Michelle Agroskin

Michelle Agroskin is a Staff Product Marketing Manager for Okta. She leads the Customer Identity AI, Authorization, and Consumer portfolios; driving go-to-market strategy, messaging, launches, and strategic growth initiatives.

She lives in NYC and in her free time, loves to travel the world and try new restaurants!

Staff Product Marketing Manager, Auth0

Auth0’s latest features enhance user experience with secure, customizable logins, flexible authentication, and improved security—without compromising convenience.

Customer expectations are higher than ever. They want security, convenience, and personalization, all without friction. Businesses need to deliver seamless experiences while keeping user data safe. The challenge? Balancing security with ease of access.

At Auth0, we believe you shouldn’t have to choose between security and experience. That’s why we’re introducing innovations that strengthen security and improve user experience—before, at, and after login.

## Powerful New Features for Secure, Seamless Login

Today’s businesses need to build trust with their users. Customers *expect* engaging experiences, convenient journeys, and secure digital platforms. Before they give you their business, they need to know that you can cater to their unique needs, provide ease of use across multiple channels, and protect their data and sensitive information. When security and user experience are seamlessly integrated, customers engage more, businesses grow, and digital experiences become effortless. And that starts with getting identity right. 

> We’ve updated the authentication journey to help businesses deliver trusted, customized experiences while keeping users safe.

#### **Before login**: greater flexibility with Tenant Access Control

**Security starts before users even log in. **Tenant Access Contro**l (Generally Available, March 2025) helps protect applications and APIs from threats like denial-of-service attacks. Stopping lousy traffic before it reaches your applications prevents disruptions and keeps them running. This feature allows organizations to create granular policies to manage access and mitigate threats, giving them more control over protecting their applications and users.

#### **At login**: Advanced Customization for Universal Login

**The login box is often the first interaction users have with your brand and the one they repeatedly return to as they continue engaging with it. Now, with **Advanced Customization for Universal Login** (Early Access, February 2025), businesses can control every piece of their login experience while leveraging Auth0’s security and built-in authentication process. Create pixel-perfect experiences and tailor every detail to match your brand with the same built-in security Auth0 is known for. 

#### **After login**: strengthen security

**Security doesn’t stop after users are logged in. We’re introducing key enhancements to secure the entire customer journey:

 * **FAPI 2 Certification **(Achieved, March 2025) strengthens API security with financial-grade protections that prevent transaction tampering and data leaks within our Highly Regulated Identity product.
 * **Client-initiated backchannel Authentication** (Limited Early Access, Generally Available Q2 2025) enables a client application (e.g., call center system, POS terminal, autonomous AI agent) to initiate the authentication process on behalf of the customer, making authentication easier.
 * **Native to Web SSO** (Early Access, April 2025) keeps users signed in as they move between mobile and web apps, eliminating unnecessary logins (and frustrated customers!).

## Identity Is the Key to Better Experiences 

In the past, businesses struggled with trade-offs, prioritizing security at the expense of user experience or vice versa. Modern identity removes that compromise, ensuring that security enhances, rather than hinders, customer experience.

Businesses that get identity right can deliver effortless logins, personalized interactions, and enterprise-grade security without slowing growth. These latest innovations make it easier than ever to:

* Protect against fraud and unauthorized access
* Build seamless, branded login experiences
* Maintain compliance with industry standards
* Enable flexible, secure authentication
* Keep users signed in across platforms

## Get Started Today

Auth0 makes identity **simple**, **scalable**, and more **secure.** These latest innovations help businesses stay ahead by offering users the frictionless, secure experiences they expect.

> Stop building identity from scratch. Start building with Auth0.

Learn more about these updates in our [documentation](https://auth0.com/docs/get-started) or [contact our team](https://auth0.com/contact-us) today.

_Any products, features, functionalities, certifications, authorizations, or attestations referenced in this material that are not currently generally available or, have not yet been obtained, or are not currently maintained may not be delivered or obtained on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, functionality, certification, or attestation, and you should not rely on them to make your purchase decisions._

Better User Experiences, Stronger Security

deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

arpit-jain

Arpit is a skilled engineering manager and software developer who specializes in Java, JS, and cloud-native technologies. He actively contributes to the developer community and focuses on enhancing the developer experience. Arpit also mentors aspiring developers.

Senior Engineering Manager

Arpit Jain

The Auth0 Terraform provider has many new features and updates. Learn all about what's new.

The [Auth0 Terraform Provider](https://registry.terraform.io/providers/auth0/auth0/latest/docs) allows you to automate the configuration of Auth0 resources like applications, connections, actions, and more. You can also use it to manage users and groups. With the Auth0 Terraform provider, you can automate almost everything you can do via the management UI.

**Check out our blog post to get started with Auth0 and Terraform.**

<include 
    src="LinkCard" 
    title="Get Started with the Auth0 Terraform Provider" 
    link="https://auth0.com/blog/get-started-with-auth0-terraform-provider/" 
    description="Learn how to get started with the Auth0 Terraform Provider to automate your identity infrastructure." 
    img="https://images.ctfassets.net/23aumh6u8s0i/315vJcTNAjaIgQZWxlovOf/a1839ed3bff28c3da8969642252c86a6/terraform-auth0-logo"
/>

## What's New in the Auth0 Terraform Provider

The latest versions (1.4 to 1.7) of the Auth0 Terraform provider have many new features and updates. Here are the top **six** features to look out for.

### Auth0 Forms

[Auth0 Forms](https://auth0.com/features/forms) is a robust visual editor that enables you to create custom, dynamic forms seamlessly integrating with your authentication workflows.

> [Available from v1.7.3](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/form)

<AmpContent>
  <amp-youtube
      data-videoid="jkzwN2xwO5w"
      layout="responsive"
      width="480" height="270">
  </amp-youtube>
</AmpContent>
<NonAmpContent>
  <div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/jkzwN2xwO5w' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Forms offer a secure and controlled experience within your tenant's domain, eliminating the need for external site redirects. You can manage Auth0 Forms and [Flows](https://auth0.com/docs/customize/forms/flows) via Terraform, enabling you to automate the creation and management of forms and flows.

```hcl
# Create an Auth0 Form
resource "auth0_form" "sample_form" {
  name = "KYC Form"

  start = jsonencode({
    coordinates = { x = 0, y = 0 }
    next_node = "username_step"
  })

  nodes = jsonencode([{
    id   = "username_step"
    type = "STEP"
    config = {
      components = [{
        category = "FIELD"
        config = {
          max_length = 50
          min_length = 1
          multiline  = false
        }
        id        = "full_name"
        label     = "Your Name"
        required  = true
        sensitive = false
        type      = "TEXT"
        },
        {
          category = "BLOCK"
          config = { text = "Continue" }
          id   = "next_button_3FbA"
          type = "NEXT_BUTTON"
      }]
      next_node = "$ending"
    }
    coordinates = { x = 500, y = 0 }
  }])

  ending = jsonencode({
    after_submit = {
      flow_id = auth0_flow.sample_flow.id
    }
    coordinates = { x = 1250, y = 0 }
    resume_flow = true
  })

  style = jsonencode({ css = "h1 { color: white; text-align: center; }" })
}

# Create an Auth0 Flow to use the Form
resource "auth0_flow" "sample_flow" {
  actions = jsonencode([{
    action = "UPDATE_USER"
    allow_failure = false
    id            = "update_user_metadata"
    mask_output   = false
    params = {
      changes = {
        user_metadata = { full_name = "{{fields.full_name}}" }
      }
      connection_id = auth0_flow_vault_connection.sample_connection.id
      user_id       = "{{context.user.user_id}}"
    }
    type = "AUTH0"
  }])
  name = "Flow KYC update data"
}

# Create a Flow Vault Connection to use in a Flow
resource "auth0_flow_vault_connection" "sample_connection" {
  app_id = "AUTH0"
  name   = "Auth0 M2M Connection"
  setup = {
    client_id     = var.auth0_client_id # The M2M app must be authorized to use the Auth0 Management API
    client_secret = var.auth0_client_secret
    domain        = var.auth0_domain # without https:// in the domain
    type          = "OAUTH_APP"
  }
}
```

### Machine-to-Machine Access for Organizations

[Machine-to-Machine (M2M) Access for Organizations](https://auth0.com/docs/manage-users/organizations/organizations-for-m2m-applications) enables you to define the organizations that a given application can access for each API using the Client Credentials Flow. This enables customers to sell and operate their services in M2M environments properly, cover scenarios with consumption devices with limited user experience capabilities, and simplify configuration and usage.

This is being implemented so that M2M Apps can be associated with a given organization, as currently done for Connections. This will enable that application to request an access token for that specific Organization.

> Note: This feature is available from B2B Professional, Enterprise, and Enterprise premium plans.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/organization_client_grant)

```hcl
# Create an Auth0 Organization
resource "auth0_organization" "my_organization" {
  name         = "auth0-inc"
  display_name = "Auth0 Inc."

  branding {
    logo_url = "https://example.com/assets/icons/icon.png"
    colors = {
      primary         = "#f2f2f2"
      page_background = "#e1e1e1"
    }
  }
}

# Create a new Auth0 M2M application
resource "auth0_client" "sample_client" {
  name                = "MyCoolApp"
  description         = "My Cool App Client Created Through Terraform"
  app_type            = "non_interactive"
}

# Create a Client Grant for the Client
resource "auth0_client_grant" "my_client_grant" {
  client_id = auth0_client.sample_client.id
  audience  = "https://passkeys-demo.eu.auth0.com/api/v2/"
  scopes    = ["create:foo", "create:bar"]
}

# Create a Client Grant for the Organization
resource "auth0_organization_client_grant" "sample_organization_client_grant" {
  organization_id = auth0_organization.my_organization.id
  grant_id       = auth0_client_grant.my_client_grant.id
}
```

## Bring Your Own Key (BYOK)

[Bring Your Own Key](https://auth0.com/docs/secure/highly-regulated-identity/customer-managed-keys/customer-managed-keys-management-api) allows you to securely replace your tenant’s top-level encryption key with a key of your own, hence gaining control of your key material in Auth0’s hardware security module (HSM). It allows compliance with specific secret custody and key provenance requirements. Once you have uploaded your key, data encryption and decryption operations use that key to encrypt your tenant's secrets and data.

> Note: This feature is available as Early Access on Enterprise plans with the Highly Regulated Identity add-on.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/encryption_key_manager)

```hcl
# Modifying the key_rotation_id causes the keys to be rotated/rekeyed.
resource "auth0_encryption_key_manager" "sample_key_manager_initial" {
  key_rotation_id = "da9f2f3b-1c7e-4245-8982-9a25da8407c4"
}

resource "auth0_encryption_key_manager" "sample_key_manager_rekey" {
  key_rotation_id = "68feba2c-7768-40f3-9d71-4b91e0233abf"
}

# To initialize the process of providing the root key by the customer, create a
# `customer_provided_root_key` block.
resource "auth0_encryption_key_manager" "sample_key_manager" {
  customer_provided_root_key {
  }
}

# The public_wrapping_key and wrapping_algorithm should be available to
# be used to wrap the new key by the customer
output "key_manager" {
  depends_on = [auth0_encryption_key_manager.sample_key_manager]
  value = {
    public_wrapping_key = auth0_encryption_key_manager.sample_key_manager.customer_provided_root_key.*.public_wrapping_key
    wrapping_algorithm  = auth0_encryption_key_manager.sample_key_manager.customer_provided_root_key.*.wrapping_algorithm
  }
}

# The root key should be wrapped using the specified algorithm by the customer and Base64 encoded.
resource "auth0_encryption_key_manager" "sample_key_manager" {
  customer_provided_root_key {
    wrapped_key = "your_base64_encoded_wrapped_root_key"
  }
}
```

## Customize Signup and Login Prompts

[Customize Signup and Login Prompts](https://auth0.com/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts) is a feature that allows customers with a Custom Domain and Custom Page Template enabled to add custom fields and content to their app’s signup and login prompts.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/prompt_screen_partial)

Customize Signup and Login Prompts supports two use cases.

- **Custom content**: Custom content is static content like text, links, or images placed directly on the signup and login prompts.
- **Data capture**: Data capture uses form elements dynamically added to the signup and login prompts, which is useful for collecting and validating user consent or user-produced data like a surname.

```hcl
# For managing a single prompt screen
resource "auth0_prompt_screen_partial" "login" {
  prompt_type = "login"
  screen_name = "login"
  insertion_points {
    form_content_start = "<div>Form Content Start</div>"
    form_content_end   = "<div>Form Content End</div>"
  }
}

# For managing multiple prompt screens
resource "auth0_prompt_screen_partials" "prompt_screen_partials" {
  prompt_type = "login-passwordless"

  screen_partials {
    screen_name = "login-passwordless-email-code"
    insertion_points {
      form_content_start = "<div>Form Content Start</div>"
      form_content_end   = "<div>Form Content End</div>"
    }
  }

  screen_partials {
    screen_name = "login-passwordless-sms-otp"
    insertion_points {
      form_content_start = "<div>Form Content Start</div>"
      form_content_end   = "<div>Form Content End</div>"
    }
  }
}
```

## Self-Service Single Sign-On

[Self-Service Single-Sign On (SSO)](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO) provides business-to-business (B2B) customers with the tools needed to delegate SSO setup to their enterprise customers. This enables your B2B customers to configure and manage their own ways of logging in to your SaaS application.

Self-Service SSO provides a packaged experience that Auth0 customers can offer to their business customers so that they can set up their own SSO access. Customers can take advantage of this time-saving feature to reduce support costs and time-to-value for their business customers.

> Note: This feature is available as limited Early Access on Enterprise plans.

> [Available from v1.5.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/self_service_profile)

```hcl
resource "auth0_self_service_profile" "my_self_service_profile" {
  user_attributes {
    name        = "sample-name"
    description = "sample-description"
    is_optional = true
  }
  branding {
    logo_url = "https://mycompany.org/v2/logo.png"
    colors {
      primary = "#0059d6"
    }
  }
}
```

## SCIM Configuration

[System for Cross-domain Identity Management (SCIM)](http://www.simplecloud.info/), is a [protocol](https://tools.ietf.org/html/rfc7644) and [schema](https://tools.ietf.org/html/rfc7643) used by enterprise organizations for provisioning, de-provisioning, and managing user identity-related information across systems in a standardized way. SaaS developers selling their SaaS apps and services to large enterprises may be asked, or even required, by those customers to implement a SCIM-based API to integrate with the user provisioning tooling they use.

With support for [inbound SCIM](https://auth0.com/docs/authenticate/protocols/scim/configure-inbound-scim), SaaS application builders will be able to:

- Use the Auth0 Dashboard or APIs to quickly and easily enable support inbound SCIM user provisioning and de-provisioning workflows to their Auth0 user identity stores
- Get out-of-box support for top Workforce IDPs that implement outbound SCIM (including Okta Workforce Identity Cloud and Azure AD) without needing to build or self-host any custom endpoints

> Note: This feature is available on Enterprise plans.

> [Available from v1.4.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/connection_scim_configuration)

```hcl
resource "auth0_connection" "my_enterprise_connection" {
  name         = "my-enterprise-connection"
  display_name = "My Enterprise Connection"
  strategy     = "okta"

  options {
    client_id              = "1234567"
    client_secret          = "1234567"
    issuer                 = "https://example.okta.com"
    jwks_uri               = "https://example.okta.com/oauth2/v1/keys"
    token_endpoint         = "https://example.okta.com/oauth2/v1/token"
    authorization_endpoint = "https://example.okta.com/oauth2/v1/authorize"
  }
}

# A resource for configuring an Auth0 Connection SCIM Configuration, specifying `user_id_attribute` and `mapping`.
# Only one can be specified for a connection.
resource "auth0_connection_scim_configuration" "my_conn_scim_configuration" {
  connection_id     = auth0_connection.my_enterprise_connection.id
  user_id_attribute = "attribute1"
  mapping {
    auth0 = "auth0_attribute1"
    scim  = "sacim_attribute1"
  }
  mapping {
    auth0 = "auth0_attribute2"
    scim  = "sacim_attribute2"
  }
}
```

## Learn More

I hope that you found this article helpful. Here are some additional resources to learn more about Auth0 and DevOps.

- [Get Started with the Auth0 Terraform Provider](https://auth0.com/blog/get-started-with-auth0-terraform-provider/)
- Be a DevOps Hero\! Automate Your Identity Infrastructure with Auth0 CLI and Ansible
- [Deploy Secure Spring Boot Microservices on Amazon EKS Using Terraform and Kubernetes](https://auth0.com/blog/terraform-eks-java-microservices/)
- [Shhhh... Kubernetes Secrets Are Not Really Secret\!](https://auth0.com/blog/kubernetes-secrets-management/)
- [Auth0 CLI Basics \- Lab](https://developer.auth0.com/resources/labs/tools/auth0-cli-basics#introduction)

You can also sign up for our [newsletter](https://a0.to/nl-signup/java) to stay updated on everything about identity and security.

If you liked this tutorial, chances are you'll enjoy the others we publish. Please follow [@auth0 on Twitter](https://twitter.com/auth0) and [subscribe to our YouTube channel](https://youtube.com/oktadev) to get notified when we publish new developer tutorials.


What's New in the Auth0 Terraform Provider?

peterfernandez_360

As an Architect, Consultant, and Engineer, I have more than 30 years of experience designing and developing secure and robust software solutions. When not helping teams deal with the complexities of Customer Identity, you can usually find me working behind the scenes, acting in or directing a show at my local theatre.

Principal Developer Advocate

Peter Fernandez

Why a Multi-Tenant approach is fundamental to B2B SaaS, and how using Auth0 and the Auth0 Organizations feature can help implement it.

Demystifying Multi-Tenancy in a B2B SaaS Application

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Andrea Chiarelli

With .NET 9.0, some interesting authentication and authorization features have been added to the platform. Let’s take an overview of them.

.NET 9 introduces interesting new features, primarily focused on cloud-native development and performance. However, the [list of improvements](https://learn.microsoft.com/en-us/dotnet/core/whats-new/dotnet-9/overview) in other areas of the platform is long. This article will focus on the main innovations introduced by .NET 9.0 in authentication and authorization.

## Support for Pushed Authorization Requests (PAR)

One of the most interesting features brought by .NET 9.0 is support for [Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) (PAR), an OAuth 2.0 and OpenID Connect extension that strengthens the security profile of these protocols. PAR allows applications to not expose the parameters of an authorization request through the browser. Instead, it enables direct communication of these parameters between the application and the authorization server. This is very important when you implement applications in a high-security context, such as in the financial, healthcare, or other regulated sectors. If you want to learn the details of [how PAR works, read this article](https://auth0.com/blog/what-are-oauth-push-authorization-requests-par).

ASP.NET Core adds support for PAR to the native [OpenID Connect middleware](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnecthandler). This is a typical configuration of the middleware if you are not using the [Auth0 SDK](https://github.com/auth0/auth0-aspnetcore-authentication):

```csharp
// Program.cs
...
  
builder.services.AddAuthentication(options =>
  {
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
  })
  .AddCookie()
  .AddOpenIdConnect("Auth0", options =>
  {
    options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";

    options.ClientId = builder.Configuration["Auth0:ClientId"];
    options.ClientSecret = builder.Configuration["Auth0:ClientSecret"];
    options.ResponseType = "code";
});

...
```

If the Identity provider you are using supports PAR, you don't need to do anything different from this. In fact, the OpenID Connect middleware transparently supports PAR by default. In other words, if the middleware detects PAR support by analyzing the standard `.well-known/openid-configuration` discovery document, it automatically leverages the PAR endpoint to pass the authorization request parameters. You can change the default behavior by modifying the value of the new option property `PushedAuthorizationBehavior`. For example, the following setting disables PAR support:

```csharp
// Program.cs
...
  
  .AddOpenIdConnect("Auth0", options =>
  {
    options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
    ...
    options.ResponseType = "code";
    
    options.PushedAuthorizationBehavior = PushedAuthorizationBehavior.Disable;
});

...
```

If you want to force your application to use PAR, you can set the value of `PushedAuthorizationBehavior` to `PushedAuthorizationBehavior.Require`. In this case, you get an error if the Identity provider does not support PAR.

Finally, to help customize PAR support, the [`OnPushAuthorization`](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnectevents.onpushauthorization?view=aspnetcore-9.0#microsoft-aspnetcore-authentication-openidconnect-openidconnectevents-onpushauthorization) event has been added to `OpenIdConnectEvents`.

## OAuth and OIDC Parameters Customization

Staying in the context of the OpenID Connect middleware, now you have a simplified way to add custom parameters to the authorization request. Up to .NET 8, if you wanted to add a custom parameter, such as `audience`, to the authorization request, you had to handle the `OnRedirectToIdentityProvider` event as shown in the following code snippet:

```csharp
// Program.cs
...

.AddOpenIdConnect(options =>
{
  options.Events.OnRedirectToIdentityProvider = context =>
  {
    context.ProtocolMessage.SetParameter("audience", "https://myapi.com");
    return Task.CompletedTask;
  };
});
...
```

> If you are using the [Auth0 SDK for ASP.NET Core](https://github.com/auth0/auth0-aspnetcore-authentication), you already have [an easier way to add the audience parameter](https://github.com/auth0/auth0-aspnetcore-authentication/blob/main/EXAMPLES.md#calling-an-api).

.NET 9 introduces the `AdditionalAuthorizationParameters` option to simplify this process. The previous code is equivalent to the following:

```csharp
// Program.cs
...
  
  .AddOpenIdConnect("Auth0", options =>
  {
    ...
    
    options.AdditionalAuthorizationParameters.Add("audience", "https://myapi.com");
});

...
```

## Configuration Flags for Windows Authentication

When using [HTTP.sys](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/httpsys) as a web server for ASP.NET Core applications on Windows systems, you can now configure [Windows Authentication](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth) by setting two new properties:

- `EnableKerberosCredentialCaching`. If this boolean value is `true`, the Kerberos authentication credentials are cached.
- `CaptureCredentials`. If this boolean value is `true`, the HTTP Server API captures the caller's credentials and uses them for Kerberos or Negotiate authentication.

