Obfuscators rename members and types, and Json.NET reads those CLR names to write JSON keys and $type discriminators, so payloads change without any error. The article explains how to pin wire names with [JsonProperty], [EnumMember] and a stable ISerializationBinder, and how to test the protected build.
Copilot Autofix for GitHub Advanced Security in Azure DevOps now runs on an agentic foundation. It proposes fixes as pull requests for code scanning alerts from third-party tools and for dependency vulnerabilities. Your team still makes the final merge decision, so the fixes need to be reviewed like any other change.
Azure Cosmos DB's Safe Key Rotation now shows the last-used timestamp for each account key and can be turned on from the Features blade in the Azure portal. Teams can confirm whether a key is still in use before regenerating it or disabling local authentication. That lowers the risk of an outage caused by rotating a key that a forgotten application still depends on.
Cookie authentication in ASP.NET Core serializes the whole AuthenticationTicket into the cookie, so large claim sets can push it past WAF limits. Implementing ITicketStore keeps the ticket on the server and leaves only a session key in the cookie. The article compares an in-memory store with a distributed cache version and discusses the scaling and revocation trade-offs.
Anthropic shared research on using Claude to find code that a deployment can reach but does not need, then restrict or remove it. Across 25 open-source projects with over five million lines, it reported 493 issues. In OpenSSH, about 4,500 lines of experimental post-quantum signature code reachable before authentication were addressed in releases 10.5 and 10.6. It is a concrete method for teams using AI in security reviews.
Microsoft has released Aspire 13.6.2, a patch on the 13.6 line. The main change pins the MessagePack dependency to 2.5.307 to pick up security fixes. Because the release is maintenance-focused, it is a low-effort upgrade for Aspire developers, but the dependency pin is worth checking in your own projects.
A guide to the four built-in rate limiting algorithms in ASP.NET Core: fixed window, sliding window, token bucket and concurrency limiter. It shows how each one behaves under the same traffic and when to pick it for a given endpoint. Useful for any .NET developer who needs to protect an API from abusive or buggy clients.
Part 9 of Taiseer Joudeh's MCP series shows how to attach an existing ASP.NET Core MCP server to a hosted Foundry agent without changing its code. The setup covers a Foundry project, an Entra app registration, a custom MCP connection using OAuth identity passthrough, and a toolbox. It matters for .NET teams that want the agent loop in Azure while user-based authorization still works.
A practical guide to adding a Model Context Protocol server to an existing ASP.NET Core app using the official ModelContextProtocol C# SDK. It covers wrapping existing services as read-only tools, locking the endpoint down with JWT authentication and per-tool authorization, and verifying the surface with an MCP client. Useful for teams that want AI agents to use their current APIs without a rewrite.
Microsoft Graph supplies calendar, mail and document data that can be indexed with Azure AI Search and passed to a language model to produce sourced answers. The article walks through a .NET retrieval-augmented generation flow with code for loading context, chunking documents and calling the model. It stresses least-privilege scopes and permission-aware retrieval, which matter for any enterprise assistant.
This post shows how to keep the ADFS ID token small and fetch extra claims from the OpenID Connect userinfo endpoint instead of using allatclaims. It covers the urn:microsoft:userinfo claim rules and the ASP.NET Core OpenIdConnect setting that merges those claims. It also flags the audience error that appears when the wrong token is sent.
Mehdi Mohseni argues that coding agents now write much of the code, but developers still need the judgment to spot code that looks right and is wrong. Using ASP.NET Core examples, he shows how generated code can compile, pass tests and still hide a fail-open security check or a silent misconfiguration. A practical read for anyone reviewing agent output.