#aspnetcore
aspnetcore

A secure enterprise chat with React, .NET 10 and Microsoft Foundry

The article targets the common mistake of calling the model straight from the front end with the API key in JavaScript, and instead wires React to a .NET 10 Minimal API that talks to Microsoft Foundry without any keys. It walks through Entra ID authentication, a server-owned system prompt, Server-Sent Events streaming and IP-based rate limiting as the protections that separate a demo from a product.

ASP.NET Core Authentication & Authorization Explained: What to Use, When, and How to Ship It Safely

A long, practical walkthrough of ASP.NET Core authentication and authorization on .NET 10: which mechanism fits which caller, where teams leave holes such as missing resource-level checks, and what to verify before going to production.

Mastering Rate Limiting and Resource Governance for MCP Servers at Scale

A production write-up on rate limiting and resource governance for MCP orchestration servers, where a single tenant's burst can exhaust shared LLM token quota and starve everyone else. It compares the common limiter algorithms and lands on per-tenant token buckets with Redis-backed state and quota-aware refill rates.

Faking a Yes: 6 Attacks on the Human Confirmation in a .NET 10 MCP Server

A developer red-teamed the confirmation step of a refund MCP server built on ASP.NET Core with the official C# SDK (ModelContextProtocol 2.3.0). Six attacks — plain-JSON requestState, replaying another user's approval, injected form fields and a pre-checked consent box — each led to a concrete server-side defense, plus a checklist you can apply to your own tools.

TermForge: SSH, Docker, and File Management in One .NET App

TermForge is a local web application built with .NET and React that merges SSH sessions, file browser, and Docker management into one unified tool. This project offers a modern solution to the challenges faced when switching between terminals and remote file systems across multiple servers.

Sending leads to Odoo without losing one: a transactional outbox in ASP.NET Core

Saving a lead and then calling Odoo means two writes that can each fail on their own. Anas Amin describes a transactional outbox where the lead and a message describing it commit together, and a Hangfire job delivers the message later. Leased claims, error classification, dead-lettering and idempotent Odoo writes carry the rest of the design.

Securing APIs with Microsoft Entra ID: scope, client and token validation

A practical guide to protecting an API with Microsoft Entra ID: registering the API, exposing a scope, and registering the client that requests it. It walks through a .NET Core API using Microsoft.Identity.Web, a React client using MSAL, and a .NET web app calling a downstream API. The same token checks apply to any backend stack.

A reusable Claude Code skill for reviewing ASP.NET Core endpoint changes

Nick Cosentino explains how to package a recurring .NET review job as a project-scoped Claude Code skill. The example reviews endpoint changes across validation, authorization, response mapping and persistence, and the article stresses clear limits on what the agent may run. It is a practical starting point for teams that want repeatable AI-assisted reviews of ASP.NET Core code.

Claude Code for .NET Developers: A Practical Agentic Workflow

Claude Code is an agent that reads a repository, plans changes, edits files and runs dotnet build and dotnet test until the code passes. Mehdi Mohseni's guide shows how a .NET team can set it up with a CLAUDE.md, a PostToolUse build hook, plan mode and permission guardrails. It is worth reading if you want the agent to check its own work.

Syncfusion Brings Open-Source Toolkit and Fixes to Blazor

Microsoft and Syncfusion are collaborating on Blazor through a free, MIT-licensed component toolkit, merged framework fixes, and setup tooling. The Syncfusion Toolkit for Blazor needs no license key and can be used commercially. For Blazor developers, the work affects component choice, project setup and the quality of ASP.NET Core fixes.

Vertical Slice vs Clean Architecture in .NET 10: the hybrid layout

The author compares Vertical Slice and Clean Architecture on the same Product API in .NET 10, counting the files each layout touches for one new feature. He then presents a hybrid layout that keeps the Domain project, drops the Application project, and groups endpoints by feature. It is a practical reference for teams deciding how to structure a Web API.

Six checks an AI Telegram assistant needs before the model runs

A developer built a Telegram assistant in n8n that can send email and book meetings, with its decisions guarded by a small ASP.NET Core API on .NET 10. The post lists six checks that run before the model sees a request: chat allowlist, duplicate updates, stale messages, voice length, contact ambiguity and time zones. It is a useful checklist for any bot that triggers side effects.