Tore Nestenius

Model Context Protocol (MCP) servers are becoming a key part of how Claude Code extends its capabilities.

Ever wondered what Claude Code is actually doing while it works?

I’m excited to introduce you to the Coding Agent Explorer, a new open-source .NET teaching tool I’ve created that lets you see exactly what happens under the hood when an AI coding agent works on your code.

Duende IdentityServer is the leading OpenID Connect and OAuth 2 server for .NET.

In the previous blog posts in this series, we built our own Backend-for-Frontend (BFF) implementation in ASP.NET Core from scratch.

In this post, we take the next step in securing our Backend-for-Frontend (BFF) by adding robust Cross-Origin Resource Sharing (CORS) protection.

Nobody wants to sign in every hour.

In this blog post, we’ll implement a minimal yet complete Backend-for-Frontend (BFF) in ASP.NET Core.

The BFF pattern eliminates many SPA security risks, but it introduces a new critical component: the session cookie.

How do you secure a Single-Page Application without storing tokens in the browser?

This multi-part blog series will show you how to implement secure authentication for Single-Page Applications using the Backend-for-Frontend (BFF) pattern with ASP.NET Core.

In this blog post, you will learn how to deploy a test instance of KurrentDB to Azure and access it from a console application in .NET.

In my previous blog post, I explained what the Forwarded Headers Middleware does and why it matters.

Proxies are vital for load balancing and security, but they obscure the actual client IP, scheme, and domain, causing broken links, inaccurate logging, and other headaches.

In ASP.NET Core 9, a new feature called AdditionalAuthorizationParameters allows you to customize OAuth and OpenID Connect (OIDC) flows more quickly.

In this final post in this series, we’ll now resolve logout challenges you might run into with IdentityServer, ensure proper sign-out redirects, and summarize the key takeaways from the series.

In this third part of the series, we tackle login issues in IdentityServer caused by cookie restrictions in HTTP and show how to resolve them by implementing HTTPS.

This is part 2 of a blog series on containerizing a Duende IdentityServer and a client application.

Getting Duende IdentityServer and a client application up and running in separate containers can be challenging.

ASP.NET Core 9 introduces support for Pushed Authorization Requests (PAR) in its OpenIdConnect authentication handler.

The Cloud Debugger is an open-source tool for Azure developers to explore, learn, and troubleshoot their Azure cloud environments.

I discovered many interesting Azure features while studying for the AZ-204 certification.

This blog post describes getting Docker up and running inside an Azure Windows Virtual Machine.

In this blog post, I will guide you through deploying a custom container image to Azure App Services from a private container registry using a system-assigned managed identity and the Azure CLI.

This blog post describes my approach to successfully deploying a custom container image to Azure App Services from a private container registry, using a user-assigned managed identity and the Azure CLI.

Exploring and discovering unfamiliar codebases is always a challenge.

The DefaultAzureCredentials is key for using Azure services, but how exactly does it work and when should you use it?

When you’re working with the Data Protection API in ASP.NET, you quickly notice how powerful and simple this service is.

The ASP.NET Core Data Protection API (DPAPI) is an essential service in ASP.NET Core that is often overlooked.

In this blog post, we’ll explore a practical way to enhance the security of your ASP.NET Core applications by reducing the size of authentication cookies.

In the world of web application security, OpenID Connect plays a key role in streamlining authentication processes.

ASP.NET Core generates various types of cookies, such as authentication, antiforgery, and session cookies.

Troubleshooting cookie problems in ASP.NET Core Having answered over 1000 questions on Stack Overflow, I’ve found that cookie-related issues are a frequent challenge for developers using ASP.NET Core, especially when implementing authentication and OpenID…

Microsoft introduced the new BearerToken authentication handler in ASP.NET Core 8 as part of an initiative to streamline and modernize authentication processes.

A common problem when protecting your ASP.NET Core APIs is that expected claims are not found in the user object.

Missing claims in the ClaimsPrincipal user object is a frequent problem when using OpenID Connect authentication in ASP.NET Core.

One of the most frequent questions I encounter on Stack Overflow is how to troubleshoot JwtBearer authentication issues in ASP.NET Core.

Understanding the differences between IdentityResource, ApiResource, and ApiScope in Duende IdentityServer is a common question among developers, often seen on platforms like Stack Overflow.

As a developer and trainer, it is hard to keep up with all the changes in all the libraries.

Introduction Over 30 years ago, I decided to take on the challenge of building my own Sega Mega Drive hardware dev kit from scratch.

Our internal validation library TNValidate is now available as a project on GitHub.