Every developer has a side project. Mine became... writing a book. Just published The Side Project, about a dev whose innocent youth football app gets hijacked by organized crime. Check it out: books2read.com/u/bP2nll

Well hello there

The future of .NET identity is here. 🚀 Hear from the architects shaping the ecosystem. The Duende leadership team dives into ISv8, modular add-ons, and our commitment to expanding identity infrastructure. 📺 Watch the full walkthrough: www.youtube.com/watch?v=qloC...

Stop hand-rolling bespoke user systems. 🏗️ Our new User Management add-on brings fully supported user storage, auth, and lifecycle management directly to your deployment. Passwords, MFA, and passkeys are built-in, not bolted on. Read the blog: duendesoftware.com/blog/2026060...

Duende Software - Identity and Access Management for .NET

Duende Software is a company that builds industry-leading security software.

duendesoftware.com

IdentityServer v8 brings architectural refinements to modern .NET workloads. 🛠️ Enjoy idiomatic cooperative cancellation, TimeProvider integration, and a unified model for OIDC & SAML connected apps. Read the release notes: docs.duendesoftware.com/identityserv...

We go LIVE in one hour! 🚨 Join us for the Spring Launch Event to see IdentityServer v8, 5 new modular add-ons, and the next era of Duende Identity Infrastructure. ⏰ 10:00 EDT / 16:00 CEST / 14:00 UTC Be there: www.youtube.com/watch?v=qloC...

Spring Launch Event: The Next Era of Duende Identity Infrastructure

This isn't a point release. This is a new chapter. On June 2, Duende ships the most significant release in the company's history: IdentityServer v8 - a .NET 10-exclusive major release, five modular…

youtube.com

IdentityServer got SAML support before GTA 6

What’s next for .NET identity? A purpose-built management plane and storage abstraction. 🏗️ We’re unveiling a new additive infrastructure layer that powers User Management today and our capabilities of tomorrow. Learn more on June 2: duendesoftware.com/webinars/the...

The next era of Duende Identity Infrastructure

Learn more about the Next Era of Duende Identity Infrastructure including IdentityServer v8, modular add-ons, a new infrastructure foundation, and more.

duendesoftware.com

What’s next for .NET identity? A purpose-built management plane and storage abstraction. 🏗️ We’re unveiling a new additive infrastructure layer that powers User Management today and our capabilities of tomorrow. Learn more on June 2: duendesoftware.com/webinars/the...

The next era of Duende Identity Infrastructure

Learn more about the Next Era of Duende Identity Infrastructure including IdentityServer v8, modular add-ons, a new infrastructure foundation, and more.

duendesoftware.com

What’s next for .NET identity? A purpose-built management plane and storage abstraction. 🏗️ We’re unveiling a new additive infrastructure layer that powers User Management today and our capabilities of tomorrow. Learn more on June 2: duendesoftware.com/webinars/the...

The next era of Duende Identity Infrastructure

Learn more about the Next Era of Duende Identity Infrastructure including IdentityServer v8, modular add-ons, a new infrastructure foundation, and more.

duendesoftware.com

Developers: IdentityServer v8 is built EXCLUSIVELY for .NET 10. 🛠️ We dropped multi-targeting for .NET 8 & 9 to deliver leaner packages, cleaner code paths, and full access to runtime capabilities like TimeProvider & HybridCache. See it live June 2: duendesoftware.com/webinars/the...

