Security in ASP.NET Core 2.0
summary
ASP.NET Core 2.0 tightens hosting and identity: Kestrel selects HTTPS certificates by subject and expiry and is supported on the edge though an upstream proxy is still recommended; authentication consolidates into a single authentication middleware with schemes, cookies gain validators and optional sign‑out‑everywhere behavior, and the roadmap moves local accounts to OpenID Connect (swap to Azure AD B2C or IdentityServer with one line). Data protection rotates keys by default (every three months) and supports stores like Azure Key Vault and files, while authorization uses policy/requirement/handler DI patterns and resource‑based checks.
AI-written summary · about
chapters (16)
- 0:00Start
- 4:55Kestrel Security Configuration
- 7:06Authentication Options in ASP.NET Core
- 7:56Individual User Accounts v2.1
- 11:19Template Authentication Individual User Accounts
- 21:17ASPNET Core 2.0 Changes
- 26:19Potential Identity changes yet to come Last login time Support for identity outside of ASPNET Core
- 31:50Custom Authentication Handlers
- 34:03Data Protection One stop shop for encryption
- 37:55Using Data Protection
- 38:46Purpose Strings
- 39:20Configuring Data Protection
- 39:59Implementing a key store
- 52:21What should a handler return?
- 54:01Resource Based Authorization
- 54:58Adjusting your views
related talks
40mSecurity in ASP.NET Core 2.1
01h 01mSecurity in ASP.NET Core 2.0
01h 04mSecurity in ASP.NET Core 2.1
52mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
01h 01mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
53mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
54mASP.NET Core Meets Owasp Top 10