Duende Software
duendesoftware.com
Duende Software
@duendesoftware.com
Duende Software. Makers of Duende IdentityServer and the BFF security framework. https://duendesoftware.com https://youtube.com/@duendesoftware
Claims and scopes describe user information in OpenID Connect.

Let's see how Duende IdentityServer handles consent, different client types, required vs. optional scopes, and what happens when a client doesn't get everything it asked for.

duende.link/97aeqlj 👀

#dotnet
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 28, 2025 at 7:30 AM
Let's look into a crucial "defense-in-depth" mechanism: SameSite cookies. Learn how this powerful browser flag adds extra protection against Cross-Site Request Forgery (CSRF) attacks.

Strengthen your #aspnetcore web applications!

youtu.be/goQlKiynWXU #dotnet
SameSite Cookies 🍪
Welcome back to Duende Software's web security series! In this video, we're looking into a crucial "defense-in-depth" mechanism: SameSite cookies. Learn how this powerful browser flag can add an…
youtu.be
November 27, 2025 at 1:45 PM
Adding .NET 10 Passkey Support to Duende IdentityServer

👉 duende.link/berqe86

Learn how to add #dotnet 10 passkey support to a non-Blazor project such as MVC or Razor Pages.

#security #aspnetcore #identity #webauthn
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 27, 2025 at 1:30 PM
Secure your #ASPNETCore APIs! 🛡️

Learn how to integrate OAuth/OpenID Connect with JWT Bearer tokens, generate an OpenAPI spec, and secure calls from your #SwaggerUI using Duende IdentityServer.

duende.link/4tqhgh4

#dotnet #webdev
Securing OpenAPI and Swagger UI with OAuth in .NET 10
See how to secure an ASP.NET Core API with JWT Bearer tokens, set up the solution to generate an OpenAPI specification, and then secure calls from a Swagger UI to authenticate against Duende’s…
duende.link
November 26, 2025 at 1:45 PM
Claims and scopes describe user information in OpenID Connect.

Let's see how Duende IdentityServer handles consent, different client types, required vs. optional scopes, and what happens when a client doesn't get everything it asked for.

duende.link/97aeqlj 👀

#dotnet
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 25, 2025 at 4:15 PM
Stop struggling with diverse identity providers. 🛑

A Federation Gateway, such as Duende IdentityServer, is the key to:
🔑 Centralized Compliance
⚡️ Operational Agility
👤 Unified User Login

duende.link/8aefizq

#IdentityOrchestration #SSO #Security #dotnet
Building a Federation Gateway with Duende IdentityServer: Strategies and Considerations for Identity Orchestration
Learn the core benefits of building a federation gateway that brings together Entra ID, Okta, SAML, Auth0 though a centralized authentication provider like DUende IdentityServer.
duende.link
November 24, 2025 at 1:30 PM
📢 .NET 10 is here, but what about security? 🤔

In this post, we explore missing security features in #dotnet 10 and discover how Duende Software fills the gaps for Token Management, DPoP, Blazor, and OAuth 2.0 Introspection!

duende.link/q13yifc
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 21, 2025 at 5:15 AM
Today, let's look into a crucial "defense-in-depth" mechanism: SameSite cookies. Learn how this powerful browser flag can add an extra layer of protection against Cross-Site Request Forgery (CSRF) attacks.

Strengthen your #aspnetcore web applications!

youtu.be/goQlKiynWXU #dotnet
November 20, 2025 at 10:07 PM
We built our own JWT Decoder tool, available at jwt.me! 🧐

Quickly inspect and validate your JSON Web Tokens. It features automatic public key (JWK) retrieval, inline claim explanations, and presenter mode.

Read all about it: duende.link/387skhq

#OAuth #OpenIDConnect #JWT #TokenValidation #dotnet
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
jwt.me
November 20, 2025 at 12:10 PM
Roland's video series continues! Let's see how to protect SPAs with OpenID Connect created with libraries like #Angular and #React or plain javascript.

We'll see why you want to use BFF & how this pattern makes secure API access less cumbersome youtu.be/pSTMCyQH_E4

#dotnet
- YouTube
Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.
youtu.be
November 19, 2025 at 3:30 PM
With the .NET 10 LTS released, now is the time to look into upgrading #IdentityServer4 to Duende IdentityServer!

Fix known vulnerabilities and future-proof your security. Get support, FAPI 2.0 compliance, and more.

duende.link/uwo974g

#IdentityServer4 #OAuth2 #OpenIDConnect #dotnet
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 18, 2025 at 1:15 PM
Heads up, #dotnet developers! 🚀

.NET 10 is a great time to upgrade your application and its dependencies.

In this post, we look at key .NET 10 breaking changes you need to know about for a smooth upgrade.

👉 duende.link/89qegla

#aspnetcore
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 14, 2025 at 3:30 PM
Say goodbye ✋ to passwords, and hello 👋 to secure, phishing-resistant logins: passkey credentials.

