Securing Web Applications and APIs with ASP.NET Core 2.2 and 3.0
summary
ASP.NET Core 2.2/3.0 now ships templates that embed IdentityServer4 in templates and a Microsoft login UI, wiring auth, JWT validation and an API sample that actually issues tokens. The platform implements automatic key rotation for Data Protection (keys stored in user profile by default so a webfarm needs shared storage), enforces SameSite cookie defaults, and shows a real demo where Access Tokens expire after 60 seconds and are kept valid by token refresh via session handler that updates tokens transparently.
AI-written summary · about
chapters (22)
- 0:00Start
- 4:16Modern Application Architecture
- 6:14Hosting
- 8:11Kestrel Security
- 9:27ASP.NET Core Architecture
- 12:17Data Protection in ASP.NET Core
- 18:01Who uses Data Protection?
- 19:20Authentication in ASP.NET Core
- 22:36Setting up authentication
- 23:33Interacting with the authentication system (2)
- 23:50Session Management (1)
- 26:30Advanced Features
- 28:22External Authentication
- 29:20API Authentication
- 38:24Example Authorization Policy
- 39:13Custom Authorization Handler
- 39:39Programmatically using policies
- 39:53Resource-based Authorization
- 40:12Example: Document resource
- 40:34Invoking the authorization handler
- 41:04ASP.NET Identity
- 44:20The missing link
related talks
01h 01mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
53mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
52mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
58mSecurity in ASP.NET Core 2.0
01h 04mImplementing Authentication and Authorization with ASP.NET Core 2
01h 04mSecurity in ASP.NET Core 2.1
51mAuthentication and Authorization in ASP.NET Core 2