Brock Allen
brockallen.bsky.social
Brock Allen
@brockallen.bsky.social
Programming is hard. Security is harder.
Reposted by Brock Allen
Claims and scopes describe user information in OpenID Connect.

Let's see how Duende IdentityServer handles consent, different client types, required vs. optional scopes, and what happens when a client doesn't get everything it asked for.

duende.link/97aeqlj 👀

#dotnet
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 28, 2025 at 7:30 AM
Reposted by Brock Allen
Adding .NET 10 Passkey Support to Duende IdentityServer

👉 duende.link/berqe86

Learn how to add #dotnet 10 passkey support to a non-Blazor project such as MVC or Razor Pages.

#security #aspnetcore #identity #webauthn
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 27, 2025 at 1:30 PM
Reposted by Brock Allen
Let's look into a crucial "defense-in-depth" mechanism: SameSite cookies. Learn how this powerful browser flag adds extra protection against Cross-Site Request Forgery (CSRF) attacks.

Strengthen your #aspnetcore web applications!

youtu.be/goQlKiynWXU #dotnet
SameSite Cookies 🍪
Welcome back to Duende Software's web security series! In this video, we're looking into a crucial "defense-in-depth" mechanism: SameSite cookies. Learn how this powerful browser flag can add an…
youtu.be
November 27, 2025 at 1:45 PM
@mailbird.bsky.social Is there a setting to disable your advertisement in the paid version of mailbird for windows? The modal dialog is broken and never goes away, and makes the product unusable; I need to use task manager to kill the process.

Related, why is there an ad in your paid product? SMH
November 24, 2025 at 3:34 PM
Reposted by Brock Allen
Stop struggling with diverse identity providers. 🛑

A Federation Gateway, such as Duende IdentityServer, is the key to:
🔑 Centralized Compliance
⚡️ Operational Agility
👤 Unified User Login

duende.link/8aefizq

#IdentityOrchestration #SSO #Security #dotnet
Building a Federation Gateway with Duende IdentityServer: Strategies and Considerations for Identity Orchestration
Learn the core benefits of building a federation gateway that brings together Entra ID, Okta, SAML, Auth0 though a centralized authentication provider like DUende IdentityServer.
duende.link
November 24, 2025 at 1:30 PM
Reposted by Brock Allen
We built our own JWT Decoder tool, available at jwt.me! 🧐

Quickly inspect and validate your JSON Web Tokens. It features automatic public key (JWK) retrieval, inline claim explanations, and presenter mode.

Read all about it: duende.link/387skhq

#OAuth #OpenIDConnect #JWT #TokenValidation #dotnet
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
jwt.me
November 20, 2025 at 12:10 PM
Reposted by Brock Allen
In this video, Christian Wenz dives deep into Cross-Site Request Forgery (CSRF), a simple yet devastating attack that has plagued web applications for years.

Learn what CSRF is, how it works, and how to defend against it in #aspnetcore

youtu.be/WUJrKw05YfI

#dotnet
Prevent Cross-Site Request Forgery
Welcome to the Duende Software web security video series! In this video, Christian Wenz dives deep into Cross-Site Request Forgery (CSRF), a simple yet devastating attack that has plagued web…
youtu.be
November 12, 2025 at 7:30 AM
Reposted by Brock Allen
Finally, #dotnet 10 is here!

Here are the new capabilities and features we are excited about. Expect passkeys, #opentelemetry additions,TLS for *.localhost, and more.

👀 duende.link/qet4wp9 #aspnetcore
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 12, 2025 at 6:11 PM
Reposted by Brock Allen
Brace yourself, w̶i̶n̶t̶e̶r̶ #dotnet 10 is coming! ⛄️

Let's look at the new capabilities and features we are excited about for the upcoming .NET release in November. Expect passkeys, #opentelemetry additions,TLS for *.localhost, and more.

duende.link/qet4wp9 #aspnetcore
November 6, 2025 at 6:31 PM
Reposted by Brock Allen
Secure your native applications, like mobile and desktop applications, using #IdentityServer 🔐

In this video, we cover why in-app login pages are outdated, the role of the browser, the Duende OidcClient library, secure token storage, and more!

youtu.be/7_OzM1c-STk #dotnet
Mobile and Desktop Applications
Secure your native applications, like mobile and desktop applications using IdentityServer 0:00 Introduction 0:38 Anti pattern: In-app login page 1:19 Why not resource owner password flow? 2:03 Role…
youtu.be
November 5, 2025 at 9:30 AM
Reposted by Brock Allen
Claims and scopes describe user information in OpenID Connect.

Let's see how Duende IdentityServer handles consent, different client types, required vs. optional scopes, and what happens when a client doesn't get everything it asked for.

duende.link/97aeqlj 👀

#dotnet #aspnetcore
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
October 28, 2025 at 12:31 PM
Reposted by Brock Allen
We're happy to start sponsoring the Spectre.Console project!

It is a #dotnet library that makes it easier to create beautiful console applications by giving you access to standard components you may find in a CLI experience.