Part 1 of our 4-part blog series covers password and authentication evolution. Longread ahead! 👀

duende.link/p455k3y #passkeys #webauthn #dotnet #security #aspnetcore
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 13, 2025 at 2:33 PM
Finally, #dotnet 10 is here!

Here are the new capabilities and features we are excited about. Expect passkeys, #opentelemetry additions,TLS for *.localhost, and more.

👀 duende.link/qet4wp9 #aspnetcore
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 12, 2025 at 6:11 PM
The server's origin is used to generate passkey credentials. A credential signed for one app can't be used elsewhere.

What about subdomains? Or multiple domains? In this post, we'll explore some options.

duende.link/igeq87f #dotnet #security #passkeys #webauthn
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 12, 2025 at 2:45 PM
In this video, Christian Wenz dives deep into Cross-Site Request Forgery (CSRF), a simple yet devastating attack that has plagued web applications for years.

Learn what CSRF is, how it works, and how to defend against it in #aspnetcore

youtu.be/WUJrKw05YfI

#dotnet
Prevent Cross-Site Request Forgery
Welcome to the Duende Software web security video series! In this video, Christian Wenz dives deep into Cross-Site Request Forgery (CSRF), a simple yet devastating attack that has plagued web…
youtu.be
November 12, 2025 at 7:30 AM
Congratulations Microsoft with the #dotnet 10 release! devblogs.microsoft.com/dotnet/annou...

Who's upgrading, when? (We're on it for our SDKs)
Announcing .NET 10 - .NET Blog
Announcing the release of .NET 10, the most productive, modern, secure, intelligent, and performant release of .NET yet. With updates across ASP.NET Core, C# 14, .NET MAUI, Aspire, and so much more.
devblogs.microsoft.com
November 11, 2025 at 5:48 PM
📢 .NET 10 is here, but what about security? 🤔

In this post, we explore missing security features in #dotnet 10 and discover how Duende Software fills the gaps for Token Management, DPoP, Blazor, and OAuth 2.0 Introspection!

duende.link/q13yifc
November 11, 2025 at 1:15 PM
Adding .NET 10 Passkey Support to Duende IdentityServer

👉 duende.link/berqe86

Learn how to add #dotnet 10 passkey support to a non-Blazor project such as MVC or Razor Pages.

#security #aspnetcore #identity #webauthn
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 10, 2025 at 7:30 AM
What are Best Practices of Web Application Security in 2025?

This post focuses on key security and authentication flows using OAuth 2.0 and OpenID Connect, flows to avoid, security measures to implement, and IETF Best Current Practices.

duende.link/iyqe3fk #security #dotnet
Web App Security Best Practices 2025
Discover best practices for web application security in 2025. Learn about OAuth 2.0 flows, PKCE, the Backend for Frontend pattern, and more.
duende.link
November 7, 2025 at 7:01 AM
Brace yourself, w̶i̶n̶t̶e̶r̶ #dotnet 10 is coming! ⛄️

Let's look at the new capabilities and features we are excited about for the upcoming .NET release in November. Expect passkeys, #opentelemetry additions,TLS for *.localhost, and more.

duende.link/qet4wp9 #aspnetcore
November 6, 2025 at 6:31 PM
In this video, Christian Wenz dives deep into Cross-Site Request Forgery (CSRF), a simple yet devastating attack that has plagued web applications for years.

Learn what CSRF is, how it works, and how to defend against it in #aspnetcore

youtu.be/WUJrKw05YfI

#dotnet
November 6, 2025 at 2:35 PM
Secure your native applications, like mobile and desktop applications, using #IdentityServer 🔐

In this video, we cover why in-app login pages are outdated, the role of the browser, the Duende OidcClient library, secure token storage, and more!

youtu.be/7_OzM1c-STk #dotnet
Mobile and Desktop Applications
Secure your native applications, like mobile and desktop applications using IdentityServer 0:00 Introduction 0:38 Anti pattern: In-app login page 1:19 Why not resource owner password flow? 2:03 Role…
youtu.be
November 5, 2025 at 9:30 AM
Heads up, #dotnet developers! 🚀

.NET 10 is a great time to upgrade your application and its dependencies.

In this post, we look at key .NET 10 breaking changes you need to know about for a smooth upgrade.

👉 duende.link/89qegla

#aspnetcore
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
November 4, 2025 at 1:23 PM
Roland's video series continues! Let's see how to protect SPAs with OpenID Connect created with libraries like #Angular and #React or plain javascript.

We'll see why you want to use a BFF & how this pattern makes secure API access less cumbersome youtu.be/pSTMCyQH_E4

#dotnet #identity #aspnetcore
Integrating SPAs with BFF
Protect SPAs with OpenID Connect created with libraries like Angular and React or even just plain javascript. 0:00 Introduction 00:28 Authentication: server-rendered vs. client-rendered 01:18 Why…
youtu.be
November 3, 2025 at 12:14 PM