The following code shows an example of usage of these properties:

```csharp
// Program.cs
...
builder.UseHttpSys(options =>
{
    options.Authentication.Schemes = AuthenticationSchemes.Negotiate;
    options.Authentication.EnableKerberosCredentialCaching = true;
    options.Authentication.CaptureCredentials = true;
});
...
```

## Authentication State Serialization for Blazor Web Apps

If you are a Blazor developer, you know how complicated authentication is since [render modes](https://www.telerik.com/blogs/getting-started-blazor-new-render-modes-net-8) have been introduced in .NET 8. You can get an idea by reading [this excerpt](https://auth0.com/blog/auth0-authentication-blazor-web-apps/#Why-Is-Blazor-Authentication-More-Complicated-Now) from my tutorial on adding authentication to Blazor Web Apps. Basically, in an application model where components can be rendered on the server side, on the client side, and on both sides dynamically, you need to keep the user authentication state in sync between the two sides of your Blazor application. This leads to writing a fair amount of code, as you can see by taking a look [here](https://auth0.com/blog/auth0-authentication-blazor-web-apps/#Syncing-the-Authentication-State). In practice, you need to serialize the user authentication state on the server, then send it to the WebAssembly client, which in turn needs to deserialize it. In addition, both authentication states must be kept in sync in order to reflect on the client side the actual authentication state on the server.

Fortunately, .NET 9 simplifies this approach by providing two new methods:

- `AddAuthenticationStateSerialization()`, which adds the services to serialize the authentication state on the server.
- `AddAuthenticationStateDeserialization()`, which adds the services to deserialize the authentication state in the WebAssembly client.

Instead of creating the serializing and deserializing classes yourself, you can now simply call the two methods respectively on the server and on the client to sync the authentication state.

On the server, you will have:

```csharp
// Program.cs
...
builder.Services.AddRazorComponents()
    .AddInteractiveWebAssemblyComponents()
    .AddAuthenticationStateSerialization();
...
```

On the client, you will write the following:

```csharp
// Program.cs
...
builder.Services.AddAuthorizationCore();
builder.Services.AddCascadingAuthenticationState();
builder.Services.AddAuthenticationStateDeserialization();
...
```

Read the [documentation](https://learn.microsoft.com/en-us/aspnet/core/blazor/security/server/?view=aspnetcore-9.0&tabs=visual-studio#manage-authentication-state-in-blazor-web-apps) to learn more.

## Conclusion

Although they are not revolutionary innovations in authentication and authorization, these new features are very convenient because they aim to simplify the work of .NET developers.
In particular, PAR support prevents developers from implementing the extension specifications themselves and encourages the adoption of increasingly advanced security. Also, simplifying the serialization and deserialization of the authentication state in Blazor relieves developers of the burden of implementing specific classes, resulting in potentially fewer bugs.

Authentication and Authorization Enhancements in .NET 9.0

Nelson Matias

As a Group Product Manager at Auth0, I focus on delivering innovative solutions that enhance security and user experience for both businesses and developers. With hands-on experience as a Developer, Consultant, and Solution Architect, along with years of working in Technical Account Management, I’m passionate about solving complex problems and shaping the future of identity management.
Outside of work, I often watch football, listen to music, or spend quality time with my kids.

Group Product Manager

Continuous Session Protection empowers customers to meet a wide range of session and refresh token security needs, including custom lifetimes and revocation capabilities. Let’s dive deeper into how these features can enhance your security strategy.

Continuous Session Protection Now Available for Enterprise Customers

A guide to building B2B SaaS applications using Auth0 and the Auth0 Organizations feature.

A B2B SaaS Application Primer Using Auth0

auth0_by_okta_hero copy

Auth0 Team

Offering expanded access and optionality for self-service plans and features

**TLDR**: 
Self-service customers have access to Auth0 capabilities that previously required a call with sales. Effective immediately: (1) customers can now upgrade to our B2B Professional Plan directly through the dashboard, (2) the Enterprise Connection limit in the B2B Pro plan has been increased from 3 to 5, and (3) Pro plans customers can now add a single Enterprise MFA factor (called 'Enterprise MFA Lite') via self-service.

In November 2023, we introduced [updated self-service plans and pricing](https://auth0.com/blog/upcoming-pricing-changes-for-the-customer-identity-cloud/) to scale with our customers. As a continuation of this work and based on your feedback, we now offer self-service customers easier access to plans and capabilities that previously required a discussion with sales.

### Here’s what’s new, effective May 2024:

* You can now choose our [B2B Professional Plan](https://auth0.com/pricing) using your dashboard! The B2B Pro Plan includes: 
    * 5,000 M2M Authentications (more available as add-ons)
    * M2M Add-on
    * External Database
    * Cross App SSO
    * 5 Enterprise Connections (increased from 3)
    * 100 organizations
    * And other features included in the B2B Essentials plan.

    _To upgrade: [Dashboard > Settings (Subscription Tab)](https://manage.auth0.com/#/tenant/billing/subscription) > Select Plan & Quota > Click Upgrade or you can continue to purchase this plan through our Sales team._

* **5 Enterprise Connections** for the B2B Professional Plan's Enterprise Connection limits have increased from 3 connections to 5 connections via self-service. This will allow more of our SaaS customers to scale more effectively. As a reminder, there is no limit on [Okta Enterprise Connections](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/okta) for customers on all of our B2B plans.
* **Enterprise MFA Lite** is now available through self-service for both B2C and B2B Professional. This capability was only available via a contract with Sales, but it can now be added via the dashboard.
    * Enterprise MFA Lite allows you to add either SMS, push, or voice notifications to Professional plans for an additional fee. Fees vary by the amount of MAUs; find more information on [Dashboard > Settings (Subscription Tab.)](https://manage.auth0.com/#/tenant/billing/subscription)
    * This includes the support of push, [SMS, and voice notifications](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa), (SMS charges for MFA are charged separately by carriers supported by Auth0). Under Enterprise MFA Lite, subscriptions will be limited to one MFA factor on the subscription. 

### MFA Offerings Explained

MFA ([Multi-Factor Authentication](https://auth0.com/blog/multifactor-authentication-mfa/)) provides a method to verify a user's identity by requiring them to provide more than one piece of identifying information. For example, **something you know**: a password, PIN, or security question, **something you have**: a smartphone, security token, or smart card, or **something you are**: your fingerprint, face scan, or voice pattern.

Some of our MFA offerings include: 

* **Pro MFA** &mdash; included in B2C Professional, B2B Essentials, B2B Professional, and Enterprise plans 
* **Enterprise MFA Lite Add-on** &mdash; an add-on for B2B and B2C Professional plans and Enterprise plans
* **Enterprise MFA** &mdash; included in our Enterprise Plans 

![Pro Plan Improvements for Self-Service Customers - May 2024](https://images.ctfassets.net/23aumh6u8s0i/sTrHbEBf42kTVlbfp6mRt/2459de4604259c2031a9808dd2111efa/MFA_Table.png)

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b> Please note that upgrading to B2B Professional and adding Enterprise MFA Lite to B2B and B2C Professional plans will incur additional fees. Visit our <a href="https://auth0.com/pricing">pricing page</a> for more information.</b><br> 
</div>

### Which MFA factor(s) are best for my product?

Choosing the right [MFA factor](https://auth0.com/docs/secure/multi-factor-authentication#mfa-factors) is all about striking a balance between security and user experience. Consider the sensitivity of the accounts you're protecting, the technical comfort level of your users, and the accessibility of the MFA factor across different devices. 

![Not All MFA is Created Equal](https://images.ctfassets.net/23aumh6u8s0i/5TgjqFrUJwTDkldGCqov7o/6d80ca9d9c0d29faebea01578a02e0b6/Not_All_MFA_is_Created_Equal.png "Not All MFA is Created Equal")
<p align="center"><i>From blog post: <a href="https://auth0.com/blog/not-all-mfa-is-created-equal/">Not All MFA is Created Equal</a></i></p>

<p align="left"</p>
To help evaluate our MFA offerings, visit this [blog post](https://auth0.com/blog/not-all-mfa-is-created-equal/) to learn about your options and for more details on factor types and authentication assurance levels, check out [this datasheet](https://www.okta.com/resources/datasheet-factor-assurance/).

### Have more questions about your plan or our MFA offerings?

We’re here to help! If you’re on a paid plan, our [Support team](https://support.auth0.com/) can help, and if you’re on a free plan, you can post in our [Community forum](https://community.auth0.com/). Thanks for being a valued customer. We hope this allows for more flexibility and optionality during your auth journey. Happy authenticating!

Pro Plan Improvements for Self-Service Customers - May 2024

jimena-garbarino

Jimena is an experienced result and value-oriented programmer with a strong engineering background. She excels with Ruby on Rails, Java, and Scrum development. She has worked in web development for 10+ years in many industries and has a master's degree in software engineering from Universidad de Buenos Aires.

Spring Cloud Developer

Jimena Garbarino

Learn how to use Spring Boot, Java, and Auth0 to secure a feature-complete API by implementing authorization in Spring Boot with Auth0.

Add Security and Authorization to a Java Spring Boot API

A new version of the Auth0 Templates for .NET package has been released: discover the new powerful features.

In May, we [announced the release of Auth0 Templates for .NET](https://auth0.com/blog/introducing-auth0-templates-for-dotnet/), a NuGet package that allows .NET developers to scaffold a new project with Auth0 embedded. Today, we are announcing the release of a new powerful version of the package: [Auth0 Templates for .NET 2.1](https://www.nuget.org/packages/Auth0.Templates). 🎉

Go to your terminal window and install the new package by running the following command:

```bash
dotnet new install Auth0.Templates
```

> ⚠️ If you already have a previous version of the package installed on your machine, please uninstall it using the following command before installing the new package:
>
> ```bash
> dotnet new uninstall Auth0.Templates
> ```
>
> 

Let's explore what's new and how you can now create **a working application with Auth0 authentication in less than a minute!**

## Auth0 CLI integration

The most prominent feature introduced in this new release is the integration with the [Auth0 CLI](https://github.com/auth0/auth0-cli), the command line tool that allows you to manage your Auth0 tenants and your application registration from your terminal window.

> 📖 If you are new to the Auth0 CLI, take a look at [the Auth0 CLI Basics Lab](https://developer.auth0.com/resources/labs/tools/auth0-cli-basics) to learn how to use it.

If you have the Auth0 CLI installed on your machine and are already logged in to your Auth0 tenant, you can have your new application automatically registered. Let's do an example to better explain.

### Self-Registration in .NET CLI

Suppose you want to create a Blazor Server application with Auth0 authentication embedded. You can start by running the following command in a terminal window:

```bash
dotnet new auth0blazorserver -o MyBlazorServerApp
```

This command uses the `auth0blazorserver` template to create a Blazor Server application in the `MyBlazorServerApp` folder.

After launching the command, you will see a message similar to the following:

```bash
The template "Auth0 Blazor Server App" was created successfully.

Processing post-creation actions...

Template is configured to run the following action:
Actual command: register-with-auth0.cmd 
Do you want to run this action [Y(yes)|N(no)]?
```

With this message, the template engine asks if you want to register the newly created application with Auth0.

Once you confirm, the new Blazor application will be registered on your current Auth0 tenant. You will see the registration data onscreen for documentation purposes only, as you don't need to configure it manually. In fact, your new application will be automatically configured. All you need to do is run your Blazor application with `dotnet run`!

As you can see, using the integration with the Auth0 CLI allows you to have **an application up and running in less than a minute!**

Of course, you can still pass the configuration options on the command line in case you don't have the Auth0 CLI installed or if you have already registered the application with Auth0. See the [specific options for each template](https://github.com/auth0/auth0-dotnet-templates#usage) for more details.

### Auth0 registration in Visual Studio

If you are using the templates with Visual Studio, you can't leverage the self-registering feature. This is not a limitation of the template, but a restriction imposed by Visual Studio (see [this issue](https://github.com/dotnet/templating/issues/4575) for context).

However, you can run the registration action manually. So, assuming you want to create your Blazor Server application with Visual Studio, select the Auth0 Blazor Server App template as shown in the following picture:

![Auth0 Blazor Server template in Visual Studio](https://images.ctfassets.net/23aumh6u8s0i/4vIKOhrrozhmSDMkYPsEUr/5bd66766af25db726fb3aca5c4d731ab/auth0-blazorserver-app-vs.png)

Then, accept the default values proposed by the template configuration window and create the project.

After the project is created, go to the newly created application and run the following command:

```bash
./register-with-auth0.cmd
```

This command will automatically register your Blazor Server application with Auth0 and configure your application.

> Note: On MacOS you must enable the script to execute. Run the following command before launching the automatic registration:
>
> ```bash
> chmod +x register-with-auth0.cmd
> ```

## .NET 8 Support

The new release of Auth0 Templates for .NET supports .NET 8 by default for most templates. When you use the `dotnet new` command without specifying a framework version, you will get a .NET project with .NET 8 as the target framework. This is also the default .NET version when you are using Visual Studio, as shown below:

![Auth0 Template for ASP.NET Core MVC targeting .NET 8](https://images.ctfassets.net/23aumh6u8s0i/1mnYGKi2t006MED0sC2raQ/902bd9cb7b94be9e4b0d4c6c14b9d3ea/auth0-mvc-app-vs-options.png)

Blazor templates do not currently support .NET 8, but they still target .NET 7. The reason for this choice depends on the new .NET 8 Blazor model, which provides a more fluid approach between the Server and the WebAssembly hosting models. Currently, there are no official guidelines on how to integrate OpenID Connect with the new Blazor model. If you are interested in this topic, you can follow [this thread in the Auth0 Community forum](https://community.auth0.com/t/net-8-0-blazor/119691) to stay updated.

<include src="ebook-ads/dotnetIdentity" />

## Minimal API Template

The [Auth0 Templates for .NET package](https://www.nuget.org/packages/Auth0.Templates/) contains four templates since its first release:

- ASP.NET Core MVC
- ASP.NET Core Web API
- Blazor Server
- Blazor WebAssembly (ASP.NET Core hosted)

This new release adds a new template for [ASP.NET Core minimal API](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis). To use this template, add the `--minimal` option to the `dotnet new auth0webapi` command, as shown in the following example:

```bash
dotnet new auth0webapi -o MyWebAPI --minimal
```

This command creates a minimal API project in the `MyWebAPI` folder, and if you have the .NET CLI installed on your machine, it also registers it with Auth0.

In Visual Studio, you can simply select the *Use minimal API* checkbox as shown in the following picture:

![Options for the Auth0 ASP.NET Core Web API template in Visual Studio](https://images.ctfassets.net/23aumh6u8s0i/30Wl7yaOdnuWBhmdbRZa3v/259aa7ca9bb215da9fba8e62bfee8d87/auth0-webapi-app-vs-options.png)

## Looking Ahead

We hope that these new features will help .NET developers set up their new applications with Auth0 more easily than before. Our goal for the next release is to include a template for the missing Blazor model and add templates for other .NET application types.

Your feedback is valuable. If you experience a problem or have a request, please [open an issue](https://github.com/auth0/auth0-dotnet-templates/issues/new/choose) on the project's GitHub repository.

Remember that [Auth0 Templates for .NET](https://github.com/auth0/auth0-dotnet-templates) is an open source project, so your contribution is welcome! If you think you can help, check out [our contribution policy](https://github.com/auth0/auth0-dotnet-templates/tree/main#contributing) and get involved.



Auth0 Templates for .NET: A New Powerful Version Released

Let’s explore the new features brought by .NET 8 to support authentication and authorization in your applications.

The release of **.NET 8** is just around the corner. Among the amazing features it brings to developers, it offers a minor revolution in support for authentication and authorization: moving ASP.NET Core Identity from a page-oriented approach to an API-oriented approach.

Let's explore what's going on.

## ASP.NET Core Identity and Token-based Authentication

ASP.NET Core developers have the built-in [ASP.NET Core Identity](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity) framework to add support for local authentication and authorization. The identity framework includes everything that developers typically need to authenticate and authorize users against a local user store. By default, a SQL Server database is created on Windows and a SQLite database is created on macOS, but you can change it to the DBMS of your choice.

The ASP.NET Core Identity framework is designed for server-rendered web applications, such as ASP.NET Core MVC or Razor Pages applications, and has challenges with SPAs, where token-based authentication seems more appropriate. To address this problem, Microsoft has provided built-in project templates for SPAs based on Angular and React with Identity Server support since .NET Core 3.1. However, the .NET community [has not been totally happy with this approach](https://github.com/dotnet/aspnetcore/issues/42158). To [meet the community's demands](https://github.com/dotnet/aspnetcore/issues/42158#issuecomment-1481742187), Microsoft removed the default support for Identity Server in .NET 8 and redesigned the internal architecture of ASP.NET Core Identity to be more suitable for SPAs and native apps. .NET 8 introduces a new set of Identity API endpoints and support for token-based authentication. But let's go in order.

## Bearer Token Authentication Handler

The first building block of this new infrastructure is the new [bearer token authentication handler](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.bearertokenextensions.addbearertoken). This handler is similar to the classic [cookie authentication handler](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.cookieextensions.addcookie) that ASP.NET Core Identity uses by default. The cookie authentication handler is responsible for two things:

- Creating a new session cookie after the user authenticates.
- Building a `ClaimsPrincipal` user object based on a valid session cookie received in the incoming HTTP request.

Similarly, the bearer token authentication handler is responsible for:

- Creating a new token after the user authenticates.
- Building a `ClaimsPrincipal` user object based on a valid token received in the incoming HTTP request.

In other words, the bearer token handler mimics the behavior of the cookie handler to manage authenticated sessions based on a token instead of a cookie.

> Note that the tokens generated by the bearer token handler are not in JWT format. Also, they don't follow any specific standard. While the documentation mentions [access tokens](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.bearertoken.accesstokenresponse.accesstoken?view=aspnetcore-8.0) and [refresh tokens](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.bearertoken.accesstokenresponse.refreshtoken?view=aspnetcore-8.0), they do not implement the [OAuth 2.0 authorization framework](https://oauth.net/2/).

How can this bearer token handler be used in practice?

Consider the following code:

```csharp
// Program.cs

using Microsoft.AspNetCore.Authentication.BearerToken; //👈
using System.Security.Claims;
 
var builder = WebApplication.CreateBuilder(args);
 
builder.Services
    .AddAuthentication()
    .AddBearerToken();  //👈
builder.Services.AddAuthorization();
 
var app = builder.Build();
 
app.MapGet("/login", (string username) =>
    {
        var claimsPrincipal = new ClaimsPrincipal(
          new ClaimsIdentity(
            new[] { new Claim(ClaimTypes.Name, username)},
            BearerTokenDefaults.AuthenticationScheme  //👈
          )
        );

        return Results.SignIn(claimsPrincipal);
    });
 
app.MapGet("/user", (ClaimsPrincipal user) =>
    {
        return Results.Ok($"Welcome {user.Identity.Name}!");
    })
    .RequireAuthorization();
 
app.Run();
```

This application defines two API endpoints:

- The `/login` endpoint creates a `ClaimsPrincipal` user object based on the username sent in the HTTP request and returns the result of signing in.
- The `/user` endpoint returns the username of the authenticated user.

Note the highlighted lines in the code. You have a reference to the new `Microsoft.AspNetCore.Authentication.BearerToken` namespace, which gives you access to the `BearerTokenDefaults.AuthenticationScheme` value. You also configure the bearer token middleware by using the `AddBearerToken()` extension method.

Now, assume you call the `login` endpoint with curl, as shown below:

```bash
curl 'https://<YOUR_HOST>/login?username=joe'
```

You will see a result like the following:

```json
{
  "token_type": "Bearer",
  "access_token": "CfDJ8Ha5YkqG...omitted content...",
  "expires_in": 3600,
  "refresh_token": "CfDJ8Ha5YkqG...omitted content..."
}
```

This JSON contains an access token and a refresh token that you can use to make your calls to the protected APIs exposed by your application. For example, you can now call the protected `/user` endpoint as follows:

```bash
curl -i https://<YOUR_HOST>/user \
-H 'Authorization: Bearer CfDJ8Ha5YkqG...omitted content...'
```

And you will get the following response:

```json
Welcome joe!
```

In summary, the bearer token authentication handler makes it very easy to set up token-based authentication. This is the building block of the whole ASP.NET Core Identity transition to token-based authentication.

## Identity API Endpoints

The second step in adding token-based authentication to ASP.NET Core Identity is to introduce the Identity API endpoints. Basically, this is an API version of the actions that you can perform with ASP.NET Core Identity through the classic web UI. Once you enable the [Identity API endpoints](https://github.com/dotnet/aspnetcore/blob/main/src/Identity/Core/src/IdentityApiEndpointRouteBuilderExtensions.cs), you will get endpoints like `/register`, `/login`, `/forgotPassword`, `confirmEmail`, etc.

The Identity API endpoints solve two of the most complained problems:

- You can build your own UI for user authentication and account management while maintaining the overall UI style of your application.
- After authentication, your app can get access tokens instead of cookies, so it's a more suitable approach for SPAs and native applications.

> Keep in mind that the Identity API endpoints do not implement [OpenID Connect (OIDC)](https://auth0.com/docs/authenticate/protocols/openid-connect-protocol). They simply expose the standard functionality provided by the ASP.NET Core Identity UI through a custom API. They are intended for first-party authentication.

Adding the Identity API endpoints to an ASP.NET Core application relies on two new methods:

- `AddIdentityApiEndpoints()`, which configures the token-based authentication using the bearer token handler in addition to the cookie authentication, and adds a set of identity services.
- `MapIdentityApi()`, which actually adds the Identity endpoints to your application.

