Wesley Cabus

🔐 Let’s talk authentication! Join us September 29 in Essen for our next #VISUG meetup with Wesley Cabus and Maarten Balliauw. Two talks on ASP.NET Core Authentication and Passkeys, plus food & drinks. And yes, it’s free! 🍕🥤 #VISUG #ASPNETCore #DotNet #Community

We've published guidance on the high-severity #aspnetcore Data Protection vulnerability, CVE-2026-40372 (Elevation of Privilege) Read our guide to: * Determine if your applications are affected * Get mitigation steps 👉️ duende.link/twe5wp #dotnet

.NET has an out of band update today to fix CVE-2026-40372, an Elevation of Privilege, which, in some cases, could allow an attacker to forge authentication tickets, or decode authentication tickets or other protected data. github.com/dotnet/annou...

Security you can’t prove isn’t security, it’s hope. Stop relying on manual checks. We’re showing you how to automate your security testing to ensure your API only accepts your trusted tokens. 🔗 March 3rd. Be there: duende.link/lsjwt26b #OAuth2 #JWT #DotNet

*Are you sure your access tokens are really secure?* by @gotsharp.be is a really great talk that exposes common validation mistakes that let attackers use forged tokens and explains how to prevent them. @ndcconferences.com youtube.com/watch?v=Jc1D...

I took some time over the holidays to hack on an idea of a documentation for .NET solutions. There are so many things that can be done, but the first step is to make what already exists available: NuDoc.NET creates cross-linked reference docs for any package on Nuget.org nudoc.net/Docs/Sustain...

Claims and scopes describe user information in OpenID Connect. Let's see how Duende IdentityServer handles consent, different client types, required vs. optional scopes, and what happens when a client doesn't get everything it asked for. duende.link/97aeqlj 👀 #dotnet

Shape the future of Duende products! Early Access!! Deep Collaboration!!! Better Security and Identity!!!! Apply Now for Duende Product Insiders! duende.link/discord #dotnet #security #identity

Why Now is an Excellent Time for Backend For Frontend Learn more about Duende's BFFv4 here -> duendesoftware.com/blog/2025120... #dotnet #security #identity #bff #react #angular #vue.js

We built our own JWT Decoder tool - jwt.me! 🧐 Quickly inspect and validate your JSON Web Tokens. It features automatic public key (JWK) retrieval, inline claim explanations, and presenter mode. Read all about it: duende.link/387skhq #dotnet

LAST CALL! 🚨 Launch livestream starts soon (Dec 2nd)! Learn how Duende IdentityServer v7.4 secures enterprises implementing MCP with RFC 8414, and how to adopt .NET 10 LTS to deliver critical security features. Register here ➡️ duendesoftware.com/webinars/due... #dotnet #security #mcp

It’s VisugXL week! That’s all. That’s the post. 😎 Make sure to grab your tickets now (only a few seats left) 👉 www.visug.be/Events/102

Worked on a good longread: simplify your identity mess! Learn how a Federation Gateway orchestrates all your IdPs (Entra ID, Google, SAML). Must-read architecture deep dive! duende.link/8aefizq #IdentityOrchestration #SSO #Security #dotnet

It’s VisugXL week! 🎉 Thanks to our amazing partners, we we can keep this event completely FREE! And guess what? There are still some seats left! Grab yours now! 👉 www.visug.be/Events/102

December 2nd is #VISUG time! 🎉 Join us at ChipSoft in Antwerp as we’re diving into distributed coordination (aka “chaos but make it elegant”) and Infrastructure as Code (aka “stop clicking around in portals like it’s 2009”). Grab your FREE ticket 👉 www.visug.be/Events/105

In this video, Christian Wenz dives deep into Cross-Site Request Forgery (CSRF), a simple yet devastating attack that has plagued web applications for years. Learn what CSRF is, how it works, and how to defend against it in #aspnetcore youtu.be/WUJrKw05YfI #dotnet

🎤 Meet one of our VISUG XL 2025 speakers: 𝐒𝐡𝐚𝐮𝐧 𝐋𝐚𝐰𝐫𝐞𝐧𝐜𝐞! We’re excited to welcome 𝐒𝐡𝐚𝐮𝐧 this year at Visug XL, our yearly, free, community-driven .NET conference. 📅 November 28, 2025 📍 UCLL Leuven 👉 More information and tickets: www.visug.be/Events/102 #VisugXL #DotNet #Community #Conference

Claims and scopes describe user information in OpenID Connect. Let's see how Duende IdentityServer handles consent, different client types, required vs. optional scopes, and what happens when a client doesn't get everything it asked for. duende.link/97aeqlj 👀 #dotnet #aspnetcore

Pssst... We at VISUG know it's "Herfstvakantie" and how challenging it can be with the kids. 🤪 So, here's a escape for all the parents out there: this Thursday at Spoor 18 in Mechelen, we've got food, drinks and sessions! (Not looking for an escape? You're welcome as well 😉) www.visug.be/Events/104

Adding .NET 10 Passkey Support to Duende IdentityServer 👉 duende.link/berqe86 Learn how to add #dotnet 10 passkey support to a non-Blazor project such as MVC or Razor Pages. #security #aspnetcore #identity #webauthn

Our next livestream with Active Solution is coming up soon! Custom Authentication in #aspdotnet Core Go beyond the built-in authentication handlers in ASP.NET and learn about a RemoteAuthenticationHandler. Register 👉 t.co/jgxpGooTE7 #dotnet #security #identity

