Brock Allen
brockallen.bsky.social
Brock Allen
@brockallen.bsky.social
Programming is hard. Security is harder.
Reposted by Brock Allen
In this video, Christian Wenz dives deep into Cross-Site Request Forgery (CSRF), a simple yet devastating attack that has plagued web applications for years.

Learn what CSRF is, how it works, and how to defend against it in #aspnetcore

youtu.be/WUJrKw05YfI

#dotnet
Prevent Cross-Site Request Forgery
Welcome to the Duende Software web security video series! In this video, Christian Wenz dives deep into Cross-Site Request Forgery (CSRF), a simple yet devastating attack that has plagued web…
youtu.be
November 12, 2025 at 7:30 AM
Reposted by Brock Allen
Finally, #dotnet 10 is here!

Here are the new capabilities and features we are excited about. Expect passkeys, #opentelemetry additions,TLS for *.localhost, and more.

👀 duende.link/qet4wp9 #aspnetcore
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 12, 2025 at 6:11 PM
Reposted by Brock Allen
Brace yourself, w̶i̶n̶t̶e̶r̶ #dotnet 10 is coming! ⛄️

Let's look at the new capabilities and features we are excited about for the upcoming .NET release in November. Expect passkeys, #opentelemetry additions,TLS for *.localhost, and more.

duende.link/qet4wp9 #aspnetcore
November 6, 2025 at 6:31 PM
Reposted by Brock Allen
Secure your native applications, like mobile and desktop applications, using #IdentityServer 🔐

In this video, we cover why in-app login pages are outdated, the role of the browser, the Duende OidcClient library, secure token storage, and more!

youtu.be/7_OzM1c-STk #dotnet
Mobile and Desktop Applications
Secure your native applications, like mobile and desktop applications using IdentityServer 0:00 Introduction 0:38 Anti pattern: In-app login page 1:19 Why not resource owner password flow? 2:03 Role…
youtu.be
November 5, 2025 at 9:30 AM
Reposted by Brock Allen
Claims and scopes describe user information in OpenID Connect.

Let's see how Duende IdentityServer handles consent, different client types, required vs. optional scopes, and what happens when a client doesn't get everything it asked for.

duende.link/97aeqlj 👀

#dotnet #aspnetcore
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
October 28, 2025 at 12:31 PM
Reposted by Brock Allen
We're happy to start sponsoring the Spectre.Console project!

It is a #dotnet library that makes it easier to create beautiful console applications by giving you access to standard components you may find in a CLI experience.

Go check it out! duende.link/sp3ctr3
October 22, 2025 at 1:45 PM
Reposted by Brock Allen
Adding .NET 10 Passkey Support to Duende IdentityServer

👉 duende.link/berqe86

Learn how to add #dotnet 10 passkey support to a non-Blazor project such as MVC or Razor Pages.

#security #aspnetcore #identity #webauthn
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
October 21, 2025 at 8:49 AM
Reposted by Brock Allen
Secure your native applications, like mobile and desktop applications, using #IdentityServer 🔐

In this video, we cover why in-app login pages are outdated, the role of the browser, the Duende OidcClient library, secure token storage, and more!

youtu.be/7_OzM1c-STk #dotnet
Mobile and Desktop Applications
Secure your native applications, like mobile and desktop applications using IdentityServer 0:00 Introduction 0:38 Anti pattern: In-app login page 1:19 Why not resource owner password flow? 2:03 Role…
youtu.be
October 20, 2025 at 1:31 PM
Reposted by Brock Allen
The server's origin is used to generate passkey credentials, making them resistant to phishing. A credential signed for one app can't be used elsewhere.

What about subdomains? Or multiple domains? In this post, we'll explore some options.

duende.link/igeq87f #dotnet #security #passkeys #webauthn
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
October 14, 2025 at 11:05 AM
Reposted by Brock Allen
Passwordless authentication is gaining momentum. The upcoming release of #dotnet 10 comes with built-in passkey support!

In this post, we look at the new #Blazor project template and how it adds secure authentication using passkeys.

duende.link/37egw9f

#identity #passkey #webauthn #aspnetcore
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
October 7, 2025 at 12:15 PM
Reposted by Brock Allen
Say goodbye ✋ to passwords, and hello 👋 to secure, phishing-resistant logins: passkey credentials.

Part 1 of our 4-part blog series covers password and authentication evolution. Longread ahead! 👀

duende.link/p455k3y #passkeys #webauthn #dotnet #security #aspnetcore
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
October 6, 2025 at 9:01 AM
Reposted by Brock Allen
Roland's video series continues! Let's see how to protect SPAs with OpenID Connect created with libraries like #Angular and #React or plain javascript.

