OpenID Connect

Authenticate service-to-service API calls

Explains API keys, client credentials, managed identity, mTLS, scopes, rotation, and per-client observability.

Authentication vs authorization in ASP.NET Core APIs

Separates identity establishment from permission decisions and applies ASP.NET Core schemes, policies, tenant boundaries, ownership checks, and correct challenge or forbid behavior.

Compare access tokens and refresh tokens

Explains short-lived access tokens, refresh-token rotation, revocation, storage choices, and replay detection.

Debug 401 vs 403 failures in ASP.NET Core APIs

Debugs ASP.NET Core authentication challenges and authorization forbids across schemes, token validation, policies, claims, tenants, and resource checks.

Investigate a spike in authentication failures

Explains how to diagnose 401/403 spikes across token validation, identity provider issues, clock skew, deployment changes, and abuse.

OAuth 2.0, OpenID Connect, and authorization code with PKCE

Separates OAuth authorization from OpenID Connect authentication and explains why modern interactive clients use authorization code with PKCE.

API Security & Auth

Authentication, authorization, tokens, tenant boundaries, and API protection.

A practical API security track covering login flows, JWT validation, refresh tokens, session revocation, external identity providers, roles and capabilities, resource ownership, tenant isolation, policy authorization, admin audit, stale claims, service-to-service auth, CORS, CSRF, rate limiting, overposting, safe errors, secrets, and browser-facing security controls.