🎤 Meet one of our VISUG XL 2025 speakers: 𝐀𝐧𝐣𝐮𝐥𝐢 𝐉𝐡𝐚𝐤𝐫𝐲! We’re excited to welcome 𝐀𝐧𝐣𝐮𝐥𝐢 this year at Visug XL, our yearly, free, community-driven .NET conference. 📅 November 28, 2025 📍 UCLL Leuven 👉 More information and tickets: www.visug.be/Events/102 #VisugXL #DotNet #Community #Conference

The server's origin is used to generate passkey credentials, making them resistant to phishing. A credential signed for one app can't be used elsewhere. What about subdomains? Or multiple domains? In this post, we'll explore some options. duende.link/igeq87f #dotnet #security #passkeys #webauthn

We're happy to start sponsoring the Spectre.Console project! It is a #dotnet library that makes it easier to create beautiful console applications by giving you access to standard components you may find in a CLI experience. Go check it out! duende.link/sp3ctr3

Say goodbye ✋ to passwords, and hello 👋 to secure, phishing-resistant logins: passkey credentials. Part 1 of our 4-part blog series covers password and authentication evolution. Longread ahead! 👀 duende.link/p455k3y #passkeys #webauthn #dotnet #security #aspnetcore

Discover a key update in #dotnet 10 that improves local development! 🔥 In this blog post, we explain how a new TLS certificate and unique local domains can solve cookie conflicts and better mimic production environments. duende.link/arbgu89 #aspnetcore #security

Let's explore the world of OpenID Connect with a focus on claims, scopes, and how Duende IdentityServer facilitates authentication in #dotnet applications. Learn how apps request necessary claim information! 👩🏼‍🏫 duende.link/j28b2bw #security #identity #aspnetcore

Brace yourself, w̶i̶n̶t̶e̶r̶ #dotnet 10 is coming! ⛄️ Let's look at the new capabilities and features we are excited about for the upcoming .NET release in November. Expect passkeys, #opentelemetry additions,TLS for *.localhost, and more. 👀 duende.link/qet4wp9 #aspnetcore

Roland's video series continues! Let's see how to protect SPAs with OpenID Connect created with libraries like #Angular and #React or plain javascript. We'll see why you want to use a BFF & how this pattern makes secure API access less cumbersome youtu.be/pSTMCyQH_E4 #dotnet #identity #aspnetcore

HttpClient is at the heart of many projects. DelegatingHandlers let you intercept and modify requests and responses, extending base functionality. In this blog post, we'll look at DelegatingHandler and how it can make HttpClient even more powerful! 💪 duende.link/78qe4kj #dotnet #aspnetcore

We're hiring! At @duendesoftware.com, we're looking for someone to join our Customer Success team. It's a 100% remote position but we are looking for someone based in the US East Coast region for time zone reasons. If you're interested, visit duendesoftware.com/careers/cust... for details! #hiring

Holy moly! Lervig has some crazy beers in their rack house line!

How to test your #IdentityServer? In this post, we demonstrate how to setup and run automated tests with your favorite test framework. #mstest #xunit #nunit #dotnet #security duende.link/a4rs979

What are Best Practices of Web Application Security in 2025? This post focuses on key security and authentication flows using OAuth 2.0 and OpenID Connect, flows to avoid, security measures to implement, and IETF Best Current Practices. duende.link/iyqe3fk #security #dotnet

Fresh post on external providers in #aspnetcore We cover initial setup, the connection between external and cookie authentication, and discusses why alternatives might be better for production apps. duende.link/q24tubs #security #identity #dotnet

Coming to an ASP.NET Core HTTPS development certificate near you soon...

Check out the freshly deployed IdentityServer 7.3.0 Release Candidate 1. It brings FAPI 2.0 profile certification, JWT response from the introspection endpoint, diagnostics data, OpenTelemetry updates, and more! duende.link/is73rc1 #dotnet #security

The agenda for #CloudBrew is ready! Why not join us in December? Early Bird tickets are now also available! 👉 www.cloudbrew.be #dotnet #azure

How I got involved in the Backend for Frontend (BFF) spec? @philippederyck.bsky.social built a demo to show how insecure single-page applications can be! Full interview: youtu.be/urS9wstmN2U More on Backend for Frontend: duende.link/bff #dotnet #security #bff #oauth2

The #dotnet 8.0.17 upgrade fixed validation of forwarded headers and proxy server configuration in load balanced scenarios. Great! Or not 🤔 This patch may affect your #aspnetcore app. 😱 Check our blog post for background and fix: duende.link/0mgnet8

Got a killer dev talk? Bring it to the stage at VisugXL 2025! 🎤 We’re talking .NET, Azure, OSS, real-world code — the good stuff. 📅 Nov 28 – Leuven, Belgium Hit us with your best shot 👉 sessionize.com/visugxl-2025 #VisugXL2025 #CallForSpeakers #dotnet #Azure #DevRockstars

Terms like "client" in OpenID Connect and OAuth 2.0 are clear for security folks, but non-technical people are sometimes confused. In this post, let's clarify what a "client" means in application security. duende.link/m8tyde4 #dotnet #security #identity

Me while I'm waiting for my Keychron keyboard order status to switch to "shipped".

WiFi 7 🏎️💨!

Cheers to the weekend 🍻