ASP.NET Core validates a JWT by its signature and expiry, so a stolen token keeps working after a password change. The article walks through two fixes: short-lived access tokens paired with revocable refresh tokens, then a token_version check for immediate revocation. Every .NET developer running JWT-based APIs should know where the gap is and what each fix costs.
Wolverine 6.52.0 is a feature release adding connection-string-name registration for every transport and message store, timer agents for recurring schedules under 15 minutes, and groundwork for Wolverine 7.0. It also changes behavior: frequent schedules now run on timer agents, and unmappable outgoing envelopes are dead-lettered. Developers running Wolverine messaging should review these changes before upgrading.
A team moving a relationship-heavy system from MySQL to graph databases reports that a recursive CTE collapsed at around 500 million rows. The author built a reproducible benchmark comparing the CTE, a C# breadth-first search on the same MySQL tables, and NebulaGraph. The results suggest the CTE's design, not the relational engine, caused most of the delay.
A developer found an IDOR flaw in their own security test, where an endpoint returned records without checking that they belonged to the caller. The article explains why [Authorize] alone cannot cover ownership and how to make the check hard to forget.
SQL Server error 1934 appears when a statement uses a feature such as a filtered index while the session has QUOTED_IDENTIFIER off. The author explains why the ASP.NET Core application never sees it while the classic sqlcmd does, and how the setting interacts with stored procedures. Useful for anyone who updates ASP.NET Core Identity tables by hand.
Marten 9.52.0, the PostgreSQL-based document and event store for .NET, adds a new schema table, an exception transform option and several tenant removal fixes. Anyone upgrading should know how the schema migration affects their databases before deploying.
The article explains how to register MongoClient as a singleton in ASP.NET Core and how request-scoped services should borrow it. It shows that disposing the client through the container does not close the driver's cluster, and that the selected driver version changes the answer. It is a useful reference for teams running MongoDB in web apps.
Avalonia reported that unauthorised access during the 22-23 October 2026 attack was limited to its marketing website CMS. The entry point was an administrator token accidentally embedded in browser-delivered JavaScript. All 39 attempts to publish to its NuGet feeds were rejected, and customers need not reset passwords or replace licence keys.
This guide covers how ASP.NET Core background services can stop cleanly during shutdown without losing or duplicating work. It walks through cancellation tokens, scoped dependencies, queue acknowledgement order and host shutdown timeouts, with a test checklist for production readiness.
The Azure Cosmos DB blog shows how to test a database-backed feature against the Azure Cosmos DB Emulator running in Docker, then run the same tests in GitHub Actions. The example is a Python demo app, but the pattern applies to any .NET service that talks to Cosmos DB. Each pull request update runs against a fresh emulator, so you can check that a write reached storage and changed the answer, not just that the HTTP call returned 200.
PostSharp 2027.0 makes advice parameter binding public: aspect advices receive typed parameters instead of a MethodExecutionArgs object. That removes per-call heap allocations, boxing and casts on hot paths. Bindings are checked at build time, so mismatches fail the build rather than production.
A developer who has maintained ASP.NET Core APIs for years lists six recurring problems: scattered try/catch blocks, unbounded list queries, ignored cancellation tokens, lost UTC kinds, late config failures and unprotected login endpoints. Each comes with a suggested pattern using .NET 10 and EF Core 10, noted to work on .NET 8 with small changes.
AuthEndpoints 4 is a library that adds ready-made authentication endpoints on top of ASP.NET Core Identity. A single AddPasswordAuth and MapPasswordAuth pair covers sign-up, sign-in, 2FA, passkeys and password recovery. It targets .NET 10 and is compared with the built-in MapIdentityApi.