Scott Brady - scottbrady.io

Learn how Evilginx can phish common multi-factor authentication implementations, and how you can defeat it using FIDO2.

Give your ASP.NET 4.x apps a refresh with the latest OWIN updates and Proof Key for Code Exchange

A nostalgic review of what I got up to in 2019 and plans for 2020.

How to implement custom signing algorithms for JWT validation in .NET Core, with examples using ES256K and Bouncy Castle.

Cheat sheet for using Nimbus JOSE + JWT to create signing keys, generate signed JWTs, and verify JWT signatures.

Getting started with mkcert for IIS TLS certificates and ASP.NET Core client certificate authentication

New Pluralsight course on all things user authentication and how to implement them in ASP.NET Core

A look at the new RSASSA-PSS support in .NET Core and what benefits it has over RSASSA-PKCS1-v1_5

A primer on Sign in with Apple, including an example integration in ASP.NET Core.

Why you should use SAML's SP-initiated SSO rather than Idp-initiated SSO and unsolicited SAML responses.

How to roll your own SRP client and server using C# and .NET Core

How to encrypt identity tokens in IdentityServer4 and decrypt them in ASP.NET Core.

How to generate a cryptographically random string in Dart, suitable for OAuth and OpenID Connect usage

Implementing and breaking XOR-based versions of the Caesar and Vigenère Ciphers in C# and .NET.

Implementing your own Base64 encoder, dealing with hex strings, bit handling, and sextets.

My solutions to the Cryptopals Crypto (Cryptography) Challenges using C# and .NET.

Implementing OAuth support in Ktor & Kotlin to get access tokens from IdentityServer4

A rebuttal to Okta's 'Nobody Cares About OAuth or OpenID Connect', advocating the education and involvement of developers with OAuth and OpenID Connect.

A cheat sheet for choosing the right way to securely access an API when using a browser-based application such as a JavaScript SPA.

How to add support for PKCE to your ASP.NET Core OpenID Connect client application.

Learn how to encrypt JSON Web Tokens with JSON Web Encryption in C#, .NET, and ASP.NET Core.

Migrating your oidc-client-js SPA from the OpenID Connect implicit flow to authorization code flow with PKCE.

A look at the advantages and disadvantages of using software tokens as an authentication factor, focussing on TOTP.

A brief review of what I've been up to since 2016, including plans for 2019.

How to keep your DBA happy by implementing your own IdentityServer4 data store.

Removing application passwords from OAuth by using JWT Bearer Tokens, including ASP.NET Core and IdentityServer4 usage.

How to handle delegation scenarios using OAuth Token Exchange, for use with microservices and API gateways.

It's not the identity provider, it's you.

Announcing my new Pluralsight course, in which we take a look at OAuth 2.0, the gold standard for API authorization.

Recording from .NET South West looking at how to protect an Angular application using OpenID Connect

An introduction to IdentityManager2, including ASP.NET Core Identity, and IdentityServer4 integration.

Getting to grips with FIDO2 and WebAuthn, including a basic implementation in ASP.NET Core

How to keep your Swagger UI test tool working after protecting your API using IdentityServer 4 (OAuth).

A cautionary tale of reinventing the wheel and history repeating itself in the name of blockchain

The reasons why OAuth is not an authentication protocol, and why without using open standards such as OpenID Connect, should not be hacked to become one.

One of the few legitimate uses for the ROPC grant type is for browserless devices.

How to use passwordless authentication via one-time, user specific login links sent via email.

Integrating with Civic SIP using an ASP.NET Core web application

A technical review of the Civic SIP, from the perspective of an identity and authentication professional

How to sign and verify a JSON Web Token (JWT) using Elliptic Curve Digital Signature Algorithms (ECDSA) in .NET Core

Verifying JSON Web Tokens usng the Java-JWT library and protecting access to a Ktor API

Getting to grips with Kotlin using OAuth client credentials and API requests

Understanding silent refresh and how to implement it using Angular CLI and oidc-client

Learn how password hashing works in ASP.NET Core Identity and how to secure the default implementation or improve it using bcrypt or Argon2 with a secure migration.

Learn why you should not use OAuth's Resource Owner Password Credentials (ROPC) grant.

How to add authentication to an Angular SPA using the oidc-client OpenID Connect client library

Tutorial for getting the node oidc-provider library up and running.

The previous alternatives to OAuth and authorizing access to an API and why we no longer use them.

How to use IdentityServer with WS-Federation as a Trusted Identity Provider in SharePoint 2013.

Configuring ASP.NET Core application settings when running within Docker containers