A long, practical walkthrough of ASP.NET Core authentication and authorization on .NET 10: which mechanism fits which caller, where teams leave holes such as missing resource-level checks, and what to verify before going to production.
The author compares Vertical Slice and Clean Architecture on the same Product API in .NET 10, counting the files each layout touches for one new feature. He then presents a hybrid layout that keeps the Domain project, drops the Application project, and groups endpoints by feature. It is a practical reference for teams deciding how to structure a Web API.
Mauro Servienti examines how strongly typed view models in ServiceComposer can reintroduce the coupling that ViewModel Composition is meant to remove. He proposes per-service interfaces for response models and per-service request models for decomposition, and discusses a DispatchProxy idea that would drop the concrete class. Read on for the trade-offs and deployment caveats, including property name collisions.
Axia is an open-source .NET 10 web console and REST API for Active Directory and OpenLDAP. Its author explains why half of the initial DDD design was dropped after several security reviews. The article covers what paid off, including value objects, ports and adapters, and architecture tests, and what was replaced, such as domain-event auditing.
Anton Martyniuk's new deep dive maps the caching options in .NET, from IMemoryCache and IDistributedCache with Redis to HybridCache, and explains when each one fits. It stresses that caching should come after fixing slow queries, and shows how a per-process cache can serve stale data once an API runs on several instances. Worth reading before you choose a cache for a scaled ASP.NET Core app.
Reading the request body in logging middleware can leave the endpoint handler and model binding with an empty body. The author reproduces the problem with a 61-byte JSON POST and shows how EnableBuffering plus a position reset fixes it. A pitfall every ASP.NET Core developer who logs payloads should know.
The author explains how traffic spikes and client retries can tip a service over, and why rate limiters and circuit breakers do not fully solve it. Load shedding, which drops requests based on current system health, is presented as the missing piece. The article walks through ASP.NET Core and Kestrel ideas for shedding early and by endpoint priority, useful for anyone running public APIs.
This beginner guide explains GraphQL schemas, queries, mutations and resolvers and builds a working endpoint with GraphQL.NET on ASP.NET Core and .NET 10. It compares the same product read with a REST endpoint and shows how validation errors come back as HTTP 200 with an errors array. Useful for .NET teams weighing GraphQL, especially the server-side duties it adds.
Duende's Halloween-themed walkthrough explains DPoP, the RFC 9449 extension that binds access tokens to a client's key pair. Binding stops a stolen bearer token from being replayed against an API. The post follows the token request, the cnf.jkt claim and the proof check on the API side, and it maps each step to Duende's .NET libraries.
A developer measured that favicon and robots.txt requests in ASP.NET Core walk the whole middleware chain like any API call. He shows how MapShortCircuit and ShortCircuit() answer those routes before the chain runs, with a counter proving zero middleware executions.
The author shows how to test the 404 branch of a minimal API endpoint by calling the handler directly instead of booting WebApplicationFactory. Typed result unions such as Results<Ok<T>, NotFound> make the return type a compiler-checked contract. The approach gives fast, readable unit tests, while the author keeps a thin layer of integration tests for routing, binding and middleware.
Karen Payne shows how to improve the Razor Pages that Visual Studio generates for an EF Core model reverse-engineered from SQL Server. The main change is replacing table-based lists with Bootstrap div layouts, swapping text links for icon buttons, and using a Bootstrap modal instead of a separate delete page. It is a practical starting point for ASP.NET Core developers who want more responsive and WCAG AA friendlier list pages.