latest
Nov 10, 2026 · 12 min
UTCP vs MCP: what happens to agent auth without a server in the middle?
What MCP authorization looks like when AI agents call APIs directly, and whether agent auth still needs DCR or CIMD.
Read it →recent
- Server-Timing Headers in ASP.NET Core: Backend Metrics in Browser DevTools Add Server-Timing headers to an ASP.NET Core app so database and API timings show up in Chrome, Edge and Firefox DevTools next to the request.
- Device Bound Session Credentials in ASP.NET Core Device Bound Session Credentials tie a session cookie to a private key on the device, so stolen cookies go stale. How DBSC works, and why .NET 11 dropped it.
- What is IdentityServer and When Do You Need it? IdentityServer is a .NET SDK for building an OpenID Connect and OAuth 2.0 identity provider. When you need it, and when ASP.NET Core Identity is enough.
- Using ASP.NET Core Passkeys for Second Factor Authentication Use passkeys as a second factor after password login in ASP.NET Core Identity on .NET 10, with a 2FA token provider and two endpoints to create and verify.
- Building a Supply Chain Attack with .NET and NuGet A story of building a supply chain attack with .NET and NuGet: package name spoofing, module initializers, source generators and MSBuild targets, and how to defend.
- Hosting the .NET Aspire Dashboard as a Standalone Container in Azure Web Apps Run the .NET Aspire dashboard as a standalone container in Azure Web Apps to view OpenTelemetry traces, metrics and logs, including the HTTP/2 and gRPC setup.
- Keyed Services (Named registrations) in .NET Service Provider Keyed services in .NET 8 let you register several implementations of one interface under a key, and inject the right one without factories or switch statements.
- So, I wrote a fiction book. Meet "The Side Project". I wrote a fiction novel called The Side Project. Why I moved from technical writing to fiction, how I started, and the tools and structure that helped.
- TimeProvider and the End of Untestable DateTime.Now DateTime.Now is hard to test. Since .NET 8, TimeProvider replaces your own clock wrapper: how to inject it and control time in tests with FakeTimeProvider.
- Union types in C# 15: discriminated unions in .NET 11 C# 15 adds a union keyword for discriminated unions in .NET 11: declaring union types, implicit conversions, exhaustive switch and null handling.
- Time for a change... Moving from JetBrains to Duende Software After close to 12 years at JetBrains, I am joining Duende Software in 2025 to drive customer success and advocate for IdentityServer. Here is why.
- Fix CS8618 Nullable Warnings in C# JSON Models Fix CS8618 non-nullable property warnings in C# JSON DTOs: compare nullable properties, constructors, default values and required, and why default! is risky.
- Mastodon on your own domain without hosting a server Get a Mastodon address on your own domain without hosting a server: serve WebFinger JSON on your domain and it resolves to your existing account.
- Rate limiting in ASP.NET Core: a practical guide (updated for .NET 10) A practical guide to the ASP.NET Core rate limiting middleware: fixed window, sliding window, token bucket and concurrency limiters, per-IP limits, and returning a 429.
- Run a .NET App as a Linux Service with systemd Run a .NET app as a Linux service: add Microsoft.Extensions.Hosting.Systemd, call UseSystemd(), write a Type=notify unit file, and read logs via journald.
- Run Azurite storage emulator in Docker with Rider Run the Azurite storage emulator in Docker, keep blobs and queues local to each solution with a volume mount, and start it from a Rider run configuration.
- System.Text.Json Polymorphic Deserialization Deserialize JSON into derived or abstract types: $type discriminators, [JsonPolymorphic] in .NET 7+, and a custom JsonConverter for legacy payloads.
- ValidateAntiForgeryToken in ASP.NET Core: unit test for it How to validate an anti forgery token in ASP.NET Core with [ValidateAntiForgeryToken], and unit test that every POST action has it, plus Rider navigation.
- Call for Papers meaning: what happens after you submit A call for papers (CFP) invites speakers to submit talks to a conference. Here is what happens after you submit, from committee to acceptance or rejection.
- PartitionKey and RowKey in Azure Table Storage explained PartitionKey picks the partition and RowKey identifies an entity within it. How to choose both in Azure Table Storage and Cosmos DB for Table, with C# code.