The code in your `Program.cs` file will look like the following:

```csharp
// Program.cs

using System.Security.Claims;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthorization();

builder.Services.AddDbContext<ApplicationDbContext>(
    options => options.UseSqlite(builder.Configuration["ConnectionString"]));

builder.Services.AddIdentityApiEndpoints<IdentityUser>()
    .AddEntityFrameworkStores<ApplicationDbContext>();

var app = builder.Build();

app.MapIdentityApi<IdentityUser>();

app.MapGet("/user", (ClaimsPrincipal user) =>
    {
        return Results.Ok($"Welcome {user.Identity.Name}!");
    })
    .RequireAuthorization();

app.Run();
```

Your client will be able to register a user by calling the `/register` endpoint, authenticate the user through the `/login` endpoint, and so on.

While the Identity API endpoints seem to solve the two main complaints about the classic ASP.NET Core Identity, there are [some concerns about using them in a production context](https://andrewlock.net/should-you-use-the-dotnet-8-identity-api-endpoints/), mainly on the security and scalability side.

## Blazor Identity UI

In addition to the changes to ASP.NET Core Identity, .NET 8 integrates the authentication framework into the Blazor project template. You can create a new .NET 8 Blazor application with identity support by running the following command:

```bash
dotnet new blazor -au Individual
```

You will get a Blazor application with everything you need to manage users and authentication locally. You will get a SQLite database to store the user accounts. You will get a SQL Server database if you use Visual Studio to scaffold the application instead of the .NET CLI. You also will get all the pages that allow users to register, authenticate, and manage their account.

The following image shows the built-in login page of a Blazor app:

![Blazor login page](https://images.ctfassets.net/23aumh6u8s0i/3J8DlVMk9qsHw9tLIAwpue/cd94d62d51ce5dc6627bda3c75d14a42/blazor-identity-ui-login.png)

The user authentication and management pages that implement the Blazor Identity UI are not Razor pages as it happens with the classic ASP.NET Core Identity, but [Razor components](https://learn.microsoft.com/en-us/aspnet/core/blazor/components). The template provides you with the source code for all of the UI components in the `Pages/Account` folder of the project. This allows you to customize them according to your application design.

<include src="ebook-ads/dotnetIdentity" />

## Custom Authorization Policies Simplification

Apart from the new features related to ASP.NET Core Identity, .NET 8 introduces a simplification to the definition of custom authorization policies. Previously, you had to write a lot of code to define a parameterized authorization policy to apply to an API endpoint.

For example, suppose you want to define a policy for an endpoint that only authorizes users over the age of 18 and that can be used as shown below:

```csharp
[ApiController]
[Route("api/[controller]")]
public class DrinkController : Controller
{
    [MinimumAgeAuthorize(18)]
    [HttpGet("beer")]
    public string BeerDispenser(ClaimsPrincipal user) => $"Here is your beer, {user.Identity?.Name}!";
}
```

With previous .NET versions, to implement your custom authorization policy, you must write the code outlined in the following code snippet:

```csharp
class MinimumAgeAuthorizeAttribute : AuthorizeAttribute
{
  ...
}

class MinimumAgePolicyProvider : IAuthorizationPolicyProvider
{
  ...
}

class MinimumAgeRequirement : IAuthorizationRequirement
{
  ...
}

class MinimumAgeAuthorizationHandler : AuthorizationHandler<MinimumAgeRequirement>
{
  ...
}
```

You must define an `AuthorizeAttribute`. Then you need to implement an `IAuthorizationPolicyProvider` to handle your custom policy and an `IAuthorizationRequirement` to define the requirement. Finally, you have to implement the `AuthorizationHandler`.

The code snippet shown above outlines the classes you need to implement. To see an example of the actual implementation, take a look at this [code sample](https://gist.github.com/captainsafia/309e408cb5e2c2e5acd44d2e19f7f88e).

Using the new `IAuthorizationRequirementData` interface, your implementation code becomes as follows:

```csharp
class MinimumAgeAuthorizeAttribute : AuthorizeAttribute, IAuthorizationRequirement, IAuthorizationRequirementData
{
  public MinimumAgeAuthorizeAttribute(int age) => Age =age;
  public int Age { get; }

  public IEnumerable<IAuthorizationRequirement> GetRequirements()
  {
    yield return this;
  }
}

class MinimumAgeAuthorizationHandler : AuthorizationHandler<MinimumAgeAuthorizeAttribute>
{
  protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, MinimumAgeAuthorizeAttribute requirement) 
  {
    ...
  }
}
```

You only need to implement two classes instead of four as in the previous example. See [here](https://gist.github.com/captainsafia/7c54e92d12df695ff0908e989fb8531f) for the complete code.

## Summary

Throughout this article, you have learned about the new features that .NET 8 brings to support authentication and authorization. Most of these features are related to the extension of the ASP.NET Core Identity framework to support token-based authentication, which paves the way for authentication in SPAs and native applications.

As a side effect, you get access to the bearer token authentication handler, which allows you to issue access tokens, and to the Identity API endpoints, which allow you to embed authentication support in your Web API.

In addition, the Blazor project template now supports authentication through the Identity API endpoints and a rich set of Razor components designed for user authentication and management.

Finally, the new `IAuthorizationRequirementData` interface allows you to create custom authorization policies with less code.


.NET 8: What's New for Authentication and Authorization

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Juan Cruz Martinez

Let's explore the main features of the new Auth0 SDK for NextJS release.

For almost a year now, the team at Next.js has been building the foundations for the future of Next.js, a future based on the React architecture, which includes Server Components, Server Actions, and much more.

With the introduction of Next.js 13.4 a few months ago, the new [App router](https://nextjs.org/blog/next-13-4#nextjs-app-router) architecture with support for React Server Components, nested routes, layouts, and new data fetching design, was promoted to stable and is the recommended option for newly built Next.js applications.

These new fundamental changes in architecture and APIs on Next.js meant that many libraries with support for Next.js had to undergo changes to fully utilize and benefit from the latest release.

<AmpContent>
<amp-youtube
    data-videoid="9ubpQ_VW158"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/9ubpQ_VW158' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Auth0's first SDK for Next.js dates back to 2021. Since then, we have been committed to the Next.js community by providing a robust, scalable, and developer-friendly SDK for implementing user authentication. We are **very happy to announce the stable release of the [Auth0 Next.js SDK v3](https://github.com/auth0/nextjs-auth0/releases/tag/v3.0.0)** with support for App Router, Edge Runtime, and Responses in Middleware.  We’ve created this [quickstart guide](https://auth0.com/docs/quickstart/webapp/nextjs/01-login) that demonstrates how to integrate Auth0 with any new or existing Next.js application using the Auth0 Next.js SDK.

## What Do I Need to Do With Existing Applications Using Pages Router?

Not much. Like Next.js, the Auth0 Next.js SDK `v3` continues to support the Pages Router and the new App Router. When updating to the new SDK, there are three considerations to keep in mind:

- As is the case for Next.js `v13.4`, the new SDK requires [Node `v16` LTS or newer releases](https://nodejs.org/en/download).
- For TypeScript applications, differences in function signatures that support both the Pages and App Router may require you to use explicit declarations for the `request` and `response` objects to help TypeScript infer their type correctly. For example:
    - Before:
    
    ```typescript
    import { withApiAuthRequired } from '@auth0/nextjs-auth0'
    
    export default withApiAuthRequired(async function handler(req, res) {
      res.status(200).json({});
    });
    ```
    
    - After:
    
    ```typescript
    import { NextApiRequest, NextApiResponse } from 'next';
    import { withApiAuthRequired } from '@auth0/nextjs-auth0'
    
    export default withApiAuthRequired(async function handler(req: NextApiRequest, res: NextApiResponse) {
      res.status(200).json({});
    });
    ```
    
- The `/401` handler has been removed: As of Next.js `v13.1`, you can now return responses from middleware. As such, the unauthorized handler has been removed in favor of an unauthorized response.

If you need to migrate your application from the Auth0 Next.js SDK `v2` to the latest version, please follow our official [`v3` migration guide](https://github.com/auth0/nextjs-auth0/blob/main/V3_MIGRATION_GUIDE.md).

## Working with the New App Router

Working with the new App Router requires a shift in the architecture and project structure of your Next.js application, and as a result of this new architecture, there are a [few limitations](https://github.com/auth0/nextjs-auth0/tree/main#important-limitations-of-the-app-directory) that you need to understand before implementing authentication for your application or working with cookies and sessions in general.

These are the steps to add authentication to your Next.js application using the latest version of the Auth0 Next.js SDK:

### Install the Auth0 SDK for Next.js

First and foremost, install the Auth0  Next.js SDK using the following command:

```bash
npm install @auth0/nextjs-auth0
```

### Add the dynamic API route

As was the case for Pages Router, the Auth0 SDK automatically creates a series of API routes or endpoints to handle essential authentication features such as login, logout, and getting user information.

For the Auth0 Next.js SDK to create such routes, it is necessary to create a [catch-all, dynamic API route handler](https://nextjs.org/docs/app/building-your-application/routing/dynamic-routes) under the `/app/api` directory. Technically speaking, you don’t need to use the `api` directory anymore to specify API routes. However, our SDK follows that convention for simplicity and clarity.

Then, create a `route.js` or `route.ts` file under the `/app/api/auth/[auth0]/` directory and populate it with the following code:

```javascript
import { handleAuth } from '@auth0/nextjs-auth0';

export const GET = handleAuth();
```

### Make the Auth0 hooks accessible throughout your application

When working on the client side of your Next.js application, you can use the `useUser()` hook from the Auth0 Next.js SDK to retrieve information about the current user and session. Since this hook leverages the React Context API to manage and communicate the authentication state of the user, you’ll have to wrap your components with a `UserProvider`. 

When using the Next.js App Router, you should wrap your [root layout](https://nextjs.org/docs/app/building-your-application/routing/pages-and-layouts#layouts) with `UserProvider` as follows:

```javascript
// app/layout.js
import React from 'react';
import { UserProvider } from '@auth0/nextjs-auth0/client';

export default function App({ children }) {
  return (
    <UserProvider>
      <body>{children}</body>
    </UserProvider>
  );
}
```

### Access user and session information

You can check if a user is authenticated by verifying that the `user` object returned by the `useUser()` hook is defined. Additionally, you can log in or log out of your users from the client layer of your Next.js application by redirecting them to the corresponding automatically-generated route.

Here is an example of a client component accessing and using user information to build a basic login, logout user flow.

```javascript
// pages/index.js
'use client';
import { useUser } from '@auth0/nextjs-auth0/client';

export default function Index() {
  const { user, error, isLoading } = useUser();

  if (isLoading) return <div>Loading...</div>;
  if (error) return <div>{error.message}</div>;

  if (user) {
    return (
      <div>
        Welcome {user.name}! <a href="/api/auth/logout">Logout</a>
      </div>
    );
  }

  return <a href="/api/auth/login">Login</a>;
}
```

## What’s Next

With the release of the Auth0 Next.js SDK v3, we are excited to continue supporting the Next.js community with a comprehensive solution for user authentication and route protection.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b>To get started, create a free account at <a href="https://auth0.com/signup?utm_source=partner&utm_medium=vercel-okta&utm_campaign=2023-03%7CINB-ORG%7CVercel-Auth0-SignupUserCreationForm-SU&ocid=7014z000000zJItAAM-aPA4z0000008OZeGAM&utm_id=aNK4z000000blT4GAI">Auth0.com</a>.</b><br> 
</div>

In this article, we only covered the basics, and if you want to learn more about how to secure your application, please check the official [GitHub repository for the SDK](https://github.com/auth0/nextjs-auth0) as well as some [examples of practical use cases](https://github.com/auth0/nextjs-auth0/blob/main/EXAMPLES.md), or check out our [Next.js code samples](https://developer.auth0.com/resources/code-samples/web-app/nextjs/basic-authentication). To get started on Next.js Authentication with Auth0 check out this [blog post](https://auth0.com/blog/ultimate-guide-nextjs-authentication-auth0/).

Auth0 by Okta is committed to providing our community and customers with a smooth yet robust developer experience to secure their applications. We continue to look for ways to improve our products and shape the future of authentication. We'd love to hear about your experience using our latest iteration of the Auth0 Next.js SDK.

Thanks for reading!

Auth0 Stable Support For Next.js App Router!

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Auth0 at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community.

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [**Products That Count**](https://productsthatcount.com/) and [**Aiven.io**](http://Aiven.io).


President, Auth0

Shiven Ramji

Over the last 6 months, Okta has delivered capabilities designed with security, scalability, and resiliency in mind. Read about what we delivered and our future roadmap.

Our teams have been heads down and focused on delivering capabilities that empower our customers to continue to provide seamless customer experiences and power their SaaS ambitions. As we are now halfway through the calendar year, I wanted to reflect on the capabilities we have delivered and give you a glimpse of what's to come next. 

## Unveiling New and Improved Product Features

We strive for innovation and resiliency in our work since we know it translates into direct value for our customers. Over the past six months, our teams have worked across domains to deliver capabilities meticulously designed with security, scalability, and resiliency in mind.

### Flexibility Focus

We continue to double down on improving our customers' ability to build great user experiences within consumer apps. The team has persistently strived to provide a flexible way to build identity flows. In the past few months, we've launched a few enhancements to support this goal further.

* [Passwordless support on New Universal Login](https://auth0.com/docs/authenticate/passwordless/passwordless-with-new-universal-login) allows users to provide an email address or phone number and receive a one-time password (OTP) to complete authentication.
* [Additional email provider support](https://auth0.com/changelog#3yVUYwYINRo7edOw8tP7kG) (Azure Communication Service & Microsoft Modern Auth) enables customers to use Outlook on Microsoft 365 or the recently released Azure Communication Services as preferred authentication methods.

### SaaS Excellence

With a keen eye for enhancing user experiences and elevating customer satisfaction, we continue to make strides that redefine and advance SaaS excellence. To that end, the teams have released several new features:

* [PKCE and attribute mapping are available on OIDC and Okta Workforce Connections](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/configure-pkce-claim-mapping-for-oidc), allowing customers to build more secure connections between Auth0 and your connected identity provider. With attribute mapping, you can sync more attributes from your IDP into your Auth0 tenant.
* [Improved Login Flow for SaaS Users](https://auth0.com/docs/manage-users/organizations/login-flows-for-organizations) includes options for tying identifier first Home Realm Discovery to Connections with IdP domains associated with Organizations and a New Universal Login Prompt that displays when configured for end users with multiple organization memberships. 
* [Organization Name support for launching Login flows](https://auth0.com/docs/manage-users/organizations/configure-organizations/use-org-name-authentication-api), making Organizations easier to use by enabling the Organization Name to launch login flows via the Authentication API.

### Making Security Easy

At the core of everything we do is the desire to make security seamless and straightforward. Safeguarding data should be uncomplicated yet foolproof. Our latest releases offer protection and make it intuitive, empowering our customers and their users to navigate the digital world without compromise.

* [Security Center is now available on Converged Platform](https://auth0.com/docs/secure/security-center), a new security feature that provides real-time monitoring of potential security events.
* [Bot Detection Slider for Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection#use-bot-detection-slider) provides the ability to adjust the level of friction of the "When Risky" setting on our Bot Detection model.
* [Bot Detection is Now Integrated with Friendly Captcha and hCaptcha](https://auth0.com/docs/secure/attack-protection/bot-detection#configure-bot-detection), supporting additional Captcha Providers and their capabilities. 
* [Teams: Security Policies - SSO Enforcement Early Access](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#configure-security-policies), providing the option to mandate login to Teams and Manage Dashboard through the organization's enterprise IdP.

### Developer Experience

Our Developer Experience teams built the following enhancements with intention, care, and a complete developer experience in mind. With streamlined workflows and a suite of tools, developers quickly translate their application experience vision into reality.

* [Node 18 is now available for Actions, Rules, and Hooks](https://auth0.com/changelog#2xzzvhZDXiRbThfc7XsfO). You can start using Node 18 in your tenants' settings and/or when creating new Actions in the Auth0 Manage Dashboard.
* [Auth0 Terraform Provider V1 - BETA](https://auth0.com/changelog#515sGCwZW2u6bD06rzS1uC), with the v1 release, managing your Auth0 resources using Terraform has never been easier. 
* [Auth0 Management API](https://auth0.com/docs/api/management/v2) launched, which includes numerous new features and enhancements for the UI experience.
* [Teams: Security Policies - SSO Enforcement](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#configure-security-policies), allowing you to mandate login to Teams and Manage Dashboard through the organization's enterprise IdP.

### Customer Delight

We obsess over giving customers the complete capabilities to deliver a delightful customer experience. Every interaction and every touchpoint is an opportunity to elevate the customer journey. Our latest achievements stand as a testament to our dedication to not only meeting but exceeding the expectations that define customer delight.

* [Guardian App Localization](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian): The Guardian app is available as an authenticator to deliver push notifications to a user's pre-registered device (mobile phone or tablet) and supports English - US (en-us), French - Canada (fr-ca), French - France (fr), Portuguese - Brazil (pt-br), and Spanish - Argentina (es-ar).
* [Universal Login: New Language Support](https://auth0.com/docs/customize/internationalization-and-localization/universal-login-internationalization): Six new languages are now available as supported translations for Universal Login: Basque: eu-ES; Catalan: ca-ES; Galician: gl-ES; Norwegian: no; Norwegian Nynorsk: nn; and Welsh: cy.
* [Custom Domains in Guardian SDKs](https://auth0.com/changelog#7brExNHNLtHshVHvayBm6L), building your users' confidence that they are providing their credentials to the proper party. Custom Domains allow authentication to happen within the context of your brand.

The [Auth0 Changelog](https://auth0.com/changelog) has the full details and documentation on these updates and serves as the real-time release center. 

## Looking Forward to the Next Half

We've made good progress on delivering our roadmap and have steadily released capabilities that help our customers deliver seamless and secure experiences for their customers. 

A big thank you to all of our teams, and looking forward to penning another post full of releases in the next six months. 

[Oktane](https://www.okta.com/oktane/) is just around the corner, where we'll pull back the curtain on what's still to come! Registration is now open, and we hope to see you there.

Unveiling New and Improved Product Features — 6 Month Lookback

Nabeel-Saeed

Nabeel is a product marketer focused on all things security and identity. He has contributed to publications like Wirecutter, Information Age, and Professional Security. He has also been a guest speaker at the Bay Area Cybersecurity Meetup, and delivered talks on IAM across the US, Canada, Israel, and Singapore. He is passionate about helping build secure auth experiences that amaze users and delight businesses.

Product Marketing

Nabeel Saeed

New feature provides real-time monitoring of potential identity security events and threat response efficacy

Auth0 today announced the general availability of Security Center, a new feature that helps enterprise customers optimize their identity security posture by leveraging insights from Auth0 to provide a single view of authentication events, potential security incidents, and threat response efficacy. It includes real-time data on companies’ current state of attack protection, out-of-the-box threat monitoring on major identity attack vectors, and application-level visibility into authentication traffic.

Determining whether an organization’s identity security posture is too restrictive or too lax is not trivial. Customers currently need to parse through logs 3rd party tools or build their own, which requires expert-level experience to effectively identify attacks and be ready to respond to them. Security Center provides an improved way to visualize this type of data directly from the Auth0. 

Security Center leverages Auth0 security insights to provide CISOs, Security Operations Professionals, and Identity teams a faster way to detect and respond to identity threats. It provides a streamlined view of authentication events, potential incidents, and threat response efficacy, allowing them to optimize their security posture without having to risk their bottom line after going through the learning curve themselves.

![Attack Protection](https://images.ctfassets.net/cdy7uua7fh8z/2hyZMfdrGwVZxKtuV4ZOR3/f1795066d12eb02550da8f4eb0f00fd5/Threat_Behavior.png)

“Accurate detection alone doesn’t ensure threat response is appropriate to the level of risk, given other business objectives like customer acquisition, retention, and growth,” said Jameeka Aaron, Chief Information Security Officer, Customer Identity at Okta. “As attacks against identity flows get more sophisticated and evolve to bypass detection, security teams often have to go through a learning curve on their own production environments, which can mean delayed detection of attacks and consequent business losses. Security Center leverages our focused expertise in identity security and packages it in a way that security operations professionals can understand and take action.”

Account takeover attacks targeting everything from sensitive healthcare data to loyalty points are one of the most common and costly cyber threats. Verizon’s 2022 Data Breach Investigations Report (DBIR) found that 80% of corporate breaches involve compromised identity solutions*. Security Center takes the work out of building your own tooling to identify and be able to respond to identity threats in a timely manner. Customers can understand their identity security landscape with summary visualization of major attack types, authentication events, and threat monitoring.

Security Center also allows companies to measure user experience impacts of Attack Protection features. Consumer-facing apps must balance security with user experience by minimizing friction while maintaining appropriate protection against identity attacks. Security Center shows app owners in near-real time UX effects of defense tactics, allowing them to adjust security and friction as appropriate to their situation. Companies can fine-tune their attack protection strategy by seeing in near real-time how defense tactics like MFA, rate limiting, and CAPTCHA affect their applications.

Security Center is available for all Enterprise customers. Learn more about implementing Security Center [here](https://auth0.com/docs/secure/security-center).

### About Okta

Okta is the World’s Identity Company. As the leading independent Identity partner, we free everyone to safely use any technology—anywhere, on any device or app. The most trusted brands trust Okta to enable secure access, authentication, and automation. With flexibility and neutrality at the core of our Okta Workforce Identity and Customer Identity Clouds, business leaders and developers can focus on innovation and accelerate digital transformation thanks to customizable solutions and more than 7,000 pre-built integrations. We’re building a world where Identity belongs to you. Learn more at [okta.com](https://www.okta.com/).


Auth0 Adds Security Center to Enterprise Plan

The Auth0 team released a new major version of the [Auth0 NextJS SDK](https://github.com/auth0/nextjs-auth0) which incorporates much of the received feedback from our v1, including support for NextJS middleware, changes in the API, first-class testing support, optimizations on the Front End package, and lots more.

This article will cover some of the most significant changes, but for a complete set, plus indications on how to migrate your current project to the new SDK, I recommend following the official [migration guide](https://github.com/auth0/nextjs-auth0/blob/v2.0.0/V2_MIGRATION_GUIDE.md).


