Security & Identity: Technologies

Security has to be designed in. It cannot be bolted on afterward. These guides explain how authentication and authorization work in ASP.NET Core, how to choose between ASP.NET Core Identity, Microsoft Entra ID and other identity providers, and how to apply OpenID Connect and JWT correctly.

You will also learn how the OWASP Top 10 risks map to concrete .NET mitigations, how to manage secrets with user secrets, Azure Key Vault and managed identities, and how to use the cryptography and Data Protection APIs without the common mistakes that lead to breaches.

Intermediate

Authentication in ASP.NET Core: Cookies, JWT and OpenID Connect

A practical guide to ASP.NET Core authentication: schemes and handlers, cookies, JWT bearer validation, OpenID Connect with Entra ID, and the BFF pattern.

14 min read

Intermediate

Authorization in ASP.NET Core: Roles, Claims, Policies and Resource-Based Access

Learn ASP.NET Core authorization in depth, covering roles, claims, policy requirements and handlers, resource-based checks, permissions and testing.

13 min read

Intermediate

ASP.NET Core Identity vs Entra ID vs External IdPs: Choosing an Identity Stack

Compare ASP.NET Core Identity, Microsoft Entra ID, Duende IdentityServer, OpenIddict, Keycloak, Auth0 and Okta to pick an identity stack.

13 min read

Intermediate

OWASP Top 10 for .NET Developers

A code-first tour of the OWASP Top 10:2025 risks, with concrete ASP.NET Core, EF Core and C# mitigations for access control, injection and more.

17 min read

Beginner

Secrets Management in .NET: User Secrets, Key Vault and Managed Identity

How to keep credentials out of .NET source control using user secrets, Azure Key Vault, managed identity, workload identity and rotation.

15 min read

Advanced

Cryptography and Data Protection in .NET

A practical guide to cryptography in .NET, covering the Data Protection API, password hashing, AesGcm, RSA/ECDsa and post-quantum APIs.

17 min read