The next era of Duende Identity Infrastructure

Learn more about the Next Era of Duende Identity Infrastructure including IdentityServer v8, modular add-ons, a new infrastructure foundation, and more.

duendesoftware.com

Custom auth creates a "training tax." New hires waste weeks learning proprietary code. License IdentityServer to use a standard. Hire .NET devs who are productive on day one. Learn how: duende.link/appmodli #dotnet #aspnet #aspnetcore

Application Modernization

Future-proof your apps with Duende's identity modernization. Get better security and control while preserving your existing identity logic.

duende.link

.NET 10 brings massive performance gains. IdentityServer leverages these immediately, showing reduced allocation rates in the token validation path. Learn more 👉️ duende.link/bpicli #aspnet #dotnet

The Big Picture

An overview of modern application architecture patterns and how OpenID Connect and OAuth 2.0 protocols implemented by IdentityServer solve authentication and API access challenges

duende.link

We've published guidance on the high-severity #aspnetcore Data Protection vulnerability, CVE-2026-40372 (Elevation of Privilege) Read our guide to: * Determine if your applications are affected * Get mitigation steps 👉️ duende.link/twe5wp #dotnet

Update Guidance for CVE-2026-40372 - ASP.NET Data Protection

Guidance on the high-severity CVE-2026-40372 vulnerability in Microsoft.AspNetCore.DataProtection. Learn how attackers can use it, check if your application is affected, and find the critical steps…

duende.link

Stop compromising your architecture for your identity provider. 🔑 Duende gives you true sovereignty in the .NET LTS era: ✅ No lock-in (On-prem/Cloud/Hybrid) ✅ Full UI/UX freedom ✅ Custom logic in your .NET pipeline Build it your way: duende.link/2swrhhw #dotnet #aspnet #aspnetcore

Duende IdentityServer

The most flexible and standards-compliant OpenID Connect and OAuth framework for ASP.NET Core.

duende.link

SAML turned 20 and it's not going anywhere. Enterprise SSO, government federations, academic networks: they all run on SAML. Here's why it endures, and what it means for IdentityServer v8. 🔐 duende.link/p2rn8q #dotnet

The History and Future of SAML: Why a 20-Year-Old Protocol Still Matters

SAML isn't legacy — it's entrenched. Tracing the protocol from its 2001 origins through its enduring role in enterprise, government, and academic identity federation, and what it means for…

duende.link

Stop bloating your auth cookies! 🍪 Learn how to: 1️⃣ Use IdentityServer server-side sessions and improve performance 2️⃣ Use AuthenticationProperties to store dynamic user metadata (like location) Article at duende.link/8624kh #dotnet #aspnetcore

Extending Duende IdentityServer Server-Side Sessions with Dynamic User Metadata

Stop bloating your authentication cookies. Use Duende IdentityServer server-side sessions and AuthenticationProperties to store dynamic user metadata (like location) on the server, which improves…

duende.link

Stop writing boilerplate code for ClaimsPrincipal! 🛡️ #csharp 14 extension members let you use properties to centralize claim access logic, leading to cleaner, #aspnetcore application code. Read more: duende.link/7efu3d

Improving .NET Security Code with C# 14 Property Extensions

Stop writing boilerplate code for ClaimsPrincipal. C# 14 extension members let you use properties to centralize claim access logic, leading to cleaner, more secure ASP.NET Core applications.

duende.link

Want the power of Duende IdentityServer but with faster time-to-value? ⏱️ We’re previewing a first-party user management .NET SDK on March 24th that gives you Passkeys, MFA, and audit trails out-of-the-box. Keep your data control, ditch the custom coding. RSVP: duende.link/78q3hk #dotnet #aspnet

A First Look at Duende User Management | Duende

Join us March 24 for a first look at Duende User Management. Learn to replace ASP.NET Identity with built-in Passkeys, MFA, and audits.

duende.link

SaaS providers are black boxes. Duende gives you full source access. Step-through to understand exactly how it all works. Learn how: duende.link/appmodb #aspnet #aspnetcore #dotnet

Application Modernization

Future-proof your apps with Duende's identity modernization. Get better security and control while preserving your existing identity logic.

duende.link

Authentication on a different device from the one you're using? 🧐 Learn how to implement Client-Initiated Backchannel Authentication (CIBA) in #ASPNETCore and #dotnet: duende.link/3ysz4u Especially helpful in high-trust scenarios.