## NextJS Middleware Support

The introduction of NextJS middleware in v12 was a big step for the framework that allows you to run code before a request is completed.

This support has been highly requested by the community, and the benefits can be summarized in two aspects: simplification and performance improvement.

### It's a lot easier to add authentication code

Prior to middleware support, each page that required authentication would need to add a snippet of code to tell NextJS only to allow access to authenticated users.

In v2, all that spread-out code can be rewritten at a single location by using middleware like the following:

```javascript
// middleware.js
import { withMiddlewareAuthRequired } from '@auth0/nextjs-auth0/middleware';

export default withMiddlewareAuthRequired();

export const config = {
  matcher: '/user/:path*',
}
```

With that simple configuration, NextJS will run the middleware `withMiddlewareAuthRequired` when the URL matches the given `matcher` expression. The matcher expressions are a feature of NextJS, they are very customizable, and you can read more information about them on [NextJS's middleware docs](https://nextjs.org/docs/advanced-features/middleware#matcher).

### Performance

Since middleware in NodeJS runs on the [NextJS Edge Runtime](https://nextjs.org/docs/api-reference/edge-runtime), validating user sessions at that level gives an immediate performance boost by simply reducing the latency for users. It is no longer required for the request to be sent to the origin server and back if the user is not authenticated.

In the image below, you can see how the NextJS Middleware Architecture plays a role in performance by being closer to the user's location.

![NextJS Middleware Architecture](https://images.ctfassets.net/23aumh6u8s0i/6jmWEwH1yBEc8Mb9lchAUk/313ee1de712bc6bd0cbe8e106154c5be/nextjs-middleware.png)

## A Delightful New Declarative Routing API

From v1, the SDK has been deeply customizable, but users often have to write full request handlers to access some of the lower-level features of the SDK. With the new declarative API for creating request handlers, this can be done simply and beautifully through the API.

Take a look at the following snippets of code.

### Using SDK v1

```javascript
export default handleAuth({
  signup: async function signup(req, res) {
    try {
      await handleLogin(req, res, {
        authorizationParams: {
          screen_hint: 'signup'
        }
      });
    } catch (error) {
      res.status(error.status || 400).end(error.message);
    }
  },
  invite: async function invite(req, res) {
    try {
      await handleLogin(req, res, {
        authorizationParams: {
          invitation: req.query.invitation
        }
      });
    } catch (error) {
      res.status(error.status || 400).end(error.message);
    }
  },
  'login-with-google': async function loginWithGoogle(req, res) {
    try {
      await handleLogin(req, res, {
        authorizationParams: {
          connection: 'google'
        }
      });
    } catch (error) {
      res.status(error.status || 400).end(error.message);
    }
  },
  'refresh-profile': async function refreshProfile(req, res) {
    try {
      await handleProfile(req, res, {
        refetch: true
      });
    } catch (error) {
      res.status(error.status || 400).end(error.message);
    }
  },
}
```

### Using SDK v2

```javascript
export default handleAuth({
  signup: loginHandler({ authorizationParams: { login_hint: 'signup' } }),
  invite: loginHandler({ authorizationParams: (req) => { invitation: req.query.invitation } }),
  'login-with-google': loginHandler({ authorizationParams: { connection: 'google' } }),
  'refresh-profile': profileHandler({ refetch: true }),
}
```

Isn't that much nicer?

## First Class Testing Support

Testing routes that require login has always been a complex problem for developers. The new SDK release includes built-in support for seeding the session cookie on your tests to make testing authenticated pages a breeze. 

Instead of having to manage secrets in tests, visit third-party websites or mock complex internals of authentication libraries, users can use the new testing functionality built right into the SDK.

Consider the following code:

```javascript
import { generateSessionCookie } from '@auth0/nextjs-auth0/testing';

test('should visit profile page', async () => {
  const cookie = await generateSessionCookie(session, config);
  const res = visit('/profile', { headers: { cookies: `appSession=${cookie}` } });
  expect(res.status).toBe(200);
})
```

The code above uses Auth0 NextJS SDK to generate a session cookie which is later sent as part of the `visit` request.

If the session is not provided, the request would respond with a `403 Forbidden` as the URL is protected against unauthenticated requests.

## And LOTS more…
But that is not all. The new SDK offers you:

- New session lifecycle and `updateUser` method.
- New package export profile to support React Server Components. 
- Improved API Docs.
- Improved Error Handling.
- Lighter Front-End binary.
- Support for custom Logout Options.
- Easier options for managing cookie size.

## Summary

The [Auth0 NextJS SDK](https://github.com/auth0/nextjs-auth0) v2 introduced some pretty neat changes that will ultimately provide a better developer and end-user experience.

For those projects migrating from the SDK v1, I recommend reading the official [migration guide](https://github.com/auth0/nextjs-auth0/blob/v2.0.0/V2_MIGRATION_GUIDE.md).

Thanks for reading!

Auth0 SDK for NextJS v2.0 released!

Let's explore the main features of the new Auth0 SDK for SPA release.

> The Auth0 team released the new Auth0 Single Page App SDK v2.0, and it's now available in the [npm registry](https://www.npmjs.com/package/@auth0/auth0-spa-js). It is a major new release with a focus on development and user experience.

The new release makes an important step towards improving usability and reducing the footprint (size) of the SDK.

## Quick Start with the New SDK

You can follow the [quick start guide](https://auth0.com/docs/quickstart/spa/vanillajs) if you build a new application or connect your SPA with Auth0 using the SDK for the first time.

If you use frameworks such as React, Angular, or Vue, you can use framework-specific libraries instead. You can learn more about specific frameworks in our [SPA guides section](https://auth0.com/docs/quickstart/spa).

> All of the mentioned improvements will be available in the next beta versions of our framework-specific SDKs. Be sure to keep an eye on them to be notified when their beta versions are available.

## Migrating from v1.x

With the improvements from v1.x, it was necessary to introduce some breaking changes. We will cover the most impactful changes in this post, but we recommend reviewing the [migration guide](https://github.com/auth0/auth0-spa-js/blob/master/MIGRATION_GUIDE.md) for the details of all breaking changes and their corresponding migration path.

## Reduced Bundle Size by 60%

Auth0 SPA SDK V1.x shipped with built-in polyfills to compensate for the lack of native support on some browsers for features such as:

- [AbortController](https://caniuse.com/mdn-api_abortcontroller_abortcontroller)
- [Promise](https://caniuse.com/promises)
- [TextEncoder & TextDecoder](https://caniuse.com/textencoder)
- [Fetch](https://caniuse.com/fetch)

As the above APIs are now available for most browsers, we believe there's no more need to include those polyfills. Primarily users of IE11 would require them, and with [Microsoft dropping support for IE11](https://blogs.windows.com/windowsexperience/2022/06/15/internet-explorer-11-has-retired-and-is-officially-out-of-support-what-you-need-to-know/), we believe it makes sense to capitalize on the gains and **drop support for IE11 as of V2**.

By removing these polyfills, and with some small improvements on our side, we **reduced the bundle size by an outstanding 60%**.

Such a reduction will allow for faster download and processing times for application users.

## API Consistency

Our SDK offers a variety of settings that can be divided into two categories:

- Properties used to configure our SDK
- Properties used solely to pass through to Auth0

In v1.x, passing both types of properties to the SDK was possible when instantiating a new `Auth0Client`. Because the different types of arguments were differentiated only by the case (camel vs. snake case), with no additional separation in the object argument, it wasn't very evident what arguments were SDK properties and which ones were authorization parameters.

Here is an example of what setting such options on v1.x looks like:

```javascript
const client = new Auth0Client({
  client_id: '...',
  useRefreshTokens: true,
  useRefreshTokensFallback: false,
  redirect_uri: '...',
  custom_param: '...',
  screen_hint: 'signup'
});
```

With v2, we are ensuring the distinction between the two categories is clear by putting any property solely used to pass through to Auth0 in a property bag named `authorizationParams`. On top of that, any property outside of `authorizationParams` will now be using camel casing.

Here is what the configuration looks like in v2:

```javascript
const client = new Auth0Client({
  clientId: '...', // <= camelCasing
  useRefreshTokens: true,
  useRefreshTokensFallback: false,
  authorizationParams: { // <= new property bag
    redirect_uri: '...', // <= moved into authorizationParams
    custom_param: '...', // <= moved into authorizationParams
    screen_hint: 'signup' // <= moved into authorizationParams
  }
});
```

## `localOnly` Logout

In v1.x of the SDK, it was possible to pass a `localOnly` when calling `logout`. In the current release, we dropped the `localOnly` argument in favor of a new `onRedirect` event that allows for more control, including the possibility of not redirecting, and thus produces the same effect the `localOnly` property intended.

To replicate the `localOnly` behavior, you can implement the following:

```javascript
await client.logout({
  onRedirect: async (url) => {
    // Do not do anything
    // Or do something else but redirecting
  }
})
```

## Removed `buildAuthorizeUrl` and `buildLogoutUrl`

In v1.x, it was possible to use the methods `buildAuthorizeUrl` and `buildLogoutUrl` for applications that couldn't rely on `window.location.assign` to redirect to Auth0 when calling `loginWithRedirect` or `logout` respectively. A typical example of this was when developers needed to set a specific URL in the context of a mobile application using frameworks such as Ionic.

In v2, developers would rely on `onRedirect` to specify such behavior.

For example:

```javascript
await client.loginWithRedirect({
  async onRedirect(url) {
    // Redirect using Capacitor's Browser plugin
    await Browser.open({ url });
  }
});
```

## `getUser` and `getIdTokenClaims`

As part of our optimization efforts, we reworked the SDK's internal cache to store tokens. Consequently, it was possible to simplify the methods `getUser` and `getIdTokenClaims`.

In v1.x, developers could pass a specific scope and audience when calling either of those functions.

Here are some examples of how these functions were used in v1:

```javascript
const user = await getUser();
const user = await getUser({ audience, scope });

const claims = await getIdTokenClaims();
const claims = await getIdTokenClaims({ audience, scope });
```

However, as an application should only have one user, such parameters wouldn't be required. So from v2, we dropped those parameters and simplified the methods to:

```javascript
const user = await getUser();
const claims = await getIdTokenClaims();
```

## Retrieve a Token from the Cache

With v2, we are introducing the possibility of retrieving a token from the cache without contacting Auth0 if no entry is found. To achieve that, we reworked the already existing `ignoreCache` argument for `getTokenSilently`, which takes a boolean, to `cacheMode`, which can accept three values:

- **on** (default value): Use the cache, but call the `oauth/token` endpoint when no entry is found. This is the equivalent of when `ignoreCache` was omitted or its value was set to false in v1.
- **off**: Do not use the cache, always call the `oauth/token` endpoint. This is the equivalent of `ignoreCache: true` in v1.
- **cache-only**: Use the cache, do not call the `oauth/token` endpoint when no entry is found.

To use our SDK and see if we have a token in the cache without contacting Auth0, you must set `cacheMode` to `cache-only` when calling `getTokenSilently`.

```javascript
const token = await client.getTokenSilently({
  cacheMode: 'cache-only'
});
```

## URL Encoded Form Data

V1 of SPA-JS defaults to sending payloads using JSON when calling Auth0's `oauth/token` endpoint, but users can opt-in to send the data as `x-www-form-urlencoded` instead.

With the release of v2, we will default to sending the requests to the `oauth/token` endpoint using `x-www-form-urlencoded`, while users can opt-in to using JSON as needed. Using `x-www-form-urlencoded` has shown to have a small performance optimization and aligns more with what the [spec describes](https://datatracker.ietf.org/doc/html/rfc6749#section-3.2).

## Summary

The Auth0 Single Page App SDK v2 improves both the developer and the user experience. On the one hand, it simplifies and makes working with the SDK API easier. On the other hand, it reduces the bundle size, which translates into faster downloads and processing times.

Thanks for reading!

Auth0 SDK for Single Page Applications v2.0 released!

Let’s explore the new .NET 7 features for improving and simplifying authentication and authorization support in .NET applications.

The release of .NET 7 continues the simplification effort that began with .NET 5. Following this line, the new release provides .NET developers with a few features related to authentication and authorization that make .NET developers' lives a bit easier. Let's take a quick look at those features, which range from simplifications in authentication configuration to the addition of new authorization test tools, to improvements to Blazor's authentication support.

## Default Authentication Scheme

When you configure authentication for your application, you need to register the authentication service through `AddAuthentication()`. For example, the following is the code needed to configure `JwtBearer` as the authentication scheme in an ASP.NET Core Web API:

```csharp
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
     .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
     {
         options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
         options.TokenValidationParameters = 
           new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
             ValidAudience = builder.Configuration["Auth0:Audience"],
             ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
         };
     });
```

Although you are defining just one authentication scheme (`JwtBearerDefaults.AuthenticationScheme`), the  `AddAuthentication()` method requires that you specify the default scheme to use when it is not specified in your API endpoints (see [this document for more details on multiple authentication schemes in ASP.NET Core](https://learn.microsoft.com/en-us/aspnet/core/security/authorization/limitingidentitybyscheme?view=aspnetcore-6.0#use-multiple-authentication-schemes)).

Starting with .NET 7, the default scheme is no longer required when you define just one authentication scheme. It is automatically inferred by the framework. In practice, you can write the previous code as follows:

```csharp
builder.Services.AddAuthentication() //👈 no default scheme specified
     .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
     {
         options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
         options.TokenValidationParameters = 
           new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
             ValidAudience = builder.Configuration["Auth0:Audience"],
             ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
         };
     });
```

In case you need to restore the old behavior for any reason, you can disable the new feature using the following statement:

```csharp
AppContext.SetSwitch("Microsoft.AspNetCore.Authentication.SuppressAutoDefaultScheme", true);
```

## Simplified Configuration

One of the recurrent critiques of .NET authentication and authorization is its complexity (see [this thread](https://www.reddit.com/r/dotnet/comments/vttrib/is_auth_way_too_hard_in_net/) and [this one](https://social.msdn.microsoft.com/Forums/en-US/4d3844d5-9175-49ba-8c2f-8257f2c67639/authentication-and-authorization-is-too-complicated-too-abstract?forum=aspdotnetcore), for example). Actually, .NET provides developers with an articulate system for managing authentication and authorization. This system is great for the flexibility it offers, but it may be hard for a beginner to digest all the details. It may be hard even for a more experienced developer who is not used to dealing with the identity features every day.

To overcome this issue, the .NET team started an initiative aiming at simplifying the authentication and authorization configuration. The .NET 7 release introduces the first step in this direction, bringing you a simplified approach to configure ASP.NET Core Web APIs authorization based on access tokens in JWT format.

> Check out [this article to learn how to protect your ASP.NET Core Web API](https://auth0.com/blog/aspnet-web-api-authorization/).

If you ever had secured an ASP.NET Core Web API with Auth0, the following code should look familiar to you:

```csharp
using Microsoft.AspNetCore.Authentication.JwtBearer;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
     .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
     {
         options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
         options.TokenValidationParameters = 
           new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
             ValidAudience = builder.Configuration["Auth0:Audience"],
             ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
         };
     });

builder.Services.AddAuthorization();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();
```

Now, you can directly rely on the built-in configuration system to define your Web API's authorization options. In fact, in addition to default authentication schemes, .NET 7 automatically loads the options to configure the authentication service from the new  `Authentication` section of the `appsettings.json` configuration file. With this new feature, the code shown earlier becomes as follows:

```csharp
using Microsoft.AspNetCore.Authentication.JwtBearer;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication().AddJwtBearer(); //👈 new feature

builder.Services.AddAuthorization();

var app = builder.Build();
```

All the configuration settings are moved to the `appsetting.json` file as follows:

```json
{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  //👇 new section
  "Authentication": {
    "Schemes": {
      "Bearer": {
        "Authority": "https://YOUR_AUTH0_DOMAIN",
        "ValidAudiences": [ "YOUR_AUDIENCE" ],
        "ValidIssuer": "YOUR_AUTH0_DOMAIN"
      }
    }
  }
  //👆 new section
}
```

The new `Authentication` section keeps the configuration settings for any authentication scheme supported by your application, although currently only the `JwtBearer` scheme is supported.

Notice that now you don't need anymore to call `UseAuthentication()` and `UseAuthorization()`. The framework takes care of automatically adding the required middleware to the request pipeline.

## Authorization Policies for Specific Endpoints

ASP.NET Core allows you to specify policies to make more accurate authorization decisions based on the access token content or other advanced criteria. Usually, these policies are defined globally at the application level and attached to the endpoint definitions the policy applies to.

> Take a look at [this article to learn how to use policies to protect ASP.NET Core Web APIs](https://auth0.com/blog/permission-based-security-aspnet-webapi/), for example.

Defining policies globally is pretty good for reuse. However, sometimes you may need just a specific policy for one endpoint. In this case, you can specify your policy directly on the endpoint definition.

The following is an example of how you can use this new feature:

```csharp
app.MapGet("/api/special-endpoint", () => "A special endpoint!")
    .RequireAuthorization(p => p.RequireClaim("scope", "api:special"));
```

## The `user-jwts` Tool

Testing a token-protected Web API could be complex. You can easily use tools like curl or Postman, but you need to pass a valid access token along with your HTTP request. To get a valid access token, you usually need a working identity and access management system at your disposal, such as [Auth0](https://auth0.com/). You need to configure your API with this system and log in by providing valid credentials.

Auth0 allows you to test your registered API using a token issued directly in the [Auth0 dashboard](https://manage.auth0.com/), but you still need to register your application with Auth0.

.NET 7 brings a new CLI tool that helps simplify protected Web API testing: `user-jwts`. This tool is integrated with the .NET CLI and allows you to generate access tokens in JWT format. The tool is based on the same infrastructure as the [secret manager](https://auth0.com/blog/secret-management-in-dotnet-applications/) and enables your application to validate the generated access token. Basically, the following command allows you to generate a new access token:

```bash
dotnet user-jwts create
```

You can use this token with curl, Postman, or any other HTTP client to make your call to the protected endpoints of your Web API without the need to register your application with an actual identity and access management system.

Beyond the basic usage, the `user-jwts` tool allows you to customize your access token by specifying the scopes, custom claims, and other properties so that you can also test endpoints with access policies. See the [official documentation](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/jwt-authn) to learn more.

<include src="ebook-ads/dotnetIdentity" />

## Dynamic Authentication Requests in Blazor WASM

Blazor WebAssembly uses the `Microsoft.AspNetCore.Components.WebAssembly.Authentication` package to handle OpenID Connect authentication. This package allows you to statically define at the startup time how authentication will occur. However, there are scenarios where you may need to authenticate users at runtime with a different configuration. For example, you may need to perform [step-up authentication](https://auth0.com/docs/secure/multi-factor-authentication/step-up-authentication) or may want the user to change their account.

In .NET 7, Blazor WebAssembly supports the creation of dynamic authentication requests using the new `InteractiveRequestOptions` class and the `NavigateToLogin()` method of the `NavigationManager` object.

The following example shows the basic use of these new features:

```csharp
InteractiveRequestOptions requestOptions = new()
{
    Interaction = InteractionType.SignIn,
    ReturnUrl = NavigationManager.Uri,
};
NavigationManager.NavigateToLogin("authentication/login", requestOptions);
```

The `InteractiveRequestOptions` class also provides a way to add custom parameters to the authentication request. For example, consider [Auth0's `screen_hint` parameter](https://auth0.com/docs/authenticate/login/auth0-universal-login/new-experience#signup) that allows you to show the signup form instead of the default login form. You can send this parameter to Auth0 as shown below:

```csharp
InteractiveRequestOptions requestOptions = new()
{
    Interaction = InteractionType.SignIn,
    ReturnUrl = NavigationManager.Uri,
};
requestOptions.TryAddAdditionalParameter("screen_hint", "signup");
NavigationManager.NavigateToLogin("authentication/login", requestOptions);
```

## Blazor WASM Authentication Diagnostics

Detecting authentication issues is not easy, especially if you are running a WebAssembly code, as it happens with Blazor WebAssembly applications. The .NET 7 release tries to improve its support for authentication diagnostics by introducing the debug level for the `Microsoft.AspNetCore.Components.WebAssembly.Authentication` library. After [enabling logging for Blazor WebAssembly](https://learn.microsoft.com/en-us/aspnet/core/blazor/fundamentals/configuration?view=aspnetcore-7.0#logging-configuration), you can add the following setting in the `wwwroot/appsettings.json` configuration file to get detailed information about the authentication process:

```json
"Logging": {
    "LogLevel": {
        "Microsoft.AspNetCore.Components.WebAssembly.Authentication": "Debug"
    }
}
```

<include src="SignupCTA" text="Try out Auth0 authentication for free." linkText="Get started →" />

## Conclusion

Probably the new features introduced by .NET 7 to mitigate the complexity of authentication and authorization support will not drastically change your life as a developer. However, they confirm the effort Microsoft is making to simplify the use of its development platform. In the area of authentication and authorization, the commitment to reduce configuration complexity with an [initiative](https://github.com/dotnet/aspnetcore/issues/34545) that will continue in subsequent .NET releases looks pretty promising.

I hope that the combination of these and future simplifications will go in the right direction of making authentication and authorization integration into .NET applications less and less challenging.


What's New in .NET 7 for Authentication and Authorization

Learn about the essential features of the Auth0 Flutter SDK and how it helps developers build and secure Flutter iOS and Android applications.

Today we are announcing the release of the [Auth0 Flutter SDK](https://pub.dev/packages/auth0_flutter), a new SDK that makes it easy to secure Flutter applications with Auth0. Whether you need to secure access to an iOS or Android application, the Auth0 Flutter SDK got you covered!

The new Flutter SDK builds on a strong foundation by wrapping our existing and robust [Auth0.Android](https://github.com/auth0/Auth0.Android) and [Auth0.swift](https://github.com/auth0/Auth0.swift) libraries while focusing on the developer experience first.

Our SDK team optimized the Auth0 Flutter SDK for quick integration into your applications and for flexibility to accommodate simple and advanced use cases.

