Brock Allen
@brockallen.bsky.social
Programming is hard. Security is harder.
Our livestream starts NOW! 🔴 Passkeys. Built-in MFA. One-Time Passwords. Audit trails. 🔐 See how Duende User Management is replacing the complexity of ASP.NET Identity with a crafted, integrated foundation. Join the live preview: duende.link/78q3hk #dotnet #aspnet #aspnetcore
A First Look at Duende User Management | Duende
Join us March 24 for a first look at Duende User Management. Learn to replace ASP.NET Identity with built-in Passkeys, MFA, and audits.
duende.link
Recording of my talk on passkeys in #aspnetcore at NDC Copenhagen is up! #dotnet Also includes a pointer on how to add passkeys to Razor Pages for folks who aren't on the #Blazor train. www.youtube.com/watch?v=P7eb... #dotnet
Going Passwordless - A Practical Guide to Passkeys in ASP.NET Core - Maarten Balliauw
YouTube video by NDC Conferences
youtube.com
Why be a Duende Product Insider? Get a Direct Channel for deep technical talks, Early Access to features (Agentic AI, .NET 10), and Spec Authority on standards. For heavy-lifters solving the hardest identity problems. ➡️ duende.link/discord #DuendeInsiders #SecurityExperts
Join the Duende Insiders Discord Server!
Check out the Duende Insiders community on Discord – hang out with 42 other members and enjoy free voice and text chat.
duende.link
🛡️ BFF v4: Frontend Security Simplified Frontend devs shouldn't handle tokens or refresh cycles. BFF keeps security on the server, eliminating XSS risks. v4 adds multi-frontend support for operational sanity. Ditch the token burden entirely. ➡️ duende.link/bff4b0b
Duende BFFv4 is now available
Duende BFFv4 is now available! Learn about multi-frontend, simplified security, and unlock end-to-end visibility with OpenTelemetry.
duende.link
@nbc10wjar.bsky.social Dan Jaehnig's questions to investigators during the brown investigation were ancillary, accusatory, inflammatory, and really unrelated to reporting the news. I wonder if the stations ownership is driving such behavior, as opposed to just honest journalism? please do better.
DPoP is not shorthand for Danish pop music. 🎶 Instead, Demonstrating Proof of Possession (DPoP) is used to fight back against token replay attacks in OpenID Connect and OAuth. Security Lingo Explained: duende.link/lgodpop #SecurityLingo #dotnet
Security Lingo Explained: DPoP
DPoP (Demonstrating Proof of Possession) uses asymmetric keys to secure OpenID Connect and OAuth against token replay attacks.
duende.link
We published a new post: "Why Now is an Excellent Time for Backend For Frontend." With the complexity of modern SPAs and the need for robust cookie management, Duende's BFF v4 solves critical security issues at the architectural level. Learn more: duendesoftware.com/blog/2025120...
Secure frontend apps with the BFF Pattern
Secure frontend apps with the Backend for Frontend (BFF) pattern. Simplify token management and boost security using Duende BFF v4, with multi-frontend support.
duendesoftware.com
If you're leveraging BFF v4, take 20 minutes to rewatch Erwin van der Valk's talk on Token Management and securing your backend-for-frontend implementations. This is the best pattern for modern single-page application (SPA) security. Available now: 📺 📺 www.youtube.com/watch?v=6zMS...
Token Management: Applying the Duende Backend for Frontend (BFF) Security Framework
https://duende.link/bff - Storing tokens in the browser is no longer secure for modern Web Application based development. The BFF Security pattern is now the way to go to enhance your security and…
youtube.com
Ever wondered how browsers determine what kind of content they're displaying? It's usually through the Content-Type header. But what happens when that's missing or incorrect? It can be a serious security risk! Let's see how to fix this in #aspnetcore youtu.be/kSaSb2hBbyk #dotnet
Understanding the X-Content-Type-Options Header
Ever wondered how browsers determine what kind of content they're displaying? It's usually through the Content-Type header. But what happens when that's missing or incorrect? That's where MIME type…
youtu.be
Is 'Auth' just one thing? 🤔 Developers often use it as shorthand, but it's ambiguous! Learn the critical difference between Authentication (AuthN) and Authorization (AuthZ) in our latest post: duende.link/lgoauth #SecurityLingo #dotnet
Security Lingo Explained: Auth
Learn and understand the key difference between Authentication (AuthN) and Authorization (AuthZ)
duende.link
Digging into the new Secure Gateway to AI. We detail how v7.4 implements RFC 8414 and DCR to manage AI agents securely; establishing a stable, secure, and future-proof MCP server architecture. Learn more about protecting your Models: duende.link/is74b1b
Scaling with Duende IdentityServer, MCP, and AI
Learn to leverage the Model Context Protocol (MCP) to securely scale AI agents and mitigate LLM errors with existing systems using Duende IdentityServer.
duende.link
The call for papers for NDC Security ends tomorrow. Come do your talk in Oslo: ndcsecurity.com/call-for-pap...
Duende BFFv4 is available now! 🚨 The #BFF security pattern saves the day! Rewatch Erwin van der Valk's demo on Token Management and applying Duende's backend for frontend. A must-watch for devs building modern apps. 📺 www.youtube.com/watch?v=6zMS... #dotnet #security #identity #react #angular
Token Management: Applying the Duende Backend for Frontend (BFF) Security Framework
https://duende.link/bff - Storing tokens in the browser is no longer secure for modern Web Application based development. The BFF Security pattern is now the way to go to enhance your security and…
youtube.com
The Duende IdentityServer v7.4 release is available! For those working with Model Context Protocol (MCP), this is the foundational security layer you've been waiting for. Read more here: duendesoftware.com/use-case-sec... #aiagents #security #identity #ModelContextProtocol
Secure MCP Implementation
Learn how IdentityServer reduces risk, scales to thousands of agents, and future-proofs MCP implementations with open, IETF-aligned identity standards.
duendesoftware.com
Tomorrow: Duende IdentityServer v7.4 livestream launch event. Security leaders and architects, this is a deep dive into the .NET 10 LTS compatibility and implementing secure MCP for AI agents. Final day to register: duendesoftware.com/webinars/due...
