Maarten Balliauw {blog}
RSS FeedRecent Posts
-
PartitionKey and RowKey in Azure Table Storage explained
Updated:PartitionKey picks the partition and RowKey identifies an entity within it. How to choose both in Azure Table Storage and Cosmos DB for Table, with C# code.
-
ValidateAntiForgeryToken in ASP.NET Core: unit test for it
Updated:How to validate an anti forgery token in ASP.NET Core with [ValidateAntiForgeryToken], and unit test that every POST action has it, plus Rider navigation.
-
Call for Papers meaning: what happens after you submit
Updated:A call for papers (CFP) invites speakers to submit talks to a conference. Here is what happens after you submit, from committee to acceptance or rejection.
-
Run Azurite storage emulator in Docker with Rider
Updated:Run the Azurite storage emulator in Docker, keep blobs and queues local to each solution with a volume mount, and start it from a Rider run configuration.
-
Server-Timing Headers in ASP.NET Core: Backend Metrics in Browser DevTools
The Network tab in browser DevTools tells you quite a bit about a request, including how long DNS resolution and the TLS handshake took. The time waiting for the server is less helpful. There is a bar labeled “Waiting for server response”, but no indication of whether the application was waiting for a database query or calling another API. With the Server-Timing response header, an application can include its own measurements. Chrome, Edge, and Firefox display these alongside the timings the browser already collects.
-
Device Bound Session Credentials in ASP.NET Core
Updated:A session cookie is a bearer token, which is a polite way of saying that whoever holds it is you. Copy the cookie, replay it from another machine, and the server happily serves your account. Nothing about the request proves which device it came from, so a cookie lifted by malware, an XSS payload, or a stray database backup keeps working until it expires. For a long-lived session, that can be weeks.
-
System.Text.Json Polymorphic Deserialization
Updated:Deserialize JSON into derived or abstract types: $type discriminators, [JsonPolymorphic] in .NET 7+, and a custom JsonConverter for legacy payloads.
-
Mastodon on your own domain without hosting a server
Updated:I wanted a Mastodon address on my own domain without running a server. The trick is WebFinger: serve your Mastodon instance’s WebFinger JSON at /.well-known/webfinger on your domain, and @you@yourdomain resolves to your existing account. I use it as a forwarding address that survives switching servers. Updated October 2026: Mastodon and the instances running it have changed since 2022, so the UI may not match what you see in the screenshots or my descriptions. The WebFinger part works the same way.
-
Fix CS8618 Nullable Warnings in C# JSON Models
Updated:Fix CS8618 non-nullable property warnings in C# JSON DTOs: compare nullable properties, constructors, default values and required, and why default! is risky.
-
What is IdentityServer and When Do You Need it?
Updated:IdentityServer is a .NET SDK for building an OpenID Connect and OAuth 2.0 identity provider on ASP.NET Core, issuing tokens to multiple clients and APIs. You need it for several apps or APIs, single sign-on, federation, or standards-based tokens. A single app with local users doesn’t; ASP.NET Core Identity suffices.