Security in ASP.NET Core 2.1

on YouTube ↗40m

" summary

Covers concrete security changes in ASP.NET Core 1.0→2.1 and what's coming in 3.0: Kestrel ships HTTPS by default with dotnet dev-certs and SNI support, HSTS defaults to 30 days, guidance to keep Kestrel behind a proxy, and patch cadence of about a month. Authentication moves to a unified service with cookie validators, virtual schemes and forwarding, built‑in Azure B2C and IdentityServer templates coming after 2.2, data protection key rings for shared keys, resource‑based authorization handlers, and GDPR cookie consent and 2FA via authenticator apps.

AI-written summary · about

" chapters (20)

1. 0:00Intro
2. 2:32Kestrel security HTTPS by default
3. 4:12SNI certification selection
4. 5:00Kestrel Security Configuration
5. 7:06HSTS caveats HSTS is dangerous
6. 9:06Authentication Options in ASPNET Core Template Support
7. 10:41Individual User Accounts v2.1 Local Database
8. 11:38Template Authentication Individual User Accounts
9. 12:58ASPNET Core 1.x Authentication No more custom identity classes Multiple authentication middleware
10. 14:12ASPNET Core 2.0 Changes Authentication is now a single service
11. 14:52Adding an authentication service
12. 15:36Do it yourself Cookie Authentication
13. 16:29Configuring cookie middleware
14. 16:50Do it yourself Caveats
15. 18:03Picking auth at runtime Virtual schemes and authentication forwarding
16. 20:59API Authentication The missing link
17. 25:09Data Protection One stop shop for encryption
18. 26:51Using Data Protection
19. 33:57What should a handler return? Successful Evaluation
20. 34:39Imperative Checks Evaluate your policies in code

" related talks

• 01h 04mSecurity in ASP.NET Core 2.1Barry Dorrans · NDC Sydney 2018
• 58mSecurity in ASP.NET Core 2.0Barry Dorrans · NDC Oslo 2017
• 01h 01mSecurity in ASP.NET Core 2.0Barry Dorrans · NDC Sydney 2017
• 01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Brock Allen · NDC Minnesota 2019
• 52mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Dominick Baier · NDC Copenhagen 2019
• 01h 01mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Dominick Baier · NDC Security Oslo 2019
• 53mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Dominick Baier, Brock Allen · NDC Porto 2019
• 39mA guided tour of ASP.NET core securityAnders Abel · Øredev 2016