Duende Software

A Halloween séance that explains DPoP (RFC 9449): how sender-constrained tokens bind access tokens to a client's key pair so stolen tokens are useless. #dotnet #oauth #oidc duende.link/dpop2026

A stolen bearer token works for anyone. DPoP (RFC 9449) binds every token to the client's private key. No key? No entry 🕯️ Join our Halloween séance 🎃 with the Medium, the Gatekeeper and the Spirit of the Vault 👻 Watch to the end, or read: duende.link/dpop2026

WebAuthn and passkeys in 60 seconds ⏰ Tap “Use your passkey” and WebAuthn uses public-key cryptography, not passwords. The server stores your public key, your private key stays on your device. Duende User Management handles WebAuthn: duende.link/8keq2ui #dotnet #passkeys

Tomorrow at 10 AM! 🚨 Join MS MVP and security author Christian Wenz for a live deep dive into the 2025 OWASP Top 10 for ASP.NET Core and Duende IdentityServer. Last chance to grab your spot: duendesoftware.com/webinars/the...

Explore why C# and .NET are worth learning in 2026. From cross-platform support and amazing tooling to AI integration and a thriving community, discover what makes #dotnet a future-proof technology. duende.link/20oct26

Don't treat all OWASP Top 10 risks as equal. Learn the methodology behind the 2025 list, which risks genuinely apply to ASP.NET Core, and leave with at least one fix you can ship this sprint. Register for Oct 22: duendesoftware.com/webinars/the...

DPoP (RFC 9449) binds an access token to a client-held key, making stolen tokens useless. Built into Duende IdentityServer and Duende.AccessTokenManagement. Read more: duende.link/lgodpop #dotnet #websecurity

The MCP specification now recommends Client ID Metadata Documents (CIMD) over Dynamic Client Registration (DCR). Learn how CIMD avoids orphaned client records on authorization servers. duende.link/12oct26 #dotnet #oauth

The OWASP Top 10 just dropped its first refresh in 4 years. What do the new categories mean for asp.net Core? Find out with Christian Wenz on Oct 22 at 10AM: duendesoftware.com/webinars/the...

Use #Azure workload identity (managed identity) to register OAuth clients at runtime with Dynamic Client Registration in Duende IdentityServer. 👉️ duende.link/06oct26 #dotnet

Don't treat all OWASP Top 10 risks as equal. Learn the methodology behind the 2025 list, which risks genuinely apply to ASP.NET Core, and leave with at least one fix you can ship this sprint. Register for Oct 22: duendesoftware.com/webinars/the...

A practical guide to enforcing fine-grained access control on #dotnet 10 Minimal API endpoints using scope claims in JWTs issued by Duende IdentityServer. ➡️ duende.link/29spt26

That’s a wrap on our FAPI 2.0 livestream! 🚀 Roland, Joe, and Al demonstrated how to protect financial apps against modern attacks by closing security gaps like token replay & URL leaks using PAR, DPoP, and private_key_jwt. 📺️ www.youtube.com/watch?v=OM00...

Tomorrow! Even if you don't need full FAPI 2.0 compliance, you'll leave this livestream with at least ONE architectural change to instantly harden your application security. Join Roland Guijt and Joe DeCock: duendesoftware.com/webinars/how...

Blogged: What #dotnet 11 and C# 15 change for Duende IdentityServer developers: registration confirmation, Blazor and SignalR auth refresh, sessions, and a practical upgrade checklist. duende.link/22spt26

Banks adopted FAPI 2.0 first, but the profile applies anywhere high-value transactions happen. Is your API landscape secure enough? Learn how to harden it here: duendesoftware.com/webinars/how...

FAPI 2.0 enforces least privilege for access tokens so compromises are contained by design. Watch us configure tightly scoped tokens live: duendesoftware.com/webinars/how...

