Tag Archives: Security

IdentityServer4 Localization using ui_locales and the query string

November 11, 2017 · by · in .NET Core, ASP.NET Core, OAuth2, Security · 5 Comments

This post is part 2 from the previous post IdentityServer4 Localization with the OIDC Implicit Flow where the localization was implemented using a shared cookie between the applications. This has its restrictions, due to the cookie domain constraints and this post shows how the oidc optional parameter ui_locales can be used instead, to pass the […]

IdentityServer4 Localization with the OIDC Implicit Flow

November 6, 2017 · by · in .NET, .NET Core, angular, ASP.NET Core, ASPNET5, MVC, Security, Typescript, Web · 11 Comments

This post shows how to implement localization in IdentityServer4 when using the Implicit Flow with an Angular client. Code: https://github.com/damienbod/AspNet5IdentityServerAngularImplicitFlow The problem When the oidc implicit client calls the endpoint /connect/authorize to authenticate and authorize the client and the identity, the user is redirected to the AccountController login method using the IdentityServer4 package. If the […]

Implementing custom policies in ASP.NET Core using the HttpContext

October 23, 2017 · by · in .NET Core, ASP.NET Core, Security · 9 Comments

This article shows how to implement a custom ASP.NET Core policy using the AuthorizationHandler class. The handler validates, that the identity from the HttpContext has the authorization to update the object in the database. Code: https://github.com/damienbod/AspNetCoreAngularSignalRSecurity History 2023-01-08 Updated Angular 15, .NET 72021-01-25 Updated Angular 11.1.0 .NET 5, ngrx implementation2020-03-21 updated packages, fixed Admin UI […]

Auto redirect to an STS server in an Angular app using oidc Implicit Flow

September 26, 2017 · by · in angular, javascript, OAuth2, Security, Typescript, UI, Web · 18 Comments

This article shows how to implement an auto redirect in an Angular application, if using the OIDC Implicit Flow with an STS server. When a user opens the application, it is sometimes required that the user is automatically redirected to the login page on the STS server. This can be tricky to implement, as you […]

angular-auth-oidc-client Release, an OpenID Implicit Flow client in Angular

June 14, 2017 · by · in angular, Security · 22 Comments

I have been blogging and writing code for Angular and OpenID Connect since Nov 1, 2015. Now after all this time, I have decided to create my first npm package for Angular: angular-auth-oidc-client, which makes it easier to use the Angular Auth OpenID client. This is now available on npm. npm package: https://www.npmjs.com/package/angular-auth-oidc-client github code: […]

Extending Identity in IdentityServer4 to manage users in ASP.NET Core

November 18, 2016 · by · in .NET, angular, ASP.NET Core, ASPNET5, dotnet, MVC, OAuth2, Security, Typescript, Web · 21 Comments

This article shows how Identity can be extended and used together with IdentityServer4 to implement application specific requirements. The application allows users to register and can access the application for 7 days. After this, the user cannot log in. Any admin can activate or deactivate a user using a custom user management API. Extra properties […]

Full Server logout with IdentityServer4 and OpenID Connect Implicit Flow

September 16, 2016 · by · in .NET, angular, AngularJS, ASP.NET Core, ASPNET5, dotnet, OAuth2, Security, Typescript · 3 Comments

The article shows how to fully logout from IdentityServer4 using an OpenID Connect Implicit Flow. Per design when using an access token to use protected data from a resource server, even if the client has logged out from the server, the access token can be used so long it is valid (AccessTokenLifetime) as it is […]

Authorization Policies and Data Protection with IdentityServer4 in ASP.NET Core

February 14, 2016 · by · in .NET, ASPNET5, Entity Framework, MVC, OAuth2, Security, SQLite, TopHeaderMenu, Web · 24 Comments

This article shows how authorization policies can be used together with IdentityServer4. The policies are configured on the resource server and the ASP.NET Core IdentityServer4 configures the user claims to match these. The resource server is also setup to encrypt a ‘Description’ field in the SQLite database, so it cannot be read by opening the […]

IIS HTTPS configuration for Team development

April 16, 2014 · by · in .NET, MVC, Security, TopHeaderMenu, Web · 1 Comment

This post a collection of information which I found all over the internet. I’m posting it as a reference for myself. I need to set up a development environment where a team of developers can develop multiple projects which use and test Web applications using HTTPS. Step 1: Create a root cert. This will be […]

Newer posts →