Since the introduction of [Flutter 3](https://medium.com/flutter/introducing-flutter-3-5eb69151622f), the framework allows for building cross-platform applications, extending from mobile applications to desktop applications and platforms. Our SDK allows for extension in such platforms by leveraging federated plugins, which means you can easily add support for other platforms without forking the SDK.

## Auth0 Flutter SDK Features

The new SDK offers features for multiple use-cases and complexity, going from magically getting the job done to providing a rich set of APIs enabling you to build your authentication flow per your specific requirements.

Let's explore the essential features of the Auth0 Flutter SDK that enable developers to do more:

- ⚡️ Quick implementation of login, logout, and automatic storage and renewal of tokens functionality into Flutter apps using WebAuth and the [Auth0 Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login) page.
- ⚙️ For more advanced use-cases, developers have access to the [Authentication API](https://pub.dev/documentation/auth0_flutter/latest/auth0_flutter/AuthenticationApi-class.html), which at the time of release supports:
	- Logging in with a username or email and password
	- Signing up new users
	- Getting user information from `/userinfo`
	- Renew tokens
	- Reset passwords
- 🔐 Auth0 provides a default instance of [Credentials Manager](https://pub.dev/documentation/auth0_flutter/latest/auth0_flutter/DefaultCredentialsManager-class.html) that automatically stores the user's credentials. If you need your own solution for handling credentials, you can create your own [custom credentials manager](https://pub.dev/documentation/auth0_flutter/latest/auth0_flutter/CredentialsManager-class.html).
- ➕ And more [advanced features](https://pub.dev/packages/auth0_flutter#advanced-features) like accepting user invites, login into organizations, and bot detection.

## Requirements

The Auth0 Flutter SDK doesn't require any other library to work. However, there are SDK version and platform requirements for your project:

<table style="width:100%" cellspacing="2" cellpadding="5">
    <thead>
        <tr style="border-bottom: solid 1px">
            <td>**Flutter**</td>
            <td>**Android**</td>
            <td>**iOS**</td>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>SDK 3.0+</td>
            <td>Android API 21+</td>
            <td>iOS 12+</td>
        </tr>
        <tr>
            <td>Dart 2.17+</td>
            <td>Java 8+</td>
            <td>Swift 5.3+</td>
        </tr>
        <tr>
            <td></td>
            <td></td>
            <td>Xcode 13.x / 14.x</td>
        </tr>
    </tbody>
</table>

Check the [project on GitHub](https://github.com/auth0/auth0-flutter/tree/main/auth0_flutter#requirements) to for the most up-to-date set of requirements.

## Installing the SDK

The Auth0 Flutter SDK is distributed via [pub.dev](https://pub.dev/packages/auth0_flutter).

To add the SDK, run the following command from the root directory of your project:

```bash
flutter pub get auth0_flutter
```

## Adding Universal Login to Your Flutter Application

Adding the full-featured [Auth0 Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login) authentication page to your application is easy with the SDK.

Please explore the [Flutter Quickstart guide](https://auth0.com/docs/quickstart/native/flutter/interactive) to see in detail how to set up your Flutter application to use the Auth0 SDK. For now, let's take a quick peak at how the Flutter SDK integration goes!

### Add login to your app

Integrate Auth0 Universal Login in your Flutter app by using the Auth0 class. Redirect your users to the Auth0 Universal Login page using `webAuthentication().login()`. This is a `Future` and must be awaited for you to retrieve the user's tokens.

```dart
await auth0.webAuthentication(scheme: 'YOUR CUSTOM SCHEME').login();
```

### Add logout to your app

Logging out users is as easy as calling the Auth0 Flutter SDK `webAuthentication().logout()` function. The `logout()` function is responsible for calling the `logout` endpoint to clear their login session and to clear the user login state from the device session.

```dart
await auth0.webAuthentication(scheme: 'YOUR CUSTOM SCHEME').logout();
```

## Next Steps

There are a lot of options to work with with the SDK, and in this post, we only barely scratch the surface of it. If you want to learn more about the SDK, please check out the [quick start guide](https://auth0.com/docs/quickstart/native/flutter/interactive) and the [SDK documentation](https://pub.dev/packages/auth0_flutter).

Thanks for reading!

Introducing the Auth0 Flutter SDK

Oliver Wang

A product manager at Auth0 focuses on  Ecosystem and Extensibility.  With an engineering background, Oliver always puts developers' experience first.  He has mixed industrial experience as a Product Manager, Software Engineer and Data Analyst. This diverse profile unites different team members to deliver value to our customers. Besides work, you can catch him up on a ski hill in the Canadian Rockies.

Product Manager, Ecosystem

Geoffrey Goodman

I am a curious and driven person. Until my early twenties, I was one of the top-ranked Canadian slalom skiers. While still competing, I pursued dual business majors at a Liberal Arts college in Nevada, funded by academic and athletic scholarships. I then joined EY in Montreal, where I worked with all of the four major service lines and earned my CA title. I now work with the Valuations and Business Modelling group and I am pursuing my CBV designation. 
<br>
I am also a self-taught computer programmer. I am comfortable in any number of programming languages. I built a website and steward a community of thousands of people across the world who rely on and benefit from its services every day.

Staff Engineer

Customers can now add custom prompts or factors in their post-login flow

We are excited to share that our customers that use Actions -  Auth0’s flagship extensibility product - can now add custom prompts or factors in their post-login flow. This enables developers and partners to confidently record the completion of a factor upon returning after a custom redirect. Auth0 delivers more tools, features, and options for developers to give them the support and capabilities they need to customize their customer’s experience through pro-code flexibility.

We have introduced a new method to the API of post-login Actions when continuing the flow after a successful custom redirect. This method allows a customer and/or partner to store the completion of that custom factor right in the user’s session. What is powerful about this is that they can then check whether that customer record is in a user session in each login and skip that prompt if it’s there already. Because it’s stored in the user session itself, it benefits from any current and future session management features within the Auth0 product offering.

## What Is the Problem We Are Solving?

Historically, there was no good way for customers to use Actions to securely implement custom prompts or custom factors in a user-friendly way. They could use user metadata or application metadata, but those objects exist across all user sessions. There was also no good way for customers or partners to see whether a user on a specific device had completed the necessary factors to login. This meant forcing users to re-perform the custom prompt or factor more often than necessary.

As an example, let's say you’re a developer for a banking app that has a special requirement to use a custom multi-factor authentication service, and you want that authentication to be associated with a user's session and or device for added security. That is where the ability to add a custom prompt enables you to build that customer experience and address that need.

## See It in the Real Example!

Let's take a look at a real example! Below is a sample Actions code for a Partner Integration implementing a custom authentication factor.

On the `onExecutePostLogin`, we trigger the custom authentication method by using Actions Redirect to send users to the customer method URL with session token information.

```js
const CUSTOM_METHOD_URL = "https://path.to.prompt";
const PROMPT_TTL = 1000 * 60 * 60 * 24; // 24h

exports.onExecutePostLogin = async (event, api) => {
    if (
        !event.authentication?.methods.some((record) => {
            // Timestamps are rendered as IS08601 strings
            const timestamp = new Date(record.timestamp);

            return (
                record.name === CUSTOM_METHOD_URL &&
                timestamp.value0f() >= Date.now() - PROMPT_TTL
            );
        })
    ){
        const sessionToken = api.redirect.encodeToken({
            payload: {
                user_id: event.user.user_id,
            },
            secret: event.secrets.SESSION_TOKEN_SECRET,
        });

        // Trigger our custom authentication method
        api.redirect.sendUserTo(CUSTOM_METHOD_URL, {
            query: { session token: sessionToken }
        });
    }
};
```

Continue with `onContinuePostLogin`, we validate the session token secret and record the completion of our custom authentication method.


```js
exports.onContinuePostLoqin = async (event, api) => {
    const payload = api.redirect.validateToken({
        secret: event.secrets. SESSION_TOKEN_SECRET,
        tokenParameterName: 'session_token'
    });

    if (!validateSessionToken(payload)) {
        return api.access.deny('Unauthorized');
    }

    // Record the completion of our custom authentication method.
    // THIS NEW API IS ONLY AVAILABLE IN 'onContinuePostLogin'
    api.authentication.recordMethod(CUSTOM_METHOD_URL);
};

function validateSessionToken(payload) {
    // Custom validation logic would go here
    return true;
}
```

Actions is an iterative platform we continually improve upon. [Start creating your Auth0 Actions](https://auth0.com/docs/customize/actions/write-your-first-action) today and customize your logic flow with the seamless low-code integration with Auth0!

New Actions Feature: Build Your Own Custom Factor

philippederyck

Philippe De Ryck helps developers protect companies through better web security. His Ph.D. in web security from KU Leuven lies at the basis of his exceptional knowledge of the security landscape. As the founder of Pragmatic Web Security, Philippe delivers security training and security consulting to companies worldwide. His online course platform allows anyone to learn complex security topics at their own pace. Philippe is a Google Developer Expert and an Auth0 Ambassador/Expert for his community contributions on the security of web applications and APIs.

Web Security Expert, Founder of Pragmatic Web Security

Philippe De Ryck

Single Page Applications clash with modern CSP features. In this article, we discuss concrete strategies for securing SPAs with CSP.

The recommended best practice for modern CSP policies relies on hashes, nonces, and `'strict-dynamic'`. Unfortunately, these features conflict with modern SPAs. This article proposes three concrete strategies to deploy secure CSP policies for SPAs. The first relies on a simple policy allowing `'self'`, which is acceptable under certain circumstances. The second strategy enables CSP hashes by rewriting the main page to use a script loader. The third strategy inserts nonces into a dynamically served main page.

## Recapping CSP

The [first article in this series](https://auth0.com/blog/defending-against-xss-with-csp/) offered an in-depth look at using CSP as a second line of defense against XSS attacks. 

We covered the configuration of CSP using URL-based entries but also [highlighted why such policies are often insecure](https://auth0.com/blog/defending-against-xss-with-csp/#CSP-is-Dead--Long-Live-CSP). In response, we discussed [Google's "universal CSP policy"](https://auth0.com/blog/defending-against-xss-with-csp/#Google-s-Universal-CSP-Policy), shown below, which offers an excellent trade-off between security and complexity: 

```
Content-Security-Policy: 
  script-src 'report-sample' 'nonce-3YCIqzKGd5cxaIoTibrW/A' 'unsafe-inline'
             'strict-dynamic' https: http: 'unsafe-eval';
  object-src 'none';
  base-uri 'self';
  report-uri /webchat/_/cspreport
```

This policy relies on nonces to identify an initial set of legitimate script blocks and script files in the page. Once these scripts execute, they can rely on the automatic trust propagation mechanism of `'strict-dynamic'` to load additional scripts.

Unfortunately, this type of policy does not work well with Single Page Applications, as we pointed out in the [conclusion of the first article](https://auth0.com/blog/defending-against-xss-with-csp/#Using-CSP-with-SPAs).

So, what is up with that? Let's take a look at the challenges of configuring CSP in SPAs and discuss a couple of solutions.

## The Challenges with SPAs

Single Page Applications load a single `index.html`, which then bootstraps the necessary JavaScript code to launch the application. The code snippet below shows the `index.html` page of an Angular application:

```html
<!doctype html>
<html lang="en">
<head>
  ...
</head>
<body>
  <app-root></app-root>
  <script src="runtime.7b63b9fd40098a2e8207.js" defer></script>
  <script src="polyfills.00096ed7d93ed26ee6df.js" defer></script>
  <script src="main.8e56a2a77fee2657fb91.js" defer></script>
</body>
</html>
```

To deploy CSP in a SPA, we first have to tell the browser that the application's JavaScript bundle is a legitimate resource that can be loaded. In the snippet above, the bundle consists of three separate JavaScript files.

One way to do that is by approving scripts coming from the application's origin (`https://example.com`). A policy with a `script-src https://example.com` directive would allow the loading of these files.

Unfortunately, as we discussed in the [previous article](https://auth0.com/blog/defending-against-xss-with-csp/), such URL-based policies are often insecure and are deprecated. Additionally, URL-based expressions cannot be used together with `'strict-dynamic'`, which prevents the use of automatic trust propagation.

One alternative is the use of hashes, a CSP Level 2 feature. However, the application's JavaScript bundle is hosted as a remote file, and hashes only work on inline code blocks. So CSP hashes are not compatible with SPAs.

CSP Level 2 also supports nonces, which are compatible with the loading of remote resources. However, [one requirement for nonces](https://auth0.com/blog/defending-against-xss-with-csp/#CSP-Level-2) is that they are unique on every page load. In essence, this means that the server has to inject a fresh nonce every time it serves a page. Doing so is easy for dynamic server-side applications but not very compatible with serving a static `index.html` file for a SPA. So nonces are also not compatible with SPAs.

With both hashes and nonces out, there is no straightforward way for SPAs to use modern CSP policies. Additionally, they are incapable of using `'strict-dynamic'` for loading additional scripts. The lack of support for `'strict-dynamic'` makes it impossible to reliably incorporate third-party components such as a Twitter timeline.

Right about now, I'm sure you're somewhat disappointed with CSP, and righteously so. But don't worry, we're only getting started. Let's take a look at three concrete strategies to implement CSP in a SPA.

## Keep It Simple

The first strategy for enabling CSP in SPAs is straightforward. If the SPA only needs to load its application bundle and no third-party resources, the following CSP policy could be a very simple solution:

```
script-src 'self'
```

This policy allows the application to load JavaScript files from its own origin. Such a policy suffices to load all of the additional resources of an isolated, self-contained application. You will often encounter such applications in enterprise settings, where the dynamic integration of remote components is less common.

But weren't URL-based policies ineffective and open to bypasses?

Yes, they are, under the right circumstances. [The paper](https://research.google/pubs/pub45542/) that described numerous bypass attacks against CSP outlines a few scenarios where approving `'self'` is problematic. For example, CSP can be bypassed if ...

* The application's origin also hosts vulnerable libraries
* The application's origin also hosts JSONP endpoints
* The application's origin hosts untrusted files uploaded by users

However, these threats are not an issue if the application's origin contains nothing else but the statically deployed application bundle. And if there are no bypasses, this policy is still considered secure. 

> To summarize, if you're building an isolated SPA with nothing else running in the same origin, this policy is a straightforward way to deploy CSP.

However, if you rely on third-party components, you will likely need to support `'strict-dynamic'`. In that case, you can rely on one of the following two strategies.

## Using `'strict-dynamic'` with Hashes

When a policy is configured with `'strict-dynamic'`, all script code approved by a hash or a nonce is allowed to load additional dependencies. This mechanism is extremely useful to allow a third-party component to load additional code or to enable lazy-loading of application components.

Unfortunately, `'strict-dynamic'` causes browsers to ignore URL-based entries, so it cannot be used in conjunction with `'self'`. This means that when we enable `'strict-dynamic'`, we have to find a different way to allow the loading of the application's bundle. 

Loading the bundle with hashes is not an option because hashes cannot be used with remote code files. Instead, we can modify the `index.html` file to include an inline code block, which we can approve with a hash. This inline code block contains a script loader, which uses proper DOM APIs to load additional script code. This behavior is automatically approved by having `'strict-dynamic'` in the policy. 

The code snippets below show the modified `index.html` of an Angular application and the corresponding CSP policy. The HTML page contains two code blocks: The script loader and the code for loading a Twitter timeline. The corresponding CSP policy approves both blocks with a hash:

```html
<!doctype html>
<html lang="en">
<head>
  ...
</head>
<body>
  <app-root></app-root>
  <script>
    let scripts = ["runtime.7b63b9fd40098a2e8207.js", "polyfills.00096ed7d93ed26ee6df.js", "main.8e56a2a77fee2657fb91.js"];
    scripts.forEach(function(scriptUrl) {
      var s = document.createElement('script');
      s.src = scriptUrl;
      s.async = false; // preserve execution order.
      document.body.appendChild(s);
    });
  </script>
  <script>
    window.twttr = (function(d, s, id) {
      ...
    }(document, "script", "twitter-wjs"));
  </script>
</body>
</html> 
```

```
Content-Security-Policy: script-src 
  'sha256-qaOxCJong9pt6ICami7oNScwNCv2sn3HUTzbEaQ3vrU=' 
  'sha256-BYW1ZgvEbfyQi82B604a0EdxK+Od5iqb/I2hgknBhiw='
  'strict-dynamic'
```

This workaround is not pretty but quite effective: It enables a modern CSP policy on a statically deployed SPA. At the time of writing, the [strict-csp](https://www.npmjs.com/package/strict-csp) package offers experimental support for transforming any HTML file to use a script loader as described here. This package is also available as a [webpack plugin](https://www.npmjs.com/package/strict-csp-html-webpack-plugin). Of course, you can also perform this task in a more manual fashion.

> To summarize, adding an inline script loader enables the use of hashes and `'strict-dynamic'`.

Finally, note that CSP Level 3 may support the use of hashes for remote code files. However, at the time of writing, (widespread) support for that feature is still far off.

## Using `'strict-dynamic'` with Nonces

Nonces are a more flexible alternative to hashes, as they can also be used on remote script files. Nonces are also quite compatible with `'strict-dynamic'` but must be unique on every page load. Unfortunately, that requirement clashes with a statically deployed `index.html`.

To enable the use of nonces in a SPA, we have to serve our `index.html` dynamically to insert a fresh nonce in each response. This process sounds complicated but is not that difficult in practice.

The code example below shows a minimal NodeJS Express server that dynamically serves our main Angular application file. The Express server uses the [express-csp-header](https://www.npmjs.com/package/express-csp-header) middleware to configure a policy and handle nonce generation. The nonce is passed along to the view rendering engine, which inserts it into the page. The modified `index.html`, now stored as `index.ejs`, is included below:

```javascript
const express = require("express");
const { expressCspHeader, NONCE } = require('express-csp-header');

const app = express();
const port = 3000;

app.set('view engine', 'ejs');

 app.use(expressCspHeader({
   directives: {
       "script-src": [NONCE, "'strict-dynamic'"]
   }
}));

// Rewrite index.html
app.get("/", (req, res) => {
  res.render(`views/index`, { nonce: req.nonce });
})

app.listen(port, () => {});
```

```html
<!doctype html>
<html lang="en">
<head>
  ...
</head>
<body>
  <app-root></app-root>
  <script nonce="<%= nonce %>" src="runtime.7b63b9fd40098a2e8207.js" defer></script>
  <script nonce="<%= nonce %>" src="polyfills.00096ed7d93ed26ee6df.js" defer></script>
  <script nonce="<%= nonce %>" src="main.8e56a2a77fee2657fb91.js" defer></script>

  
  <script nonce="<%= nonce %>">
    window.twttr = (function(d, s, id) {
      ...
    }(document, "script", "twitter-wjs"));
  </script>
</body>
</html>
```

At first glance, running a dynamic server for serving a SPA seems quite complicated. However, if you take a closer look, the Express server is quite simple. Additionally, it is completely stateless, making it easy to deploy as a stateless function on various cloud platforms. 

Note that only the main HTML file needs to be served dynamically. All other resources, such as JS or CSS files, can still be served statically.

>  To summarize, serving `index.html` dynamically enables the use of nonces and `'strict-dynamic`'.

<include src="ebook-ads/WebSecurity" />

## Overview of CSP for SPAs

In a nutshell, deploying modern CSP policies with SPAs is perfectly feasible, albeit with a bit more effort than you would expect. 

In this article, we covered two scenarios: isolated applications and more complex applications with dynamic code loading. We recap our recommendations for both scenarios below.

### Isolated applications without third-party components

Use a simple `'self'` policy that approves the application's origin. Note that this policy is only secure if nothing else is hosted in the application's origin.

### Applications relying on third-party components

To enable the use of `'strict-dynamic'`, initial scripts must be approved with a hash or a nonce. To use hashes, the SPA's main page has to be rewritten at build time, but can be served statically. To use nonces, the SPA's main page requires slight modifications at build time and has to be dynamically served by a web server.

<include src="SignupCTA" text="Try out the most powerful authentication platform for free." linkText="Get started →" />

## Coming Up Next

I know you're excited to get started. But before you dive into CSP yourself, take a look at the next article in this series, where we offer practical tips and tricks for deploying CSP.

Deploying CSP in Single Page Applications

332d7898dae6bc56031ac3507a0248ba

I'm a full-stack developer with a passion for technology and code. I love writing tutorials for developers to showcase a particular technology whilst building something useful at the same time. Right now  I can mostly be found developing for the front-end, playing around with Docker, or tinkering with Unreal Engine and electronics!

Developer Experience Engineer

Steve Hobbs

Learn about the essential features of the Auth0 Vue SDK and how it helps developers secure Vue 3 apps.

Today, we are announcing the release of the [Auth0 Vue SDK](https://www.npmjs.com/package/@auth0/auth0-vue), a new SDK that makes it easy to integrate Auth0 with any Vue 3 apps. This new SDK only supports Vue 3 apps. To secure Vue 2 (Vue.js) apps, developers can use the [Auth0 SPA SDK](https://auth0.com/docs/libraries/auth0-single-page-app-sdk) instead.

[Vue.js](https://vuejs.org/) is a progressive JavaScript framework designed for building user interfaces using HTML, JavaScript, and CSS. It makes building apps for the modern web easy while providing developers with a lot of flexibility.

The Auth0 Developer Experience team designed the new [Auth0 Vue SDK](https://github.com/auth0/auth0-vue) to follow idiomatic patterns that are familiar to Vue developers. The Vue SDK abstracts the features of the [Auth0 SPA SDK](https://github.com/auth0/auth0-spa-js) into a Vue plugin that developers can consume in Vue 3 components either using the Options API or the new Composition API.