Claims and scopes describe user information in OpenID Connect. Let's see how Duende IdentityServer handles consent, different client types, required vs. optional scopes, and what happens when a client doesn't get everything it asked for. duende.link/97aeqlj 👀 #dotnet
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
Adding .NET 10 Passkey Support to Duende IdentityServer 👉 duende.link/berqe86 Learn how to add #dotnet 10 passkey support to a non-Blazor project such as MVC or Razor Pages. #security #aspnetcore #identity #webauthn
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
Let's look into a crucial "defense-in-depth" mechanism: SameSite cookies. Learn how this powerful browser flag adds extra protection against Cross-Site Request Forgery (CSRF) attacks. Strengthen your #aspnetcore web applications! youtu.be/goQlKiynWXU #dotnet
SameSite Cookies 🍪
Welcome back to Duende Software's web security series! In this video, we're looking into a crucial "defense-in-depth" mechanism: SameSite cookies. Learn how this powerful browser flag can add an…
youtu.be
@mailbird.bsky.social Is there a setting to disable your advertisement in the paid version of mailbird for windows? The modal dialog is broken and never goes away, and makes the product unusable; I need to use task manager to kill the process. Related, why is there an ad in your paid product? SMH
Stop struggling with diverse identity providers. 🛑 A Federation Gateway, such as Duende IdentityServer, is the key to: 🔑 Centralized Compliance ⚡️ Operational Agility 👤 Unified User Login duende.link/8aefizq #IdentityOrchestration #SSO #Security #dotnet
Building a Federation Gateway with Duende IdentityServer: Strategies and Considerations for Identity Orchestration
Learn the core benefits of building a federation gateway that brings together Entra ID, Okta, SAML, Auth0 though a centralized authentication provider like DUende IdentityServer.
duende.link
We built our own JWT Decoder tool, available at jwt.me! 🧐 Quickly inspect and validate your JSON Web Tokens. It features automatic public key (JWK) retrieval, inline claim explanations, and presenter mode. Read all about it: duende.link/387skhq #OAuth #OpenIDConnect #JWT #TokenValidation #dotnet
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
jwt.me
In this video, Christian Wenz dives deep into Cross-Site Request Forgery (CSRF), a simple yet devastating attack that has plagued web applications for years. Learn what CSRF is, how it works, and how to defend against it in #aspnetcore youtu.be/WUJrKw05YfI #dotnet
Prevent Cross-Site Request Forgery
Welcome to the Duende Software web security video series! In this video, Christian Wenz dives deep into Cross-Site Request Forgery (CSRF), a simple yet devastating attack that has plagued web…
youtu.be
Finally, #dotnet 10 is here! Here are the new capabilities and features we are excited about. Expect passkeys, #opentelemetry additions,TLS for *.localhost, and more. 👀 duende.link/qet4wp9 #aspnetcore
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
Brace yourself, w̶i̶n̶t̶e̶r̶ #dotnet 10 is coming! ⛄️ Let's look at the new capabilities and features we are excited about for the upcoming .NET release in November. Expect passkeys, #opentelemetry additions,TLS for *.localhost, and more. duende.link/qet4wp9 #aspnetcore
Secure your native applications, like mobile and desktop applications, using #IdentityServer 🔐 In this video, we cover why in-app login pages are outdated, the role of the browser, the Duende OidcClient library, secure token storage, and more! youtu.be/7_OzM1c-STk #dotnet
Mobile and Desktop Applications
Secure your native applications, like mobile and desktop applications using IdentityServer 0:00 Introduction 0:38 Anti pattern: In-app login page 1:19 Why not resource owner password flow? 2:03 Role…
youtu.be
Claims and scopes describe user information in OpenID Connect. Let's see how Duende IdentityServer handles consent, different client types, required vs. optional scopes, and what happens when a client doesn't get everything it asked for. duende.link/97aeqlj 👀 #dotnet #aspnetcore
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
We're happy to start sponsoring the Spectre.Console project! It is a #dotnet library that makes it easier to create beautiful console applications by giving you access to standard components you may find in a CLI experience. Go check it out! duende.link/sp3ctr3
Adding .NET 10 Passkey Support to Duende IdentityServer 👉 duende.link/berqe86 Learn how to add #dotnet 10 passkey support to a non-Blazor project such as MVC or Razor Pages. #security #aspnetcore #identity #webauthn
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link
Secure your native applications, like mobile and desktop applications, using #IdentityServer 🔐 In this video, we cover why in-app login pages are outdated, the role of the browser, the Duende OidcClient library, secure token storage, and more! youtu.be/7_OzM1c-STk #dotnet
Mobile and Desktop Applications
Secure your native applications, like mobile and desktop applications using IdentityServer 0:00 Introduction 0:38 Anti pattern: In-app login page 1:19 Why not resource owner password flow? 2:03 Role…
youtu.be
The server's origin is used to generate passkey credentials, making them resistant to phishing. A credential signed for one app can't be used elsewhere. What about subdomains? Or multiple domains? In this post, we'll explore some options. duende.link/igeq87f #dotnet #security #passkeys #webauthn
Duende Software - Identity and Access Management for .NET
We help companies using .NET to build identity and access control solutions for modern applications.
duende.link