Security in ASP.NET Core 2.1

on YouTube ↗01h 04m

" summary

ASP.NET Core 2.1 turns on HTTPS by default and adds a dotnet dev-certs tool, Kestrel supports SNI and certificate selection/rotation, and HSTS is enabled with stepwise max-age guidance; cookie authentication and data protection use key rings with configurable stores (Azure Blob, SQL, Redis) and automatic rotation; policy-based authorization uses requirement handlers and DI; a prototype IdentityServer embedded flow issues JWTs to SPA/local storage and calls APIs, with full IdentityServer integration planned shortly after 2.1.

AI-written summary · about

" chapters (29)

1. 0:00Intro
2. 1:37Kestrel security HTTPS by default
3. 4:07Certificate Config
4. 4:38SNI certification selection
5. 5:12Kestrel Security Configuration
6. 7:02HSTS caveats
7. 12:59Authentication Options in ASPNET Core Template Support
8. 14:28Individual User Accounts v2.1 Local Database
9. 15:32Template Authentication Individual User Accounts
10. 17:08ASPNET Core Authentication No more custom identity classes
11. 18:27ASPNET Core 20 Changes Authentication is now a single service
12. 21:42Do it yourself Cookie Authentication
13. 22:42Configuring cookie middleware
14. 24:55Implementing a validator
15. 25:16Authentication forwarding
16. 28:06Virtual Schemes
17. 28:56API Authentication The missing link
18. 39:01Data Protection One stop shop for encryption
19. 43:16Using Data Protection
20. 44:24Purpose Strings Their purpose
21. 45:31Configuring Data Protection Configuration Points
22. 46:15Implementing a key store IXmlRepository
23. 46:32Authorization Goal
24. 54:16Policies, Requirements & Handlers
25. 55:41Imperative Checks Evaluate your policies in code
26. 56:05Things to remember Register your handlers in DI
27. 56:26Resource Based Authorization Acting on a resource or model
28. 56:51Resource Authorization Handlers
29. 58:10Identity Features Packaged Uls

" related talks

• 40mSecurity in ASP.NET Core 2.1Barry Dorrans · Øredev 2018
• 58mSecurity in ASP.NET Core 2.0Barry Dorrans · NDC Oslo 2017
• 01h 01mSecurity in ASP.NET Core 2.0Barry Dorrans · NDC Sydney 2017
• 01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Brock Allen · NDC Minnesota 2019
• 52mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Dominick Baier · NDC Copenhagen 2019
• 53mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Dominick Baier, Brock Allen · NDC Porto 2019
• 01h 01mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Dominick Baier · NDC Security Oslo 2019
• 54mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Dominick Baier · NDC London 2019