Securing Web Applications and APIs with ASP.NET Core 2.2 and 3.0
summary
ASP.NET Core 2.2/3.0 ships concrete security pieces: the data protection API that moves key material out of app directories and auto-rotates keys every 90 days; cookie-based session management with optional Redis backing and events to refresh or revoke access tokens; built-in handlers for OpenID Connect, JWT bearer, and introspection; user management via ASP.NET Identity; and the new zero‑config experience with IdentityServer4 in templates for SPA/API scenarios. Authorization uses policy and resource-based authorization with testable handlers and DI-friendly requirements.
AI-written summary · about
chapters (26)
- 0:00Intro
- 2:58How many options actually work
- 4:01Never write a book
- 4:34Modern applications
- 6:51Start from the ground up
- 7:05Hosting
- 8:53Kestrel
- 10:04Runtime
- 11:03Machine Key
- 12:25Data Protection API
- 17:14Authentication System
- 20:16Session Management
- 22:10Cookie Handler
- 24:09External Authentication
- 25:04OpenBody Connect
- 25:37API of Indication
- 26:22Demo
- 33:30Authorization
- 35:51Policy
- 36:42Authorization System
- 37:49Claims
- 38:34Requirement
- 39:29Resource Based Authorization
- 39:59Authorization Handlers
- 40:20Authorization Rules
- 42:31ASPNET Identity
related talks
01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
01h 01mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
53mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
54mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
58mSecurity in ASP.NET Core 2.0
40mSecurity in ASP.NET Core 2.1
39mA guided tour of ASP.NET core security
01h 04mSecurity in ASP.NET Core 2.1