We are officially here at #NDCOslo! 🇳🇴 We hit the ground running today with Maarten taking the stage to give his speech on going passwordless. Such a great start to the week! Come say hi if you're around. 👋

RFC 10017 (BCP 212) makes the Backend for Frontend pattern official IETF best current practice for browser-based OAuth apps. Here's what the RFC recommends and why it matters. duende.link/15spt26 #bff #dotnet #identity

Stop dealing with shared secrets that can be leaked, rotated poorly, or committed to GitHub. Learn how to implement private_key_jwt for asymmetric client authentication in our FAPI 2.0 livestream. 🔑 duendesoftware.com/webinars/how...

We've had 3,600 monthly searches for "Duende"… spelled every way except Duende. 😅 So Al Rodriguez is here to settle how to pronounce it: it's doo-EN-deh. 🎤 You're welcome. (Bloopers in video)

Next week, we’re heading to Norway for NDC Oslo! We can't wait to dive into the sessions and connect with the incredible dev community. Will you be there? Let us know below so we can say hi! 👋 #NDCOslo

Learn how to implement WhatsApp OTP login with Duende IdentityServer and User Management by building a custom IOtpDispatcher that delivers one-time passwords via Meta's WhatsApp Business Cloud API. duende.link/10spt26 #dotnet #identity

Join Anders Abel's workshop on securing asp.net 10 apps. This workshop breaks down Auth Design, Cookie-Based Sessions, SSO, and Account Linking. Learn architectural patterns that actually work: ndcoslo.com/workshops/id... #NDCOslo #NDCOslo2026

Standard OAuth 2.0 is great, but what happens when a stolen token can move money? Learn the threat model behind financial-grade security and why you might need FAPI 2.0. Register for the livestream here: duendesoftware.com/webinars/how...

Blogged: a strategic architecture guide for migrating from OWIN-based IdentityServer3 to modern Duende IdentityServer. duende.link/8s3pt26 #dotnet

Curious how DPoP and mTLS bind a token exclusively to the client that requested it? We are demonstrating it live, end-to-end. Watch the live implementation: duendesoftware.com/webinars/how...

Blogged: Wesley compares three OAuth client authentication methods in ASP.NET Core: Client Secrets, Private Key JWT, and Mutual TLS, with code examples for Duende IdentityServer. duende.link/3s3pt26 #dotnet #oidc #identity

.NET 11 adds automatic CSRF protection that rejects cross-origin browser requests by default. Learn how this impacts SPAs and IdentityServer deployments, and how to prepare your apps. duende.link/1s3pt26 #dotnet

Prevent outages from expired signing keys. 🛡️ Duende IdentityServer’s Automatic Key Management handles the lifecycle natively: 🔹 Generation 🔹 Rotation 🔹 Propagation 🔹 Retirement Zero-downtime rollover. Put your security on autopilot: duendesoftware.com/products/cap...

Learn what TOTP (Time-based One-Time Password) means, how the algorithm works, and how it fits into multi-factor authentication flows. duende.link/97w4iou #dotnet

The next era of Duende is live! 🚀 We're expanding from a token server to identity infrastructure. IdentityServer v8 brings modular Add-Ons (Adopt what you need, when you need). Learn more: duendesoftware.com/products/ide...

Blogged: Learn how to restrict passkey registration to approved hardware security keys like YubiKey using Duende User Management's IAttestationTrustPolicy interface. duende.link/p4k4tta #dotnet #webauthn

IdentityServer v8 brings architectural refinements to modern .NET workloads. 🛠️ Enjoy unified model for OIDC & SAML connected apps, idiomatic cooperative cancellation, and TimeProvider integration. Read the release notes: docs.duendesoftware.com/identityserv...

