Security in ASP.NET Core 2.0
summary
Kestrel now supports HTTPS and Visual Studio can issue self‑signed certs; running Kestrel on the edge is supported but not recommended. Authentication becomes a single service with configurable handlers: cookie sign‑in, validators that revalidate identities, and explicit default schemes so APIs don’t accept cookies by mistake. Authorization uses policy/requirement/handler model and supports resource‑based checks. DataProtection uses a keyring that rotates master keys every 90 days and supports stores like Redis, DB, blob or Azure Key Vault. Templates add Authenticator apps for 2FA instead of SMS.
AI-written summary · about
chapters (33)
- 0:00Introduction
- 1:22Overview
- 1:40Hosting
- 3:13Limits
- 4:45Authentication
- 5:52Template Off
- 12:50Authentication Handlers
- 13:54Cookies
- 14:19Context Authentication
- 14:51Identity Cookies
- 16:09Sign in and sign out
- 16:20Validator
- 17:24Demo
- 20:24Multiple handlers
- 21:07OpenID Connect
- 24:08Options
- 24:21Authorization
- 26:45Requirements
- 29:17Policy
- 30:06Demo of Policy
- 33:37Ginger
- 40:10Summary
- 40:20Handler
- 40:31Authorization Service
- 41:42Resource Based Authorization
- 44:57Custom Parameters
- 45:27Data Protection
- 51:29Configuration Points
- 52:33Configuration Services
- 53:17Certificate
- 53:50Backing Store
- 54:09Cookie Sharing
- 57:23CSRF Validation
related talks
58mSecurity in ASP.NET Core 2.0
40mSecurity in ASP.NET Core 2.1
01h 04mSecurity in ASP.NET Core 2.1
01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
52mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
53mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
39mA guided tour of ASP.NET core security
54mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0