Starting today, Vue developers can:

- [Install the `auth0-vue` package from `npm`](https://www.npmjs.com/package/@auth0/auth0-vue)
- [View the Auth0 Vue SDK source code on GitHub](https://github.com/auth0/auth0-vue)
- [Read and follow the quickstart](https://auth0.com/docs/quickstart/spa/vuejs)
- [Grab the sample apps](https://github.com/auth0-samples/auth0-vue-samples)

## Auth0 Vue SDK Features

This new Auth0 Vue SDK arrives at a great time as Evan You announced on February 7th, 2020, that [Vue 3 is now the default version of Vue](https://blog.vuejs.org/posts/vue-3-as-the-new-default.html). As such, the Auth0 Vue SDK fully supports Vue 3 along with the Options API and the Composition API. The SDK also provides full TypeScript support.

Here’s a breakdown of the essential features that developers can enjoy when using the new Auth0 Vue SDK:

- Quick implementation of login and logout functionality into Vue 3 apps using the [Auth0 Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login) page.
- Easy access to profile information about the logged-in user.
- Availability of access tokens to retrieve protected user data from an external API.
- Simple mechanism to protect Vue 3 routes using a router guard from the SDK with the [Vue Router](https://next.router.vuejs.org/).

## Vue 2 Auth0 SDK Support

The new Auth0 Vue SDK only works with Vue 3. If you’re working on an app that uses Vue 2, you can use the [Auth0 SPA SDK](https://auth0.com/docs/libraries/auth0-single-page-app-sdk) instead to implement authentication in your application.

To see the integration of Vue.js (Vue 2) with the Auth0 SPA SDK in action, take a look at the ["Vue.js/JavaScript Authentication" code sample](https://auth0.com/developers/hub/code-samples/spa/vue-javascript/basic-authentication) from the 
 [Auth0 Developer Hub](https://auth0.com/developers/hub/code-samples/spa/vue-javascript)!

## Integrate Auth0 Vue into Your Vue 3 Application

You can quickly integrate the Auth0 Vue SDK with your Vue 3 application by following a few steps.

If you don’t already have an Auth0 application to work with, create a Single Page Application in your [Auth0 Dashboard](https://manage.auth0.com/) and configure the following URLs for your application under **Application URLs**:

- **Allowed Callback URLs**: `http://localhost:8080`
- **Allowed Logout URLs**: `http://localhost:8080`
- **Allowed Web Origins**: `http://localhost:8080`

You can replace `http://localhost:8080` with the root URL of your application.

Take note of the **Client ID** and **Domain**, as you will need those in the next step.

Install the Auth0 Vue SDK from npm:

```bash
npm install @auth0/auth0-vue
```

Import the Vue plugin and use the `createAuth0` function to register it with your Vue 3 app:

```javascript
import { createAuth0 } from '@auth0/auth0-vue';

const app = createApp(App);

app.use(
  createAuth0({
    domain: '<YOUR AUTH0 DOMAIN>',
    client_id: '<YOUR AUTH0 CLIENT ID>',
    redirect_uri: window.location.origin,
  }),
);

app.mount('#app');
```

Replace the `<YOUR AUTH0 DOMAIN>` and `<YOUR AUTH0 CLIENT ID>` placeholders with the actual **Client ID** and **Domain** values you got from the Auth0 dashboard.
Create a `LoginButton.vue` component and use the Auth0 Vue SDK to log the user in. Here’s an example using a [Single File Component](https://vuejs.org/guide/scaling-up/sfc.html) and the Composition API:

```js
// LoginButton.vue
<template>
  <button @click="login">Log in</button>
</template>

<script>
import { useAuth0 } from "@auth0/auth0-vue";

export default {
  setup() {
    const { loginWithRedirect } = useAuth0();

    return {
      login() {
        loginWithRedirect();
      },
    };
  },
};
</script>
```

If you prefer to use the Options API, the same thing can be achieved using the `$auth0` accessor:

```js
<template>
  <button @click="login">Log in</button>
</template>

<script>
export default {
  methods: {
    login() {
      this.$auth0.loginWithRedirect();
    },
  },
};
</script>
```

Add a `LoginComponent` to your app, start it up, and click the button to see the magic of authentication!

Please check out [the Quickstart](https://auth0.com/docs/quickstart/spa/vuejs) for more things you can do with the SDK and the [repository on GitHub](http://github.com/auth0/auth0-vue) for a more detailed description of the setup and usage of the SDK.

Enjoy!

Introducing the Brand-New Auth0 Vue SDK

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

Learn how to use TypeScript and Auth0 to secure a feature-complete Express.js API. Tutorial on how to use Auth0 to implement authorization in Express.

Node.js and TypeScript Tutorial: Secure an Express API

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

New feature adds a dedicated security team and support for multiple languages to prevent fraudulent access with stolen credentials

**BELLEVUE, Wash. – February 9, 2022 – [Auth0](https://auth0.com/)**, a product unit within [Okta](https://www.okta.com/) (NASDAQ: OKTA), today announced the general availability of [Credential Guard](https://www.auth0.com/breached-passwords#credential-guard), a new security feature that helps enterprises prevent account takeover attacks by detecting and resetting stolen passwords faster. Credential Guard upgrades Auth0’s existing breached password detection with a dedicated security team, and support for more than 35 languages and 200+ countries and territories to reduce breach detection time.

Credential Guard gives application builders the tools to help secure their apps and to help protect their users from bad actors logging in with stolen credentials. Auth0’s breached password detection enables organizations to automatically screen for stolen passwords, and alert the user, prompt for additional verification, or block access by forcing a password reset. Credential Guard adds even more visibility and speed with a dedicated security team that infiltrates criminal communities to gain access to otherwise unavailable breach data.

Auth0’s security team conducted an internal test on 100,000 random usernames, and found that the ability to detect breached passwords (breach detection efficacy) increased by a minimum of 250% when using Credential Guard compared to an automated detection solution alone.

“The goal with Credential Guard is to help organizations detect breaches as soon as they happen, to reduce the risk to the business and its users,” said Shiv Ramji, Chief Product Officer at Auth0. “Traditional web scanners and scrapers rely on breach data being made public, which can be months or even years after the initial breach. Credential Guard enables security teams to shrink that gap, and better protect their customers’ digital identities on a global scale.”

Account takeover attacks with stolen credentials, targeting everything from sensitive healthcare data to loyalty points, are one of the most common and costly cyber threats. Verizon’s 2021 [Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) (DBIR) found that 89% of web application breaches involve some sort of credential abuse (use of stolen credentials or brute force). Reusing passwords across sites increases the risk of an attack and makes it more difficult for organizations to prevent fraudulent access to user accounts. With Credential Guard, organizations can secure their apps and protect their users during the login process by detecting and resetting exposed passwords before they fall into the wrong hands.

Credential Guard is available as an Enterprise Add-on for existing Auth0 customers. For more information, please visit the [Auth0 blog](https://auth0.com/blog/detect-breached-passwords-faster-with-auth0-credential-guard/).

<include src="asides/AboutAuth0" />

## About Okta

Okta is the leading independent identity provider. The Okta Identity Cloud enables organizations to securely connect the right people to the right technologies at the right time. With more than 7,000 pre-built integrations to applications and infrastructure providers, Okta provides simple and secure access to people and organizations everywhere, giving them the confidence to reach their full potential. More than 14,000 organizations, including JetBlue, Nordstrom, Siemens, Slack, Takeda, Teach for America, and Twilio, trust Okta to help protect the identities of their workforces and customers.

### Media Contacts

Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

### Investor Contact

Investor Relations<br />
[investor@okta.com](mailto:investor@okta.com)<br />

<br>
<div class="alert alert-info alert-icon">
  These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments nor all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials. Information regarding Okta's contractual assurances to its customers can be found at <a href="https://www.okta.com/agreements/">okta.com/agreements</a>.<br> 
</div>



Auth0 Credential Guard Detects Breached Passwords Faster to Prevent Account Takeover

tonycamp

Tom Camp is a DevRel Engineer at <b><a href="https://ably.com/">Ably</a></b>. His recent interest lies in open realtime data and ways of representing and sharing it. He’s also a member of the Open API and Async API communities which work towards standardizing specifications and capabilities of APIs. In his spare time, Tom loves to play strategy-based games and modding them.

DevRel Engineer at Ably Realtime

Thomas Camp

Creating a Universal Authentication System with Auth0 for Ably's scalable chat application.

This is the second part of [Ably’s Fully Featured Scalable Chat App](https://ably.com/blog/fully-featured-scalable-chat-app) series. We have been working on creating a prototype for an open-source chat application that anyone could use at real-world scales of traffic, with many of the bells and whistles one would expect from a modern chat application. This means integrated media, notifications, and more.

If you want to try out this application yourself, you can get the code from [GitHub](https://github.com/ably-labs/fully-featured-scalable-chat-app) and follow the [README](https://github.com/ably-labs/fully-featured-scalable-chat-app#readme) on the steps for local setup.

Our goal is for you to be able to take the code and create your own scalable chat application or mix and match elements from it into other applications that need a chat element.

Ably handles the complexity of distributed messaging between clients, presence checks, and authorization of messages. By making use of [WebSockets](https://ably.com/topic/websockets) we can have persisted, realtime communication. Making use of Ably as a [Pub/Sub broker](https://ably.com/pub-sub-messaging), we will be able to have the consistent ordering of messages and reliable message ordering. You can try out these features by [signing up for a free Ably account](https://ably.com/signup).

Before starting on these elements, however, we need the absolute fundamentals of chat. One of the most crucial things to get right is the authentication of users.

Authentication requires:

*   All information we store on users to be secure
*   We should provide 2FA and reasonable methods to recover an account should login credentials be forgotten
*   Password resetting should be possible
*   We need to be able to assign permissions, user information, and more to a user

## 

## Starting Off

Prior to starting on our authentication system, we already have a few things in place.

We have a frontend server that is hosting a [ReactJS](https://reactjs.org/) application, compiled using [Snowpack](https://www.snowpack.dev/). On this, we have a basic page as seen below which allows for a user to set a username for themselves.

![Starting Off](https://images.ctfassets.net/23aumh6u8s0i/10HfnKU3xmw1aTcBXfQNwP/36fc8f2a57b7a7dc1f323cfd090c7ea8/Uploaded_from_Fully_Functional_Scalable_Chat_App)

Once a user sets their username, they’ll be taken to the main chat application page, which has the available hard-coded chat channels on the left, which you can click on to load a [React Component](https://reactjs.org/docs/react-component.html) on the right of the screen for chatting within that channel.

![Starting Off](https://images.ctfassets.net/23aumh6u8s0i/6UCmezwQzxO2oDofbC3JaX/5433dd6b9b2d8409fb4a6f79b599c8e5/ably-chat.png)

The chat uses Ably. When a user clicks on one of the chat channels on the left of the screen, we use the [Ably React Hooks](https://ably.com/blog/ably-react-hooks-npm-package) library to connect to one of Ably’s servers and subscribe to its associated [Ably Channel](https://ably.com/documentation/realtime/channels). For example, to subscribe to the Ably Channel for the ‘global-welcome’ chat room:

```javascript
[ channel ] = useChannel(“global-welcome”, (message) => {
// Append message to our chat box component
});
```

If we want to publish a message to this channel, we can make use of the channel object returned by the `useChannel` function:

```javascript
channel.publish("message", messageFromChatBox);
```

We do both of these within the FFS app inside our [ChatContainer](https://github.com/ably-labs/fully-featured-scalable-chat-app/blob/main/app/src/components/Chat/ChatContainer.jsx) code, which you can check if you’d like to see real examples.

With the above, we’re able to allow for non-authenticated usage of some hard-coded chat rooms with a username. However, we have no form of authentication at this stage. We trust the user to set themselves to have any name, even if it’s the same as someone else. We have no way to uniquely identify a user, which is something that is crucial for having any form of permissioning, private discussions, notifications, and more.

## Creating a Basic Authentication System

For an absolutely rudimentary authentication system, we need to have:

*   A signup page where users can create a username and password
*   A database to store these, with the password being encrypted
*   A backend system that can authenticate a user when logging in by checking their login details to the database, and return a token that the user can use for any actions which require authentication
*   An endpoint that can be used to get authentication credentials to be used with Ably

<br>
In addition, we’d want:

*   2-Factor Authentication
*   Password Resetting
*   Social media logins

Each would be complex to implement, with many edge-cases and many security concerns to address. However, we thankfully knew of an existing solution for this, which [we’ve used in numerous projects](https://auth0.com/blog/dependable-and-secure-realtime-in-spring-boot-with-auth0-and-ably/) before, known as [Auth0](https://auth0.com/).

Auth0, an authentication and authorization platform, simplifies this process immensely. Not only does it allow for easy integration with your login systems, but it also makes integrating other login services such as Google and Twitter simple. It allows for a quick setup of permissions, roles with set permissions attached, and these roles to be assigned to users. These users can then use various login systems to access the same account and thus have the same permissions.

### Setting up Auth0

To make use of Auth0, you firstly need to create and configure an account with them. To do this, firstly, [sign up to Auth0](https://auth0.com/signup) on their website. Go through the signup process, setting whatever [tenant name and region you'd like](https://auth0.com/docs/get-started/create-tenants). Once you’re signed up, go to the ‘Applications’ part of the website. You should see ‘Default App’ here, which you can use for this tutorial, or you can create a new app if you so wish.

![Setting up Auth0](https://images.ctfassets.net/23aumh6u8s0i/62NYAkeQ25FA41mP2aspir/c6b325272a4447284036388fcae8a51c/Uploaded_from_Fully_Functional_Scalable_Chat_App)

If you go to your app, you should arrive on the ‘Settings’ page for the app. From here, you should make a note of the **Domain**, **Client** **ID**, and **Client Secret**.

![Setting up Auth0](https://images.ctfassets.net/23aumh6u8s0i/5ksyxBrksEBwQSeCkZe5VP/945e24c31578d98a6425b52c61eefbe0/Uploaded_from_Fully_Functional_Scalable_Chat_App)

On this _settings_ tab, scroll down to the section called ‘Application URIs.’ In it, you should see a field for ‘Allowed Callback URLs’ and ‘Allowed Logout URLs.’ For context, the flow of a webpage using Auth0 is:

*   Your site links a user to your Auth0 app’s login page, where they sign in
*   The Auth0 page redirects the user back to your website’s ‘callback’ page
*   When the user wants to log out, they are directed to the Auth0 app’s logout page and then redirected back to the page specified in the ‘returnTo’ query passed to the logout page

To avoid potential misuse and abuse, you need to specify what URLs Auth0 can redirect to. When hosting this chat app locally, it is hosted on localhost:8080, so set the **Allowed Callback URLs** to ‘[http://localhost:8080/auth0-landing](http://localhost:8080/auth0-landing)’. When a user logs out, we’ll have the user redirected back to our main page, so set the **Allowed Logout URLs** to ‘[http://localhost:8080/](http://localhost:8080/)’.

### Using an Auth0 application from the chat application

With the Auth0 application set up, the actual chat application needs to make use of it. When someone attempts to sign up or log in via Auth0, we will need to redirect a user to the appropriate Auth0 endpoint, and the same needs to occur when a user logs out.

Auth0 provides both a [React library](https://www.npmjs.com/package/@auth0/auth0-react) as well as a standard node module. Both work well, and in most cases, you’d probably want to use the React library as it will automatically handle a lot of authentication state sharing between different components.

For this project, however, we decided to go with the node module. This was due to a few reasons:

*   We want the code to be easily understood, and as we will need to use the node module version from the [Serverless Functions](https://azure.microsoft.com/en-gb/services/functions/) we’re using for our database, it makes sense to keep consistency between both frontend and backend
*   To use the Auth0 library, it needs to have specific details such as the endpoint name specified as part of a compilation. To have these details adjustable by anyone using the project, we’d need to set this as part of the environment variables. This variable would be required at two different stages, the compilation (which we do on GitHub using [GitHub Actions](https://github.com/features/actions)) and at runtime (for the Serverless Functions which we’re hosting on Azure), we’d need to specify it in 2 separate environments.

To avoid these complications, we decided only to store these Auth0 variables on the Serverless Functions and make them available via a Serverless Function to clients to use. We couldn’t use the React library to do this, as it has no method for asynchronous instantiation of details.

Using the node library, we just need to fetch the Auth0 configuration details from the appropriate Serverless Function endpoint, and then use those to instantiate an Auth0 client:

```javascript
import createAuth0Client from "@auth0/auth0-spa-js";

const response = await fetch("/api/oauth/config");
const configuration = await response.json();
cachedClient = await createAuth0Client(configuration);
```

The Serverless Function at `/api/oauth/config` simply responds with the configuration details we obtained earlier when setting up Auth0:

```javascript
  context.res = {
	status: 200,
	body: JSON.stringify({
  		domain: process.env.AUTH0_DOMAIN,
  		clientID: process.env.AUTH0_CLIENTID,
  		client_id: process.env.AUTH0_CLIENTID,
  		redirect_uri: process.env.AUTH0_REDIRECT_URI
	})
  };
```

Now we can add a button to our chat application which will instantiate our Auth0 client as seen above, and then use the Auth0 library’s login method to redirect the user to the Auth0 login page for our app:

```javascript
export async function loginWithRedirect(event) {
  event.preventDefault();
  const auth0 = await useAuth0();
  await auth0.loginWithRedirect();
}
```

![Setting up Auth0](https://images.ctfassets.net/23aumh6u8s0i/Ce4CuRSlp8zXsf3nNvzmG/896b959bb5619c99cad5234d4d18f8f7/Uploaded_from_Fully_Functional_Scalable_Chat_App)

When the user either signs up or enters valid credentials for logging in via Auth0, they need to be redirected to the page we specified when setting up Auth0, `localhost:8080/auth0-landing`.

With that, Auth0 is now up and running and we can use it as an authentication method!

## Storing user credentials

We now have login credentials of our users stored in Auth0, but we need that data to be accessible and associated with data in our CosmosDB database as well. Ideally we’d [migrate our database’s contents over to Auth0](https://auth0.com/docs/users/import-and-export-users/configure-automatic-migration-from-your-database) to avoid duplication of information, however for the time being we decided to keep data in CosmosDB.

As we will be treating our own database as the definitive location of data, we will want to also have our Auth0 users stored in our database as well. To do this, we can just intercept the response of signup via Auth0, and get the Auth0 ID and other details to store in our database.

Our CosmosDB will thus end up with a data structure for Users, defined in our [Users.ts](https://github.com/ably-labs/fully-featured-scalable-chat-app/blob/main/api/common/metadata/User.ts) file, of:

*   id: Unique ID for the User in our database
*   username: the login name they use if using our custom login system
*   oauthSub: The unique Auth0 ID if the user has an Auth0 login method associated with them
*   firstName: The user’s first name
*   lastName: The user’s last name
*   profileImgUrl: User’s profile image

With the above, we can provide users with login methods for both Auth0. We will also have representations of all our users within our database.

## Conclusion

With that, we have a way to authenticate users. With Auth0 we’re able to have 2FA, password recovery, and a smooth signup process handled for us. We have additional user information stored within CosmosDB, which we can use for providing additional information on users, which we can potentially use for profile pages, attaching details to messages.

With authentication done now, we still need to be able to authorize these users. We may know who someone is when they’re logged in, but we’re yet to define what permissions they should have, and how we’ll control them.

Next, we’ll be diving into how we can make use of a combination of Role-based Access Control (RBAC) and fine-grained permissions to define an authorization structure for users, as well as how to apply these permissions to both our backend as well as our real-time communications over WebSockets using Ably.

If you have any questions or thoughts about this project, please get in touch on [Twitter](https://twitter.com/ablyrealtime/) or via [email](mailto:devrel@ably.com) and we’d love to talk with you!

Ably's Fully Featured Scalable Chat App

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

The software’s latest features will help users bolster their data security.



If you happened to catch Apple’s initial June 4, 2018 announcement of iOS 12, you might have noticed that it was lacking the “big splash” that we’ve seen from other iOS announcements. That’s partially because Apple was so busy focusing on new iOS 12 data security features.

Though more is to be unveiled at the September 12, 2018 Apple Keynote event, many of the features of iOS 12 that have been revealed likely won’t catch the average consumer’s attention. That’s intentional. Good data security features are relatively unnoticeable to most users. If anything, those features in Apple’s newest mobile OS will make life a little bit easier for the average iPhone user.

But, if you happen to be an IT or security pro, the new iOS 12 probably piqued your interest.

This emphasis on personal data privacy and security from Apple prompts one question: is iOS 12 the most secure operating system Apple has ever released?

In a word, yes. Let’s dig into what makes it so secure.

## Better Anti-Hacking Technology for Data Privacy

One of the biggest changes Apple is making to the new iOS’s security is the introduction of USB Restricted Mode. 

On iOS 11 and earlier iOS versions, USB-based communications stay active for up to seven days after the phone is locked. This means that if an iPhone is stolen, the would-be hackers have seven days to plug a brute force device, such as GrayKey, into the phone and force it to unlock.

_[The New York Times](https://www.nytimes.com/2018/06/13/technology/apple-iphone-police.html)_ calls this seven-day window a massive security vulnerability in iOS 11.

The good news is that Apple is closing this window. With USB Restricted Mode on iOS 12, Apple is reducing the time for USB-based communications to just one hour after the phone is locked. 

That makes a brute force attack on iOS 12 nearly impossible. According to one app developer we talked to, “USB Restricted Mode essentially turns the phone into a battery-powered brick after one hour.” Unless the phone is unlocked by an authorized user in that hour timeframe, it’s useless to would-be hackers.

To illustrate this further, if an employee at your company has their iPhone stolen with iOS 11 on it, there’s a very good chance the thief will be able to gain access to the phone within seven days. However if iOS 12 is installed, the thief will only have one hour to attempt a brute force attack. The chances of that being accomplished in an hour are very unlikely. 

This data privacy feature is automatically turned on in the new OS, but Apple does give you the option of disabling it:

![Turn USB Restricted Mode Off in iOS 12](https://images.ctfassets.net/23aumh6u8s0i/43Cy7OyrsRaEn2felz1YVf/dce0db81be1260e1be29ba15fad941c2/ios12-usb-restricted-mode-off)

_[Image Source](https://www.macrumors.com/how-to/access-controls-usb-restricted-mode-ios-12/)_

We're excited by both the strength and flexibility of this for greater personal data security.