We’re continuing our web security series with a deep dive into HTTP Strict Transport Security (HSTS) in ASP.NET Core. Learn how to move beyond the defaults, configure production settings, and understand how HSTS preload works. youtu.be/9U10DySH6zg #dotnet #security

Joe DeCock covers three key identity standards milestones from summer 2026: OAuth Identity Chaining reaching Proposed Standard, the Transaction Authorization Challenge draft for human-in-the-loop approval, and Transaction Token chaining across trust domains. duende.link/jhnr982 #identity #dotnet

🛠️ .NET Devs: The MCP RC brings a great DCR update! SEP-837 advises declaring OIDC application_type to validate redirect URIs with precision (e.g., enforcing HTTPS for web). Grab the C# code to implement this easily in our newest post: duendesoftware.com/blog/2026073...

Before writing code, every team needs to answer what identity means for their organization. Learn the core vocabulary and the critical questions that turn 'add auth' from a vague task into an architecture. duende.link/87qegkh #dotnet

The new Model Context Protocol (MCP) RC is stateless! 🚀 No more tracking sessions or sticky load balancers. Deploying MCP servers just got easier. Plus, 6 new SEPs are hardening OAuth security. Read the full architectural breakdown here: duendesoftware.com/blog/2026073...

🛠️ .NET Devs: The MCP RC brings a great DCR update! SEP-837 advises declaring OIDC application_type to validate redirect URIs with precision (e.g., enforcing HTTPS for web). Grab the C# code to implement this easily in our newest post: duendesoftware.com/blog/2026073...

Heading to #NDCOslo! 🇳🇴 Visit the Duende Software booth to talk identity & security! Catch our sessions: 🎤 Anders (Sustainsys): ASP.NET Core meets OWASP Top 10 2025 🎤 Maarten Balliauw: Going Passwordless - A Practical Guide to Passkeys in ASP.NET Core See you there! ✨

A practical guide to choosing session and token lifetimes in Duende IdentityServer. Learn how to align your security configuration with your specific risk profile. duende.link/87qkhaq #dotnet

Adopting new AI protocols? For Duende IdentityServer users, the new MCP RC is smooth sailing. 😌 The heavy lifting for the 6 new OAuth security SEPs is largely built-in. We recommend just one quick C# tweak for DCR. See how to get MCP-ready: duendesoftware.com/blog/2026073...

Want to ensure your web app is always served over HTTPS? 🔒 In our latest episode, we look at enforcing transport security to secure your traffic in ASP.NET Core using UseHttpsRedirection() and the more robust UseHsts(). Watch here: youtu.be/oIwdoscInWw #aspnetcore #WebSecurity #dotnet

Blogged: How to implement passkeys with IdentityServer, including ceremony endpoints, progressive onboarding, and deployment considerations. duende.link/8keq2ui #webauthn #dotnet #passkey

While OpenID Connect (OIDC) is the "cool kid" of modern web development, SAML remains the bedrock of the enterprise world. Our new SAML 2.0 Add-On lets you bridge OIDC and SAML (IdP and SP) in one identity solution Watch the deep dive: www.youtube.com/watch?v=o_tG...

The future of .NET identity is here. 🚀 Hear from the architects shaping the ecosystem. The Duende leadership team dives into ISv8, modular add-ons, and our commitment to expanding identity infrastructure. 📺 Watch the full walkthrough: www.youtube.com/watch?v=qloC...

Putting our game face on 🎮 Learn how to authenticate players in Godot 4 game engine using OAuth 2.0 and OpenID Connect with IdentityServer. Also covering approaches for consoles and limited-input devices. duende.link/u7q4kjm #dotnet

Are your AI agents vulnerable to mix-up attacks? The new MCP RC introduces SEP-2468 to definitively identify Authorization Servers & stop bad actors. Good news: Duende IdentityServer users are already protected by default! 🛡️ Dive deep here: duendesoftware.com/blog/2026073...

"P@ssw0rd1!" passes every password complexity rule, but it's in 100K+ data breaches. 🚨 Complexity ≠ Security. Learn how to integrate the Have I Been Pwned API with Duende User Management to automatically reject compromised passwords at registration. 🛡️👇 duendesoftware.com/blog/2026072...