Client-Initiated Backchannel Authentication (CIBA) in ASP.NET Core 10 with Duende Identity Server

Learn about the Client-Initiated Backchannel Authentication (CIBA) standard, an OpenID Connect extension for authenticating users on a separate device. See how to implement this high-trust flow with…

duende.link

Duende Software's legendary training on Identity and Access Management was originally created by Dominick Baier and Brock Allen. We're offering the training online/remotely as 6 half-day blocks in EU afternoons/US mornings, starting March 10. Read more and sign up at sustainsys.com/training

Training Information

sustainsys.com

The livestream starts NOW! 🔴 Security you can’t prove isn’t security, it’s hope. Stop relying on manual checks. We’re showing you how to automate your security testing to ensure your API only accepts your trusted tokens. 🔗 Join us now: duende.link/lsjwt26b #OAuth2 #JWT #DotNet

Livestream: Are your access tokens really secure?

Are your APIs vulnerable? Explore JWT pitfalls, learn to prevent exploits, and compare JWTs vs. opaque tokens in this expert-led session.

duende.link

Should you add rate limiting to your Duende IdentityServer deployment? 🤔 Our new article breaks down the why (and why not), plus 3 implementation options. Read the full article 👉 duende.link/87wrkjh #dotnet #ASPNETCore #OAuth #OpenIDConnect

Rate Limiting IdentityServer Endpoints

Learn why rate limiting Duende IdentityServer endpoints is usually unnecessary, and when you do need it. Explore a layered approach using network proxies, ASP.NET Core middleware, and custom…

duende.link

Null exceptions are costly. We are enforcing strict Nullable Reference Types across the IdentityServer API in .NET 10. The compiler catches bugs before you deploy. The community deserves rigorous design. Learn More: duende.link/bpicb #aspnet #dotnet

Stability is a community asset. Aligning with the Microsoft LTS schedule provides a shared timeline for the industry. We can all plan, budget, and coordinate releases together. Predictability helps the whole community function better. Learn more: duende.link/bpicb #aspnet #dotnet #LTS

The Big Picture

An overview of modern application architecture patterns and how OpenID Connect and OAuth 2.0 protocols implemented by IdentityServer solve authentication and API access challenges

duende.link

No more overprivileged access tokens? 🔑 Implement strict trust boundaries in your APIs with resource isolation (#OAuth RFC 8707). Learn how to configure it in Duende IdentityServer: duende.link/87qt2j #dotnet

Implementing Zero Trust with Resource Isolation

Learn how to enforce strict trust boundaries between your APIs and prevent overprivileged access tokens by adopting Resource Isolation, based on OAuth 2.0's RFC 8707, with Duende IdentityServer.

duende.link

In this video, we look deeper into critical security-related HTTP headers that can significantly strengthen your website's defenses. Expect X-Content-Type-Options, Referrer-Policy:, X-FRAME-OPTIONS, Content Security Policy (CSP), ... youtu.be/OztgrdMQG94 #dotnet #aspnetcore #SecurityTips

MORE Essential HTTP Headers

In this video, we look deeper into critical security-related HTTP headers that can significantly strengthen your website's defenses. What you'll learn in this video: * X-Content-Type-Options:…

youtu.be

SaaS providers are black boxes. Duende gives you full source access. Step-through to understand exactly how it all works. Learn More: duende.link/2swrhhw #aspnet #aspnetcore #dotnet

Duende IdentityServer

The most flexible and standards-compliant OpenID Connect and OAuth framework for ASP.NET Core.

duende.link

Supply chain something something... not an issue - all focus back on AI!

Maarten Balliauw@maartenballiauw.be · 7mo ago

Submitted 2 security issues to NuGet and GitHub last year, finally heard back that they are low priority and not a big deal. I did manage to publish this package to NuGet. A bunch of unicode in there, but it looks genuine, right? Nobody would discover this via search because of the unicode.