.NET Rocks Live

on YouTube ↗50m

" summary

Practical answers for real integration: desktop apps achieve single sign‑on by launching the system browser SSO (GitHub for Windows example) so shared cookies return tokens; headless devices use the device flow (e.g., Nintendo Switch pattern); APIs can require mutual TLS plus sender‑constrained access tokens for device identity (medical scenario); PKCE mitigates code‑substitution attacks; updated JavaScript guidance and CSP advice reduce token leakage; IdentityServer shows 157 contributors and Microsoft is shipping zero‑config identity templates in .NET Core preview.

AI-written summary · about

" chapters (8)

1. 0:00Start
2. 17:29What Makes Spa's Different from a Security Context
3. 20:39Injection Attacks
4. 20:57Cross-Site Scripting
5. 21:17Content Injection
6. 24:42Turn Off Inline Javascript
7. 27:37Substitution Attacks
8. 46:26Distributed Identity Foundation

" related talks

• 39mSecuring your apps with OAuth2 and OpenID ConnectRoland Guijt · Codemotion Rome 2015
• 59mThe whirlwind tour of Authentication and Authorization with ASP.NET CoreChris Klug · NDC Minnesota 2018
• 54mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Dominick Baier · NDC London 2019
• 51mAuthentication and Authorization in ASP.NET Core 2Roland Guijt · Update Conference Prague 2018
• 45mOAuth and beyond: Modern auth not only for the webFilip Koňařík, Dušan Jakub · GeeCON Prague 2023
• 01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Brock Allen · NDC Minnesota 2019
• 58mBuilding JavaScript and mobile/native Clients for Token-based ArchitecturesDominick Baier, Brock Allen · NDC London 2017
• 58mSecurity in ASP.NET Core 2.0Barry Dorrans · NDC Oslo 2017