## Password Reuse Auditing

As is the case with any data security system, humans are the weakest link. If you develop the best tools in the world but the actual human operators aren’t using it, then it’s worthless.

That’s why Apple is trying to make password management as simple as possible in iOS 12. One of the features that makes this easier is Password Reuse Auditing. This feature monitors the passwords that iPhone owners use for different services. When it catches someone [using the same password on different websites](https://www.godaddy.com/garage/10-best-practices-for-creating-and-securing-stronger-passwords/), it flags the duplicate, offers a more secure password, and then saves it to the iCloud Keychain.

![iOS 12 Password Autofill - Password Reuse Auditing flag present on online service](https://images.ctfassets.net/23aumh6u8s0i/4xFwJwR593h6HlGI5SjAo/59a1d22b1766872c1ecc233dcf3a8cac/ios-12-password-reuse-auditing-flag-present-on-online-service)

_[Image Source](https://www.macrumors.com/how-to/automatic-passwords-and-auditing-in-ios-12/)_

The issues with using one password across different websites are well documented. Security experts have been trying to get around these issues for years and Apple is doing their best to help. Auth0 offers secure authentication using [token-based, passwordless authentication](https://auth0.com/passwordless) that features a brute-force protection system.

### iCloud: The Elephant in the Room

At first glance, this iOS 12 security feature seems slightly less secure. For this feature to work, Apple has to record your current passwords and be able to crawl them for matches. While at the same time, Apple stores everything in the iCloud. 

That concern caused Apple to make this system as secure as possible. This feature uses a highly secure 256-bit AES for encryption. 256-bit AES is nearly impossible to crack. It’s actually the same encryption standard that the US government uses to transmit top secret data. It seems that Apple is pretty serious about security. 

In addition to using the uncrackable 256-bit AES, Apple also recommends users enable two-factor authentication for their iCloud Keychain. That combination makes it extremely unlikely that some nefarious individual would be able to compromise the iCloud. 

Speaking of two-factor authentication…

## Making Two-Factor Authentication Easier

_[Two-Factor Authentication](https://auth0.com/learn/two-factor-authentication/)_ (2FA) is the next big security feature in iOS 12. 

For years, data privacy experts have been begging and pleading with website users to set up 2FA. It's one of the best ways to [protect individuals and small teams from cyber attacks](http://blog.idonethis.com/security-ringcaptcha/). Adoption has still been relatively low because 2FA adds an extra step for users.

The most common type of Two-Factor Authentication is SMS text message 2FA. This authentication protocol sends users a text with a passcode before they are granted access to a system.

The problem is, it requires a lot of switching back and forth between apps to get the code, memorize the code, and then plug it into the app. And, if the user mistypes or misremembers the code, then it's back to square one.

Luckily, Apple is coming to the rescue. With iOS 12, SMS security codes will autofill without the user having to switch from app to app. No memorization, either. It does this by making specific API calls to the messaging app. When iOS 12 recognizes an SMS 2FA security code, it will automatically pull it into autofill for the user. 

![iOS 12 SMS 2FA security code and autofill example](https://images.ctfassets.net/23aumh6u8s0i/5fZy2u7OvyQocoyZ7jLsLh/225753ebf85204d06fa4e6ddc2ad7feb/ios-12-recognizes-an-sms-2fa-code-and-autofills-it-for-user)

There is one downside here. It has been well established that SMS 2FA can be compromised. We recently mentioned this _[in a post about a Reddit data breach](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/)_. Even still, any 2FA is better than no 2FA. With Apple including this feature in iOS 12’s security, they’ve made users significantly less prone to hacking.

## What Else is New in Data Security for iOS 12?

There are a few other security features worth mentioning in iOS 12. First up is group video chat. What makes this a security feature? Facetime is fully encrypted and extremely secure. Adding group chat to Facetime simply means that Apple is now supporting fully encrypted group chats. 

Apple also introduced a new Face ID feature. The tech company is giving iPhone owners the ability to add a “second face.” This allows two different users to unlock an iPhone using Face ID. We’ve covered the _[security of Face ID](https://auth0.com/blog/is-faceid-really-secure/)_ is another blog post. It’s good to see Apple improving upon this feature.

## Final Thoughts iOS 12 Release

We’re really impressed with Apple’s new iOS 12 security features. Not only are they making the operating system more secure, they’re making security easier to use. That combination is one that security experts are always after. Be looking for "A new iOS update is now available" as iOS 12 will be released soon.

<include src="asides/AboutAuth0" />


Apple iOS 12: Is it the Most Secure iOS Ever?

What's new in .NET 6? What are the main relevant features brought by the new version of the .NET platform? Let's take a quick look.

With the release of .NET 6, Microsoft consolidates its plan to create a unified platform to develop applications for any device and operating system. Together with this vision, .NET 6 brings many new features aiming to simplify development and gain performance. Let's take a quick look at the main points.

## Unified Platform Support
The vision of a [unified platform for the .NET world started with .NET 5](https://auth0.com/blog/dotnet-5-whats-new/). That release was meant to be the unified successor of [the various .NET flavors: .NET Framework, .NET Standard, .NET Core, Mono](https://auth0.com/blog/navigating-dotnet-maze/), etc. Beyond this goal, .NET 5 wanted to be a development platform to create any kind of application for any platform. However, at that time, an important piece was missing to complete the puzzle: a unified framework to create cross-platform UIs. Now, with [.NET MAUI](https://devblogs.microsoft.com/dotnet/announcing-net-maui-preview-10/), i.e., the **.NET Multi-platform App UI** framework, the puzzle is complete. Although at the time of writing [.NET MAUI is in preview](https://devblogs.microsoft.com/dotnet/announcing-net-maui-preview-10/), it is mature enough to be considered part of the .NET 6 release.

Now with .NET 6, you can really create the application you want and run it practically everywhere: from desktop to mobile, from the web to the cloud.

![.NET 6 unified platform](https://images.ctfassets.net/23aumh6u8s0i/GOa5gfL6LckpRRhqaBRJe/69341464075cbd46cf88fcbe36af4aa5/dotnet-unified-platform.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6/)]
</p>

In particular, the new [.NET MAUI](https://github.com/dotnet/maui) framework allows you to build desktop and mobile native user interfaces with a single codebase.

![.NET MAUI overview](https://images.ctfassets.net/23aumh6u8s0i/4WkvXpMRwu7j5T82HiW04A/069649d85ea4e1def0831672b5fc8698/dotnet-maui-overview.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/introducing-net-multi-platform-app-ui/)]
</p>

## Simplified Development
One of the main goals of the .NET 6 release is to provide developers with features that simplify their work. You can find support for simplified development throughout the platform, but three contexts are really exciting: new C# features, Hot Reload support, and minimal web APIs.

### C# 10 features
.NET 6 brings you [C# 10 with plenty of new features](https://devblogs.microsoft.com/dotnet/welcome-to-csharp-10/) that help you write code more easily. Let's take a quick look at a few of them.

#### Global and implicit usings

As a C# developer, you know how annoying it is to declare the same namespace in every file of your project. Consider, for example, the `System` namespace. Its use is very common, and I'm pretty sure you forget it all the time and let Visual Studio suggest it.

Now you can declare namespaces using a global `using`, as shown in the following example:

```csharp
global using System;
```

With this declaration, you don't need to insert the `using System;` declaration in all files anymore. You can declare a namespace through `global using` in any file, and it will be available in the entire project.

If you prefer (and I think it's a good practice), you can declare your namespaces in a file named `GlobalUsings.cs`.

You can also take advantage of implicit `using`s by configuring the `<ImplicitUsings>` element in your `.csproj` file, as shown below:

```xml
<PropertyGroup>
    
    <ImplicitUsings>enable</ImplicitUsings>
</PropertyGroup>
```

This way, the compiler will automatically add the required `global using` directives based on the type of your project.

#### New namespace syntax

You know that the usual way to declare a namespace is as follows:

```csharp
namespace Geometry
{
  class Triangle 
  {
    // ...class members...
  }
}
```

Now you can use the file-scoped namespace syntax to get the same result:

```csharp
namespace Geometry

class Triangle 
{
  // ...class members...
}
```

With this approach, everything you define in the current file belongs to the declared namespace. By removing a nesting level, you make the code a bit cleaner. However, you can't create nested namespaces with this new syntax.

#### Natural types for lambda expressions

Consider the following assignment of a lambda expression to a variable:

```csharp
Func<string, int> parse = (string s) => int.Parse(s);
```

You need to declare the target type of the lambda expression, `Func<string, int>` in the example. Starting with C# 10, you can write the above code as follows:

```csharp
var parse = (string s) => int.Parse(s);
```

The compiler will try to infer the "natural" type of the lambda expression.

### Hot Reload
To improve the developer's productivity, .NET 6 extends [the Hot Reload feature](https://devblogs.microsoft.com/dotnet/announcing-net-6/#hot-reload) to Visual Studio and almost any type of project. It allows you to run an application in your development environment, make changes, and get the changes applied without stopping, rebuilding, and rerunning the application.

In previous .NET releases, this feature was available just for the .NET CLI via the `dotnet watch` command. Not without [some minor hiccups with the community](https://www.theverge.com/2021/10/22/22740701/microsoft-dotnet-hot-reload-removal-decision-open-source), you can now benefit from it in [Visual Studio 2022](https://devblogs.microsoft.com/dotnet/update-on-net-hot-reload-progress-and-visual-studio-2022-highlights/#improved-user-experience-in-visual-studio-2022) as well by simply clicking a button:

![Visual Studio 2022 Hot Reload button](https://images.ctfassets.net/23aumh6u8s0i/3wu09sA8C4IQ5uKfmGoITK/e13d618f3f497e72281665de780b472d/vs2022-hot-reload-button.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/update-on-net-hot-reload-progress-and-visual-studio-2022-highlights/)]
</p>

### Minimal web APIs
One astonishing feature introduced by .NET 6 to simplify your code is [minimal web APIs](https://docs.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis). Along the lines of top-level statements, now you can build a fully working web API application with a few lines of code. Consider the following sample:

```csharp
//Program.cs
var app = WebApplication.CreateBuilder(args).Build();

app.MapGet("/", () => "Hello World!");
app.Run();
```

This is all the code you need to run a simple *Hello World!* web API.

If you have some experience building web APIs with ASP.NET Core, you know that you usually need a more articulate project. You need at least a `Program.cs` file with the setup code for the application, a `Startup.cs` file where you configure your API, and a controller class defining the API routes and implementing the endpoints.

That's a lot of simplification!

## Performance Improvements
In the last years, the .NET team put a lot of effort into improving the platform performance in compiling and execution time and reducing memory consumption. With .NET 6, you can appreciate these improvements in many parts of the framework. For example, the effort to [improve inner-loop performance](https://github.com/dotnet/core/issues/5510) in building .NET projects has given awesome results, as you can see from the following diagram:

![dotnet6-build-improvements](https://images.ctfassets.net/23aumh6u8s0i/2ZVS4o4DKc6OroBO0Lb76b/187a5cbf18d934d9a1cefae71f1535f5/dotnet6-build-improvements.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6-preview-2/)]
</p>

Other performance improvements include the IO subsystem. For example, the `FileStream` class [was almost completely rewritten](https://devblogs.microsoft.com/dotnet/file-io-improvements-in-dotnet-6/) with amazing results even with respect to .NET 5, as the following table summarizes for the writing operation:

![FileStream performance improvement](https://images.ctfassets.net/23aumh6u8s0i/6RgFjbKytdIQk6pHtEaHxT/1d524bb8a02e4688979d71f3151aef3f/filestream-performance-improvement.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6/)]
</p>
You can check out [a detailed report on performance improvements in .NET 6](https://devblogs.microsoft.com/dotnet/performance-improvements-in-net-6/) with related benchmarks for more information.

## Summary

This quick overview of .NET 6 shows that this is a consolidation release of the .NET platform. It aims to complete the unified platform vision started with .NET 5, improves the internals of the platform to provide the best performance, and starts a process of development simplification that probably will go further in future releases.

<include src="asides/DotNetCore" />

.NET 6 Highlights

Learn about the new features introduced by the .NET Core 3.0 release.

Exploring .NET Core 3.0. What's New?

tadej-slamic

With over a decade in the software industry, I've helped startups launch their first product, assisted FTSE100 enterprises with digital transformation, been a part of the fintech boom, and helped particle accelerators cool down. I enjoy architecting and creating scalable backends and crafting modern mobile, web, and desktop apps.

CTO at Shortcut AS

Tadej Slamic

Learn how to use Spring Boot, Java, and Auth0 to secure a feature-complete API. Learn how to use Auth0 to implement authorization in Spring Boot.

Spring Boot Authorization Tutorial: Secure an API (Java)

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

New feature removes the need for passwords and offers unique progressive enrollment features, paving the way for the ultimate user experience.


**BELLEVUE, Wash. – June 15, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced the launch of [Auth0 WebAuthn Passwordless](https://auth0.com/passwordless), an authentication feature that enables end-users to seamlessly log in with a biometric identifier — such as facial recognition or a fingerprint — as a convenient and secure alternative to a traditional password. Removing the need for long, complex passwords, Auth0 WebAuthn Passwordless provides a frictionless experience for end-users while reducing the significant password management burden for companies. 

<include src="WebAuthnMeCTA" group="B"/>

Today’s abundance of applications and systems have never had more access points, leaving organizations and their end-users vulnerable to attacks. A reliance on passwords as a primary means of authentication, combined with users’ tendency to re-use passwords across applications, presents a number of security, user experience, and cost issues. According to a [2021 Data Breach Investigations Report by Verizon](https://www.verizon.com/business/resources/reports/dbir/), compromised passwords are responsible for 84% of breaches. Passwordless authentication mitigates these challenges and offers increased security and trust for applications, devices, and services providers; faster and smoother login experiences for their end-users; and cost savings by eliminating the need for password management support. 

“Despite ongoing guidance around proper password creation and repeated warnings against password reuse, consumers crave convenience and continue to use the easiest and most convenient path for application access,” said Shiv Ramji, Chief Product Officer at Auth0. “A passwordless future is largely being driven by two primary forces — security and convenience. Companies want to secure the vulnerabilities that come with passwords, and they also want to offer their users a better digital experience. Auth0 WebAuthn Passwordless is a modern option for organizations looking to attract and retain users.”

With Auth0 WebAuthn Passwordless, users can authenticate with Web Authentication-powered (WebAuthn) biometrics, the official web standard for passwordless authentication as published by [W3C and used by FIDO](https://fidoalliance.org/fido2/fido2-web-authentication-webauthn/), for first-factor authentication. This form of authentication eliminates security weaknesses based on password reuse since passwords are not required. Additionally, Auth0 WebAuthn Passwordless is an ideal option for companies looking to build and provide an authentication experience supporting conversion and retention of users who want more choice and less friction in their login experience.

Auth0 WebAuthn Passwordless eliminates the need for users to enter username and password credentials and enables simpler login with a biometric identifier such as facial recognition like Apple Face ID or a fingerprint scan on a mobile device or laptop. The biometric data remains stored on the device, alleviating privacy and security concerns for end-users. The feature also allows end-users to progressively enroll devices one at a time, as they use them, without needing a centralized portal, giving them the flexibility of having multiple passwordless authentication options — an advanced, unique capability that maximizes end-user adoption and enables a faster transition from passwords to passwordless, benefiting both end-users and organizations.

More detailed information on Auth0 WebAuthn Passwordless can be found here: [7 Things You Need to Know About Passwordless Authentication](https://auth0.com/resources/whitepapers/passwordless-authentication) (whitepaper) and on [Auth0’s blog](https://auth0.com/blog/freedom-from-passwords-with-auth0-webauthn-passwordless). 

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), provides a modern identity platform that helps organizations meet the security, privacy, and convenience needs of their users. Please visit [The Auth0 Identity Platform](https://auth0.com/identity-os) to learn more.


<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

Auth0 WebAuthn Passwordless Offers New Levels of Ease and Security for Modern Authentication

brandon-roberts

Brandon is a Developer Advocate at Nrwl, focused on community engagement, content creation, and collaboration around Nx, the open-source build framework. He enjoys learning new things, helping other developers build web applications, sharing knowledge, collaborating with others, and contributing to open source. Brandon is a Google Developer Expert in Angular, a technical writer, and also a maintainer of the NgRx project building libraries for reactive Angular applications.

Developer Advocate

Brandon Roberts

Whether you have a single application or a suite of applications, code reuse, standards around structure, process, and feature development help to ensure your codebase remains healthy in the long term.

[Nx is a build framework for monorepos](https://nx.dev) with first-class React support. It helps accelerate the adoption of proven development practices across projects of many sizes and scopes. Nx provides additional tooling for React projects to help scale and develop features at a faster pace. 

This guide walks through some of the tooling provided by Nx, the creation, and structure of an Nx workspace, with an example to follow along with.

<AmpContent>
<amp-youtube
    data-videoid="IMWk0P6EeRc"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/IMWk0P6EeRc' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## What are Monorepos

A monorepo is a single collection of all your source code that spans multiple applications, libraries, and languages. Everything in the monorepo is not deployed at the same time but is all located in a central repository. Many companies use monorepos for different organizations and projects. Some even use a single monorepo to house all the source code for projects across their entire company.

Here are some of the benefits of a monorepo:

* **Shared code** &mdash; Promotes reuse of validation code, UI components, and types across the code base, including code between the backend and the frontend.
* **Atomic changes** &mdash; Make changes to a server API and modify the clients that consume that API in the same commit. No more coordinating commits across different repositories.
* **Developer mobility** &mdash; Provides consistency between building and testing applications written using different tools and technologies. Developers can confidently contribute to other teams’ applications and verify that their changes are safe.
* **A single set of dependencies** &mdash; Use a single version of third-party dependencies for all your apps. Less frequently used applications don’t get left behind with a 3-year-old version of a framework library or an old version of a build tool. 

There are also a few common misconceptions with monorepos:

* Strictly co-locating your code just by placing all your code in the same repository.
* Running all the builds, tests, and quality checks on all applications for each PR or commit.
* Deploying every application on every commit to the main branch.
* Setting up multiple scripts across applications to handle common tasks.

Just because you have all your code in a monorepo, that does not mean you have run all the tests and checks on your monorepo for every single commit. This doesn't scale well and leads to bottlenecks in your development and Continuous Integration (CI) and Continuous Deployment (CD) pipelines. Nx provides integrated tooling to intelligently determine what needs to be run through code analysis, affected commands, and computation caching. 

### Affected commands

Nx uses code analysis to build a dependency graph of all projects in the workspace. It then uses the dependency graph to determine what projects are impacted based on your changes between your Git branches and the main branch. [Nx’s Affected Commands](https://nx.dev/latest/react/core-concepts/mental-model#affected-commands) use this code analysis to perform the minimum set of tasks based on what's changed. Let’s look at two applications that depend on a library as an example.

![](https://images.ctfassets.net/23aumh6u8s0i/3Msqcbm3M7zreqA7s3Yga/fa9a14ab5dd0970d45ff8603494a2530/Uploaded_from_Streamlining_a_React_Monorepo)

To see what applications are affected, use the **[nx affected:apps command](https://nx.dev/latest/angular/cli/affected-apps)**. Nx analyzes the nature of the changes and determines which projects, including applications and libraries, are impacted. In the example above, changing app1 doesn’t cause app2 to be impacted, so you don’t need to run all the pre-merge steps for app2. Alternatively, changing the lib, or packages that both apps depend on does impact both applications.

### Computation caching

Nx is smart in that it also knows the context in which you ran particular commands, the current hash of the files, and other environmental information. 

![](https://images.ctfassets.net/23aumh6u8s0i/1gsO5lGTZaluzgHVc3H3xr/f931ae116060c2def80962a764b4888b/Uploaded_from_Streamlining_a_React_Monorepo)

The image above displays an example of the information collected to build a unique hash used to identify the computation. With this information, Nx caches and stores these computations and can replay them if it seems the same computation is being run again.

This isn’t done through rebuilding source code. Only the artifacts produced from a given command are stored and replayed when possible. If Nx doesn’t find this computation, Nx runs the task, and after it completes, it takes the outputs and the terminal output and stores it locally (and if configured remotely). All of this happens transparently, so you don’t have to worry about it.

## Creating an Nx Workspace Using a React Preset

Now that you know how Nx works, let’s try it out by building a small application that lists Star Wars characters.

Start with creating the Nx workspace with a React application using the `react` preset. 

```sh
npx create-nx-workspace sw-org --preset react --appName myapp
```

After running this command, you’ll be asked to select a stylesheet format. You can choose the default for this demo. You also have the option to connect your workspace to [Nx Cloud](https://nx.app/) if you’d like.

After you make your selections, this command does the following:

- Generates a new Nx workspace
- Scaffolds out a new React application with modern tooling, including [Jest for unit tests](https://jestjs.io/), and [Cypress for E2E tests](https://www.cypress.io/).

There are other presets available, such as `next` for [Next.js](https://nextjs.org/) projects, and `react-express` for a workspace with React and Express pre-configured.

Every Nx workspace has a file structure similar to this:

```treeview
myorg/
├── apps/
├── libs/
├── tools/
├── workspace.json
├── nx.json
├── package.json
└── tsconfig.base.json
```

* `/apps/` contains the application projects. This is the main entry point for each runnable application.
* `/libs/` contains the library projects. Each library defines its external API so that boundaries between libraries remain clear. 
* `/tools/` contains scripts that act on your codebase.
* `/workspace.json` contains the configuration for each project in your workspace.
* `/nx.json` adds extra information about projects, including implicit dependencies and tags that can be used to restrict the ways projects are allowed to depend on each other.
* `/tsconfig.base.json` sets up the global TypeScript settings and aliases.

To serve up the application, enter into the `sw-org` directory and run the `serve` command using the Nx CLI:

```sh
nx serve
```

> Note: If you don't want to install Nx globally, you can use `npx nx serve` instead.

The initial application page is displayed.

