fixes the code, but key rotation and artifact auditing are essential to close the window fully.
CVE-2026-40372: The Data Protection HMAC Bug That Made Cookie Forgery Trivial on Linux
Microsoft's emergency .NET 10.0.7 out-of-band update patches a CVSS 9.1 flaw in the Data Protection managed encryptor. If you run ASP.NET Core on Linux, your HMAC validation was effectively broken since .NET 10 shipped.
.NET April 2026 Security Patches: SMTP Header Injection and XML Recursion Bombs Explained
Microsoft's April 2026 servicing update patches two high-severity vulnerabilities in System.Net.Mail and System.Security.Cryptography.Xml. Here is how they work, why they matter, and what you need to do.
SQL MCP Server: Microsoft's Answer to the NL2SQL Problem
Microsoft's SQL MCP Server gives AI agents deterministic, RBAC-secured access to SQL Server, PostgreSQL, Cosmos DB, and MySQL without generating a single line of raw SQL. Here is how it works and why it deliberately avoids NL2SQL.
Passkeys in ASP.NET Core 10: Phishing-Resistant Auth Without the Third-Party Dependency
ASP.NET Core 10 ships with built-in passkey support in Identity, bringing WebAuthn registration and authentication into the framework. Here's how it works, what the API surface looks like, and where you'll still need a third-party library.
Post-Quantum Cryptography in .NET 10: ML-KEM, ML-DSA, and SLH-DSA from System.Security.Cryptography
With .NET 10 shipping built-in support for three NIST-standardised post-quantum algorithms, here is how ML-KEM, ML-DSA, and SLH-DSA work in practice, what the APIs look like, and what you need to watch out for on different platforms.
API Rate Limiting in ASP.NET Core
How to implement rate limiting in ASP.NET Core using the built-in rate limiting middleware with fixed window, sliding window, and token bucket algorithms.
Authentication and Authorisation in SignalR
Learn how to secure SignalR hubs with JWT bearer tokens, cookie authentication, and granular authorisation policies.
.NET Container Images Explained: Chiselled, Alpine, and More
Understand the differences between .NET's container image variants — standard, Alpine, chiselled, and AOT — and when to use each.
Security Headers Middleware for ASP.NET Core
Building a comprehensive security headers middleware for ASP.NET Core that covers X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and more.
Cryptography in .NET: Hashing, Encryption, and Getting It Right
A practical guide to hashing passwords, encrypting data, and using .NET's cryptography APIs without the common pitfalls.
Input Validation and Sanitisation in .NET
Practical approaches to validating and sanitising user input in .NET applications to prevent injection attacks and data corruption.
API Key Authentication Patterns in ASP.NET Core
Implementing API key authentication in ASP.NET Core using middleware, authentication handlers, and endpoint filters.
Role-Based vs Policy-Based Authorisation in ASP.NET Core
Comparing role-based and policy-based authorisation in ASP.NET Core, with practical examples showing when to use each approach.
Customising ASP.NET Core Identity: Beyond the Defaults
How to extend and customise ASP.NET Core Identity with custom user properties, stores, password policies, and token providers.
Secrets Management in .NET: From User Secrets to Azure Key Vault
Practical patterns for managing secrets in .NET applications, covering user secrets for development and Key Vault for production.
Content Security Policy Headers in ASP.NET Core
How to implement Content Security Policy headers to mitigate XSS and data injection attacks in ASP.NET Core applications.
CSRF Protection in ASP.NET Core: How Anti-Forgery Tokens Work
Understanding cross-site request forgery attacks and how ASP.NET Core's anti-forgery system prevents them.
HTTPS and Certificate Management in .NET
Configuring HTTPS in ASP.NET Core, managing certificates for development and production, and enforcing secure connections.
The ASP.NET Core Data Protection API: Encrypting Data the Right Way
How ASP.NET Core's Data Protection API handles key management, encryption, and data persistence — and how to configure it for production.
OAuth 2.0 and OpenID Connect in .NET: What You Actually Need to Know
A practical breakdown of OAuth 2.0 and OpenID Connect in ASP.NET Core, covering authorization code flow, token handling, and common integration patterns.
JWT Authentication in ASP.NET Core: A Practical Guide
How to implement JWT bearer authentication in ASP.NET Core, from token generation to validation and refresh strategies.