Go check it out! duende.link/sp3ctr3
October 22, 2025 at 1:45 PM
Reposted by Brock Allen
Adding .NET 10 Passkey Support to Duende IdentityServer

👉 duende.link/berqe86

Learn how to add #dotnet 10 passkey support to a non-Blazor project such as MVC or Razor Pages.

#security #aspnetcore #identity #webauthn
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
October 21, 2025 at 8:49 AM
Reposted by Brock Allen
Secure your native applications, like mobile and desktop applications, using #IdentityServer 🔐

In this video, we cover why in-app login pages are outdated, the role of the browser, the Duende OidcClient library, secure token storage, and more!

youtu.be/7_OzM1c-STk #dotnet
Mobile and Desktop Applications
Secure your native applications, like mobile and desktop applications using IdentityServer 0:00 Introduction 0:38 Anti pattern: In-app login page 1:19 Why not resource owner password flow? 2:03 Role…
youtu.be
October 20, 2025 at 1:31 PM
Reposted by Brock Allen
The server's origin is used to generate passkey credentials, making them resistant to phishing. A credential signed for one app can't be used elsewhere.

What about subdomains? Or multiple domains? In this post, we'll explore some options.

duende.link/igeq87f #dotnet #security #passkeys #webauthn
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
October 14, 2025 at 11:05 AM
Reposted by Brock Allen
Passwordless authentication is gaining momentum. The upcoming release of #dotnet 10 comes with built-in passkey support!

In this post, we look at the new #Blazor project template and how it adds secure authentication using passkeys.

duende.link/37egw9f

#identity #passkey #webauthn #aspnetcore
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
October 7, 2025 at 12:15 PM
Reposted by Brock Allen
Say goodbye ✋ to passwords, and hello 👋 to secure, phishing-resistant logins: passkey credentials.

Part 1 of our 4-part blog series covers password and authentication evolution. Longread ahead! 👀

duende.link/p455k3y #passkeys #webauthn #dotnet #security #aspnetcore
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
October 6, 2025 at 9:01 AM
Reposted by Brock Allen
Roland's video series continues! Let's see how to protect SPAs with OpenID Connect created with libraries like #Angular and #React or plain javascript.

We'll see why you want to use a BFF & how this pattern makes secure API access less cumbersome youtu.be/pSTMCyQH_E4

#dotnet #identity #aspnetcore
Integrating SPAs with BFF
Protect SPAs with OpenID Connect created with libraries like Angular and React or even just plain javascript. 0:00 Introduction 00:28 Authentication: server-rendered vs. client-rendered 01:18 Why…
youtu.be
October 6, 2025 at 2:31 PM
Reposted by Brock Allen
I'm hiring! Looking for an #aspnetcore dev, ideally with identity/oidc experience. Role is support, tech presales, advisory, docs, ...

East coast US ideally for timezone overlap in the team

Small team and company, big ambition. Reach out if you're interested! duendesoftware.com/careers/cust...
Customer Success Engineer
Duende software looking to fill Customer Success Engineer position
duendesoftware.com
September 25, 2025 at 4:57 PM
Reposted by Brock Allen
In this video, let's see how to protect SPAs with OpenID Connect created with libraries like #Angular and #React or plain javascript.

We'll see why you want to use a BFF & how this pattern makes secure API access less cumbersome youtu.be/pSTMCyQH_E4

#dotnet #identity #aspnetcore
Integrating SPAs with BFF
Protect SPAs with OpenID Connect created with libraries like Angular and React or even just plain javascript. 0:00 Introduction 00:28 Authentication: server-rendered vs. client-rendered 01:18 Why…
youtu.be
September 26, 2025 at 12:15 PM
Reposted by Brock Allen
What are Best Practices of Web Application Security in 2025?

This post focuses on key security and authentication flows using OAuth 2.0 and OpenID Connect, flows to avoid, security measures to implement, and IETF Best Current Practices.

duende.link/iyqe3fk #security #dotnet
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
September 5, 2025 at 1:03 PM
Reposted by Brock Allen
Watch the recording of our #IdentityServer 7.3 launch!
duendesoftware.com/webinars/due...

Joe DeCock covers new templates, and looks at setting up your environment for the FAPI 2.0 security profile and conformance tests.

#dotnet #security #identity
September 5, 2025 at 1:07 PM
Reposted by Brock Allen
Meet Duende #IdentityServer v7.3! This new release includes:

👉 Enhanced security & future proofing with FAPI 2.0 support
👉 Quick start templates to accelerate development.
👉 And more....

Release blog here ➡️ duende.link/is73b0b

#dotnet #security #identity
August 19, 2025 at 1:51 PM
Reposted by Brock Allen
External identity providers in #aspnetcore

In this post, we cover initial setup (with Google), the connection between external and cookie authentication, and discusses why alternatives might be better for production apps.

duende.link/q24tubs #security #identity #dotnet
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
August 19, 2025 at 9:43 PM
Reposted by Brock Allen
Meet Duende #IdentityServer v7.3! This new release includes:

👉 Enhanced security & future proofing with FAPI 2.0 support
👉 Quick start templates to accelerate development.
👉 And more....

Release blog here ➡️ duende.link/is73b0b

#dotnet #security #identity
August 14, 2025 at 1:26 PM