Duende Software

Authentication tells you who the caller is; it doesn't tell you what they're allowed to do. In this post, we'll use scope-based authorization in .NET 10 Minimal APIs to enforce fine-grained access control using JWTs issued by Duende IdentityServer.

A high-severity vulnerability (CVSS 8.2) has been identified in the Pushed Authorization Requests (PAR) endpoint of Duende IdentityServer. The endpoint performs insufficient validation of pushed requests, resulting in three related weaknesses:

.NET 11 and C# 15 will be released this November and with it comes changes, updates, and new features. Of course every new update brings the same familiar question, what changes for the software I maintain? For developers of Duende IdentityServer applicat

If you've been following the identity standards world (or reading this blog), you know that the OAuth 2.0 for Browser-Based Applications specification has been in draft form for years. I mentioned it in my summer standards recap when it was finally submit

One-Time Passwords (OTP) over SMS are often the default for phone-based login: every phone can receive a text, users know the drill, and it works most of the time. However, delivery rates vary wildly by country, carrier filtering silently drops codes, and

Remaining stationary on an unsupported identity platform introduces unacceptable compliance and business risks. For organizations running IdentityServer3, moving forward is the only viable option to maintain security hygiene. However, upgrading is not a s

When you configure a confidential OAuth or OpenID Connect client, that client needs to authenticate itself against the authorization server. Most samples and demos out there demonstrate using a client secret for authentication, because this is the most co

It's Duende. D-U-E-N-D-E. Not Deunde, not Duande, not Deuende, and definitely not Duemde. If you've been searching for Duende Software, Duende IdentityServer, or the Duende BFF Security Framework and couldn't quite nail the spelling, you're not alone. Tho

As identity and security experts, we love "safe by default" systems, but changes to defaults can often lead to headaches during migrations and upgrades. Recently, while reviewing the .NET 11 release notes, we noticed a notable change to the defaults that

The security space can be a strange and confusing place for newcomers. In this series of posts, we aim to shed light on the security lingo you may encounter when reading the latest security specifications and scanning your favorite Duende documentation. B