We'll see why you want to use a BFF & how this pattern makes secure API access less cumbersome youtu.be/pSTMCyQH_E4

#dotnet #identity #aspnetcore
Integrating SPAs with BFF
Protect SPAs with OpenID Connect created with libraries like Angular and React or even just plain javascript. 0:00 Introduction 00:28 Authentication: server-rendered vs. client-rendered 01:18 Why…
youtu.be
October 6, 2025 at 2:31 PM
Reposted by Brock Allen
I'm hiring! Looking for an #aspnetcore dev, ideally with identity/oidc experience. Role is support, tech presales, advisory, docs, ...

East coast US ideally for timezone overlap in the team

Small team and company, big ambition. Reach out if you're interested! duendesoftware.com/careers/cust...
Customer Success Engineer
Duende software looking to fill Customer Success Engineer position
duendesoftware.com
September 25, 2025 at 4:57 PM
Reposted by Brock Allen
In this video, let's see how to protect SPAs with OpenID Connect created with libraries like #Angular and #React or plain javascript.

We'll see why you want to use a BFF & how this pattern makes secure API access less cumbersome youtu.be/pSTMCyQH_E4

#dotnet #identity #aspnetcore
Integrating SPAs with BFF
Protect SPAs with OpenID Connect created with libraries like Angular and React or even just plain javascript. 0:00 Introduction 00:28 Authentication: server-rendered vs. client-rendered 01:18 Why…
youtu.be
September 26, 2025 at 12:15 PM
Reposted by Brock Allen
What are Best Practices of Web Application Security in 2025?

This post focuses on key security and authentication flows using OAuth 2.0 and OpenID Connect, flows to avoid, security measures to implement, and IETF Best Current Practices.

duende.link/iyqe3fk #security #dotnet
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
September 5, 2025 at 1:03 PM
Reposted by Brock Allen
Watch the recording of our #IdentityServer 7.3 launch!
duendesoftware.com/webinars/due...

Joe DeCock covers new templates, and looks at setting up your environment for the FAPI 2.0 security profile and conformance tests.

#dotnet #security #identity
September 5, 2025 at 1:07 PM
Reposted by Brock Allen
Meet Duende #IdentityServer v7.3! This new release includes:

👉 Enhanced security & future proofing with FAPI 2.0 support
👉 Quick start templates to accelerate development.
👉 And more....

Release blog here ➡️ duende.link/is73b0b

#dotnet #security #identity
August 19, 2025 at 1:51 PM
Reposted by Brock Allen
External identity providers in #aspnetcore

In this post, we cover initial setup (with Google), the connection between external and cookie authentication, and discusses why alternatives might be better for production apps.

duende.link/q24tubs #security #identity #dotnet
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
August 19, 2025 at 9:43 PM
Reposted by Brock Allen
Meet Duende #IdentityServer v7.3! This new release includes:

👉 Enhanced security & future proofing with FAPI 2.0 support
👉 Quick start templates to accelerate development.
👉 And more....

Release blog here ➡️ duende.link/is73b0b

#dotnet #security #identity
August 14, 2025 at 1:26 PM
Reposted by Brock Allen
Next video from our Identity & Access Control workshop: OpenID Connect

We cover tokens, scopes, the #aspnetcore OpenID Connect handler, the userinfo endpoint, token management, refresh tokens, and more.

youtube.com/watch?v=c41R...

#identityserver #aspnetcore #oauth2 #openidconnect #dotnet
August 4, 2025 at 1:00 PM
Reposted by Brock Allen
Fresh post on external providers in #aspnetcore

We cover initial setup, the connection between external and cookie authentication, and discusses why alternatives might be better for production apps.

duende.link/q24tubs #security #identity #dotnet
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
July 28, 2025 at 12:59 PM
Reposted by Brock Allen
How to test your #IdentityServer?

In this post, we'll show how to setup and run automated tests with your favorite test framework. #mstest #xunit #nunit #dotnet #security

duende.link/a4rs979
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
July 22, 2025 at 1:01 PM
Reposted by Brock Allen
Duende is committed to open source and values contributors. We are now sponsoring Astro and Starlight, the static site generator that powers our docs.

More details about Astro and why we are sponsoring on our blog: duende.link/astr055 #dotnet #astro #identity
Duende Software Docs
Get started building your .NET applications with IdentityServer, Backend-for-Frontend (BFF) and our open-source tools.
docs.duendesoftware.com
July 3, 2025 at 3:31 PM
Reposted by Brock Allen
Add an extra layer of security to critical user actions! 🛡️

Learn how to implement Step Up challenges in your #aspnetcore apps with Duende #IdentityServer to enhance user verification and re-confirm identity for some activities.

duende.link/qthej2r

#dotnet #security #oidc
July 1, 2025 at 1:00 PM
Reposted by Brock Allen
How I got involved in the Backend for Frontend (BFF) spec? @philippederyck.bsky.social built a demo to show how insecure single-page applications can be!

Full interview: youtu.be/urS9wstmN2U
More on Backend for Frontend: duende.link/bff

#dotnet #security #bff #oauth2
June 25, 2025 at 9:32 AM