Writing a browser-based application is hard, and when it comes to security the guidance changes every year. It all started with securing your Ajax calls with cookies until we learned that this is prone to CSRF attacks. Then the IETF made JS-based OAuth official by introducing the Implicit Flow - until we learned how hard it is to protect against XSS, token leakage and the threat of token exfiltration. Seems you cannot win.

Every once in a while, a security problem comes up that needs patching. We couldn’t find a clear and concise Microsoft document that describes that process, so we asked Barry directly. We thought it might be useful to document our conversation here. Regardless what you are building, you ultimately have two types of dependencies: Functionality that is part of the .NET runtime/SDK Functionality you reference via a Nuget package. This might be a Microsoft package that is not part of the shared runtime (e.

Today is a big day for us! Almost one year in the making, our new company has its first official release. If you haven’t followed our journey, we announced Duende Software as the new home for IdentityServer with a sustainable business model on October, 1st. We then migrated the IdentityServer4 code base and added .NET 5 support in Preview 1, added automatic key management in Preview 2 and finally resource isolation in Preview 3.