![](https://images.ctfassets.net/23aumh6u8s0i/2EUaKnrpRkLehJempAp06f/a99c92b3282e79e42b16877c98cac1c9/Uploaded_from_Streamlining_a_React_Monorepo)

## Generating a Feature Library

[Generating libraries](https://nx.dev/latest/react/structure/library-types#feature-libraries) in an Nx workspace is done by using the `generate` command with the Nx CLI. Feature libraries are used to display UI to the user, which could including routing information, and could use other libraries such as shared components.

Create one now by running:

```sh
nx generate lib people
```

**NOTE** [Nx Console](https://nx.dev/latest/angular/getting-started/console) also provides a full l GUI to run Nx CLI commands in your editor with native VSCode and WebStorm support.

## Generating a Data Access Library

A "data access" library is where functionality for fetching and storing data for a feature exists. So any services necessary to manage the quotes are placed in this library. Throughout building applications, there will be data access libraries across multiple features.

Create the data access library by running:

```sh
nx generate lib data-access
```

**NOTE** You can also create your custom generators similar to the `library` generator inside an Nx workspace. This provides more flexibility to create more standards around your development processes and guidelines. Read more about workspace generators in our [Workspace Generators](https://nx.dev/latest/angular/generators/workspace-generators) guide.

Update the data-access library to fetch the characters from the Star Wars API.

Open up `data-access.tsx` and replace it with the following:

```js
import { useEffect, useState } from "react";

export interface IPerson {
 birth_year: string;
 eye_color: string;
 films: string[];
 gender: string;
 hair_color: string;
 height: string;
 homeworld: string;
 mass: string;
 name: string;
 skin_color: string;
 created: Date;
 edited: Date;
 species: string[];
 starships: string[];
 url: string;
 vehicles: string[];
}

export interface Response<T> {
 count: number;
 next: null | string;
 previous: null | string;
 results: T[];
}

export function usePeople(page: number) {
 const [people, setPeople] = useState<IPerson[]>([]);

 useEffect(() => {
   fetch(`https://swapi.dev/api/people/?page=${page}`).then((r) =>
   r.json().then(data => data.results)
 ).then(data => {
     setPeople(data);
   });
 }, []);

 return people;
}
```

Now update the people feature at `people.tsx` to list out the characters:

```js
import { usePeople } from '@sw-org/data-access';
import './people.module.css';

export function People() {
 const people = usePeople(1);
  return (
   <div>
     <h1>Star Wars People</h1>

     <ul>
       {
         people.map(person => (
           <li key={person.name}>
             {person.name}
           </li>
         ))
       }
     </ul>
   </div>
 );
}

export default People;
```

Replace the `App` template with the `People` component

```js
import styles from './app.module.css';

import { People } from '@sw-org/people';

export function App() {
 return (
   <div className={styles.app}>
     <People/>
   </div>
 );
}

export default App;
```

Refreshing the application shows a list of characters.

![](https://images.ctfassets.net/23aumh6u8s0i/3wmVIH8Sqz1ejavorzIzsI/99c44e96e4e44149da2e72e5e328baad/Uploaded_from_Streamlining_a_React_Monorepo)

The list of characters is simple. The business and data logic is kept in libraries. As your applications grow, the number of libraries grows along with it, but the applications remain relatively small and are only used for integrating core functionality for the app to run.

## Dependency Graph

Nx knows the dependencies between projects in your workspace and can generate your dependency graph visually at any point in time. 

Run the **nx dep-graph** command to see the current state of the workspace.

```sh
nx dep-graph
```

This displays the application, E2E project, and the two libraries. 

![](https://images.ctfassets.net/23aumh6u8s0i/4oiIpWdF5wIpz6y5qJkGA4/9a8802092e0de9c1a0e5c9e25d9828d7/Uploaded_from_Streamlining_a_React_Monorepo)

**NOTE**: You can also have the dependency graph auto-refresh with the `--watch` flag.

You can also see what projects are impacted by a given change. Make a change to the App.tsx, such as removing the `className`, save, and run the **nx affected:dep-graph** command.

```sh
nx affected:dep-graph
```

This displays the **myapp** and **myapp-e2e** highlighted in red as affected projects.

![](https://images.ctfassets.net/23aumh6u8s0i/2S5DueXJUNdbbguneKUjGJ/cc397167e5dc78a1835ab2db57b6dacb/Uploaded_from_Streamlining_a_React_Monorepo)


**NOTE:** The **myapp-e2e** application is directly tied to mapp, but is implicitly linked through the **nx.json** file. Read more about Nx configuration here.

### Using Affected Commands

Nx provides affected commands to run certain tasks against affected projects. For example, make a change to the `data-access` library, and run **nx affected:build**. 

```sh
nx affected:build
```

Nx finds the affected applications impacted by changing the **data-access **library and runs the **build** target for each one of them. That way, **only** the affected projects are built for the given change, and not every project in the monorepo. The same commands work for **test**, **lint**, and **e2e**, and others.

There is also the **nx affected** command that works with any defined target. The alias for **nx affected:build** is:

```sh
nx affected --target=build
```

This allows you to run any target based on the affected projects.

### Using Computation Caching

Along with affected commands, Nx supports[ computation caching](https://nx.dev/latest/angular/core-extended/computation-caching) to never execute the same computation twice. This computation cache is pluggable and can be distributed. Taking `**myapp`** as an example, run the build for `myapp` twice.

```sh
nx build myapp
```

When running the same command the second time without changes, you immediately get the cached results from the previous computation. The computation cache is done locally, but can also be distributed and extended to the rest of your team and organization. 

[Nx Cloud](https://nx.app) is one such option to distribute your computation cache. It includes a free tier with 5 hours of saved time per month, enterprise options, and is free for open-source projects.

## Summary

Nx provides modern tooling including code analysis, code generation, code analysis, affected commands, and computation caching to scale your application development using a monorepo.

What did we cover?

- Monorepos and why you should use one
- Nx workspace structure and standardization
- Smarter tooling with code analysis, affected commands, dependency visualization, and computation caching.

Find out more with the following resources:

* Documentation at [https://nx.dev](https://nx.dev)
* Free [Egghead course](https://egghead.io/playlists/scale-react-development-with-nx-4038) on Scaling React Development

Streamlining a React Monorepo

daniel-krzyczkowski-2020

Software Engineer passionate about Microsoft technologies. Awarded with Microsoft Most Valuable Professional title. The main part of his activities is to share knowledge and passion about Microsoft Azure, IoT, Universal Windows Platform and DevSecOps.


Daniel Krzyczkowski

Learn what software supply chain is and how to improve security with GitHub security features.

Secure Software Supply Chain with GitHub Security Features

vincenzo-chianese

Vincenzo Chianese is an Italian Software Developer focused on Web APIs and User Interfaces. He has been working for the last years in API companies such as Apiary, Oracle, LunchBadger, Stoplight. Currently, he is working for Microsoft to help move Microsoft Graph forward and authored some open-source tools in the market (Prism, Express Gateway).

API Architect

Vincenzo Chianese

A bird's view look to the Typing features in Python 3.x

## Introduction

Python is a dynamically typed language. This means that the Python interpreter does type checking only as code runs, and the type of a variable is allowed to change over its lifetime.

However — Python has included a gradual type system for a very long time through the [PEP 484](https://www.python.org/dev/peps/pep-0484/).

Gradual Typing is the ability of a type system to have expressions that are typed (and thus checked) while also having some that are untyped. The final program is still valid and executable by the interpreter.

In this article, we're going to take a look at how the typing annotations have been introduced, what tools we can use today to enforce typings, and then have a rundown to the typing capabilities that Python 3.9 is offering.

## Function Annotations

Python 3 introduced the support of function annotations through the [PEP3107](https://www.python.org/dev/peps/pep-3107/). It was essentially a way to store metadata and attributes to function parameters and return values that somebody _could_ be using. For instance, consider the following function that sums two numbers:

```python
def add(a, b):
    return a + b
```

In Python 3, it is possible to add annotations by using the `:` for the parameters and `->` for the return value:

```python
def add(a: "first number", b: "second number"):
    return a + b
```

The annotations do not modify the function's behavior in any way. Such data is stored in the `__attributes__` mutable dictionary of the function itself and can be retrieved and also modified:

```python
def add(a: "first number", b: "second number"):
     return a + b 

print(add.__annotations__)

$ {'a': 'first number', 'b': 'second number'}
```

Technically speaking, the annotations are a shortcut to set up the `__attributes__` dictionary of a function.

Any expression is a valid annotation. So the following is also valid:

```python
operation = "square root"

def do_math(a: "Should be a positive number" if operation=='square root' else "Should be a number" ):
    if(operation == "square root"):
        return sqrt(a)
    return a**2
```

and the relative `__annotations__` will contain the evaluated expressions:

```python
print(do_math.__annotations__)

# {'a': 'Should be a positive number'}
```

Things get more interesting when we start to annotate function parameters and return values with dictionaries. Consider, for instance, the following annotated function:

```python
def subtract(
    a: {"description": "first number", "exampleValue": 10},
    b: {"description": "second number", "exampleValue": 15}
) -> {"description": "subtraction of the numbers"}:
    return a - b

print(subtract.__annotations__)

$ {'a': {'description': 'first number', 'exampleValue': 10},
   'b': {'description': 'second number', 'exampleValue': 15},
   'return': {'description': 'subtraction of the numbers'}}
```

Any other Python program can read such metadata and use it. In this specific case, a theoretic program could use such annotations to display or even generate documentation. [pydoc](https://docs.python.org/3/library/typing.html), for instance, displays the type annotations in the generated artifacts.

## Type Annotations

Because any expression is a valid annotation, it is possible to level up the game by annotating the function parameters with the type constructors that represent the parameter type and have a linter check them out for us.

Linters are programs that will statically analyze the source code of a project and, based on its configuration, can point out sections that might be problematic. In some cases, they can also suggest corrections. In this specific case, a linter can take such annotations, track all the function usages and check whether the type passed as a parameter corresponds to the one, and alert in case the types do not align. This is exactly what [mypy](https://mypy.readthedocs.io) does.

Consider the following function concatenating a string to a constant, and let's use type constructors as type annotations:

```python
def greeting(name: str) -> str:
    return "Hello " + name

greeting(10)
```

Now let's install mypy and run the checked on the newly created file:

```bash

# Create a new directory for your project
mkdir python-typings

# Make your project directory the current directory
cd python-typings
 
pip3 install mypy

touch greetings.py

# Open the file with your favorite editor and paste the content of the snippet above

$ mypy ./greetings.py

$ greetings.py:4: error: Argument 1 to "greeting" has incompatible type "int"; expected "str"
$ Found 1 error in 1 file (checked 1 source file)
```

mypy has identified a misusage in the function typings and alert us with some appropriate error messages. It does so by looking at the annotations that the function provides and then use them in all the function calls it is able to detect, alerting when mismatches are detected.

Just as we have done previously, let's take a look at the annotations on the function:

```python
print(greeting.__annotations__)

$ {'name': <class 'str'>, 'return': <class 'str'>}
```

This is a very different model than, for example, the one that [TypeScript is using](https://auth0.com/blog/working-with-typeScript-a-practical-introduction/).

While TypeScript code needs to be transpiled (which is the procedure that, among other things, strips all the types out) in order to produce regular untyped JavaScript — Python has not a real type erasure. The annotations are left in place and can even be accessed at runtime.

mypy is available as a command-line tool or, in case you are not a fan of the terminal, as a [VSCode extension](https://code.visualstudio.com/docs/python/linting) or with [Pycharm](https://plugins.jetbrains.com/plugin/11086-mypy). These plugins can boost your experience when writing code significantly since they will report type errors directly in your IDE and in real-time.

Now that we know how to type annotations work, let's do a typing tour to see the capabilities of the typing system.

## Typing Fundamentals

All the primitives offered by Python are supported through a type constructor. So any variable, function parameter, and return value can be naturally typed with `int, str, float, bool, None`.

On top of these, there's a number of special types that are provided for a better experience:

* `Any`: specified an unconstrained type, effectively skipping the type check for anything annotated with so
* `NoReturn`: specifies a function that does *NOT* return in any case. Infinite loops or functions throwing exceptions are some examples
* `Literal`: constrains the parameter or the return value to be only one of the provided possible values, effectively subtyping a type

```python
from typing import Literal

def return_literal() -> Literal[1, 2, 3, 4]:
    t: int = 10 
    # return t # Incompatible return value type (got "int", expected "Union[Literal[1], Literal[2], Literal[3], Literal[4]]")
    return 4 # OK
```

### Aggregated

Aggregates are collections of related information we wish to treat as a unit. Python's typing module supports them too.

#### Dictionaries

Dictionaries can be annotated by creating a subclass of the provided `TypedDict` class:

```python
from typing import TypedDict


class Movie(TypedDict):
    name: str
    year: int


m: Movie = {"name": "The Avengers", "year": 2018}
```

It is also possible to use the `Movie` constructor, yielding the same result:

```python
m = Movie("Batman Begins", 2005)
```

All the variable annotations on a module are being held on the `__annotations__` dictionary in the module itself, so `print(__annotations__)` is legit.

mypy will also make sure to alert in case the code is trying to access a property that has not been declared:

```python
m["ratings"] = 5 # TypedDict "Movie" has no key 'ratings'
```

By default, all the keys specified in the Typed Dictionary must be present. It is possible to relax such constraint through the `total` boolean value:

```python
class Movie(TypedDict, total=False):
    name: str
    year: int


m: Movie = {"year": 2018} # The name is missing, but this is still ok
```

As long as the key is a string and the value is an integer, the type checker will mark it as valid.

In case some of the keys are mandatory while some are not, the `Optional[T]` key can be used:

```python
from typing import Optional


class Movie(TypedDict):
    name: str
    year: Optional[int]


m: Movie = {"name": "Batman Begins", "year": None}
```

The `Optional[T]` can also be used to annotate function parameters that are not required:

```python
from typing import Optional, Union


def greet(name: Optional[str], surname: Union[str, None]):
    n = name or "Clark"
    s = surname or "Kent"
    # return "Hello, " + name + " " + s
    return "Hello, " + n + " " + s
```

You can see that we have also used `Union[str, None]`, which is effectively the same thing as `Optional[str]`.

The `Mapping` type can be used when we have fewer constraints about the keys/values of the dictionary we want to operate with:

```python
from collections.abc import Mapping

m: Mapping[str, int] = {"year": 2018, "randomProperty": 1000}
```

You can see that, as long as the key of the dictionary is a string and the value is an integer, the dictionary is valid, and we do not have to specify the property names ahead of time.

While the `dict` class is the only one effectively implementing `Mapping`, it is advised to use the less specific type as possible so that future code won't be broken in case the standard Mapping gets changed in a different Python version. This also happens for List, as we'll see shortly.

#### Sequences

Python has the `Sequence[T]` base class that can be used to model a number of classes, such as `list`, `str`, `tuple`, and `bytes`. The `Sequence` protocol only supports accessing items (but not modify them), so you will need to type according to your use case:

```python
from collections.abc import Mapping


seq: Sequence[int] = [1,2,3,4]
seq[0] = 10 # Unsupported target for indexed assignment ("Sequence[int]")

lst: list[int] = [1,2,3,4]
lst[0] = 10 # This is OK
```

In case you're a fan of immutability, you've just gained a powerful tool to clearly mark the fact that function will *NOT* touch the passed sequence.

### Type Guard

Type Guard is a feature found in different languages (including TypeScript), where the Type System is capable of narrowing down a type in a block based on a condition.

For instance, if we consider this code:

```python
from typing import Optional


def func(val: Optional[str]) -> str:
    if val is not None:
        return val
    return "default"
```

The type checker, by statically analyzing the code, is able to understand `val` is a string (and only a string) in case the statement on the first line is true and narrows down to just `None` in case the condition is false.

There are cases where type narrowing cannot be applied based on static information only, and in such cases, custom type guards can come to help. For instance, consider this code example:

```python
def is_str_list(val: List[object]) -> bool:
    return all(isinstance(x, str) for x in val)

lst: List[object] = ["hello", "world", 1, 3, 4]


def capitalize_first_element(lst: List[object]) -> str:
    if is_str_list(lst):
        return lst[0].capitalize()
    return str(lst[0]).capitalize()
```

If we run mypy on it, we will receive the following error:

`code.py:8: error: "object" has no attribute "capitalize"`

The Type System is not able to infer that, when `is_str_list` returns `true` — it's safe to assume that the entire list contains only `str` types, where the `capitalize` method exists.

Custom Type Guards allow us to instruct the Type Checker about a type "assumption" based on a boolean value.

```python
from typing import TypeGuard


def is_str_list(val: List[object]) -> TypeGuard[List[str]]:
    return all(isinstance(x, str) for x in val)
```

By using this function instead of the one provided above, the Type Checker will be able to refine from `List[object]` to `List[string]` (when the return value is `true`) where the `capitalize` function is defined for every element.

The accuracy of the type guard function is left to the developer. If the function is returning an incorrect value, the type checker has no way to figure that out, and it will flow on the wrong branch. For instance, let's say we have a bug in our function:

```python
from typing import TypeGuard


def is_str_list(val: List[object]) -> TypeGuard[List[str]]:
    return all(not isinstance(x, str) for x in val)
```

In such a case, the type checker will still assume the List of object has strings inside when the function returns `true` even if it's semantically incorrect, leading to possible bugs.

Unfortunately, custom type guards are not available yet, but they are going to be added in [Python 3.10](https://www.python.org/dev/peps/pep-0647/)

## Conclusion

Typing in Python works — it is a success story. It is gradually integrated into the language with no significant modifications and does not modify the dynamic nature of the language. While the features are long to be completed, the way paved is definitely the good one and, in some circumstances,  might lead to better software.

Types in Python

yigit

I am an Informatics MSc. student at TU Münich and a Software Engineer. My areas of interest include but are not limited to Computer Networks, Software Engineering, Databases, and Network/Web Security.

Most of my practical experience revolved around Java and backend development with the Spring framework. I also like exploring the huge world of JavaScript and especially love using Vue.js and exploring new technologies.

I am a big fan of real agile development, startups, and fast-paced environments. I believe one of the major things that makes tech a very exciting field is: Gaining the ability and knowledge to create products that will make people’s lives easier and more fun.

MSc. student and Software Engineer

Yiğit Kemal Erinç

A bird's view look to Spring Security and its features

Spring Security Overview

A quick tour about five C# features that even experienced developers might not know: from variable scopes to the top-level statements and others.



Even if you are an experienced C# developer, there are features you might not be aware of. In this article, you will explore five little-known C# features that allow you to accomplish things in a slightly different way than you are used to. These features allow you to declare local variables in an unusual way, create conditions with the `switch` command and the `try/catch` block, reduce the number of lines to set up a console program, define properties that can only be initialized, and access private variables of a class instance.

Let's get started.

## Variable Scope and Braces

In C#, you can declare variables within code blocks surrounded by braces to define methods, conditional statements, loops, among others. For example, the braces define a variable scope within a method:

``` csharp  
static void Main(string[] args)
{
  Console.Write("Enter your name: ");
  var name = Console.ReadLine();

  Console.WriteLine($"Hello, {name}!");
}
```

Also, you can define a variable scope with an `if` statement:

``` csharp  
if (name.Trim() != "")
{
  var dayOfWeek = DateTime.Today.ToString("dddd");
  Console.WriteLine($"Happy {dayOfWeek}, {name}!");
}
```

And with a `while` statement as well:

``` csharp  
while (name.Trim() != "")
{
  var dayOfWeek = DateTime.Today.ToString("dddd");
  Console.WriteLine($"Happy {dayOfWeek}, {name}!");

  Console.Write("Enter your name: ");
  name = Console.ReadLine();
}
```

Regardless of the context, the braces delimit the scope of the variable. Did you know that **you can define a variable scope with braces even without a specific statement**? Consider the following code:

``` csharp 
using System;

namespace variable_scope
{
  class Program  {
    static void Main(string[] args)
    {
      Console.WriteLine("Hello World!");
      {
        var theVariable = "I'm the variable";
        Console.WriteLine(theVariable);
      }
    }
  }
}
```

Here, we have a code block delimited by braces inside the `Main()` method. The code block defines and initializes the variable `theVariable` and writes its value to the console. Notice that no `if`, `while`, `for`, or any other statement stands right before the braces.
This program works as expected: it will write both strings as shown below:

``` bash 
Hello World!
I'm the variable
```

What happens if we add the following statement outside the code block, as in the following example?

``` csharp 
using System;

namespace variable_scope
{
  class Program  {
    static void Main(string[] args)
    {
      Console.WriteLine("Hello World!");
      {
        var theVariable = "I'm the variable";
        Console.WriteLine(theVariable);
      }
      //👇 new statement outside the code block
      Console.WriteLine(theVariable);
    }
  }
}
```

If you attempt to run this program, you will get the following error:

``` bash 
error CS0103: The name 'theVariable' does not exist in the current context
```

As you can see, the variable defined inside the code block is not accessible outside it.

In other words, you can create a variable scope by simply using braces anywhere in your code. This feature may be useful when you have a short sequence of statements that need to share a value through a variable. You create a code block on the fly, declare the variable, and use it.
However, I suggest not to abuse it. Sometimes, it's a better idea to create a method and invoke it. It may be more readable than a code block.

## The *when* keyword

Another little-known C# feature is the `when` keyword. You can use it to apply a filter condition in the context of a `switch` statement or a `try/catch` block.
Let’s start by seeing how to use it in the context of a `switch` statement. Consider the following code:

``` csharp  
private static string evaluateScore(int score)
{
  var result = "";

  switch (score)
  {
    case int n when (n < 6):
      result = "Your score doesn't look good...";
      break;

    case int n when (n >= 6 && n <= 7):
      result = "Your score is not bad!";
      break;
    
    case int n when (n > 7 && n <= 9):
      result = "Your score is pretty good!";
      break;
    
    case int n when (n > 9):
      result = "Your score is awesome!";
      break;
  }

  return result;
}
```

Here we have the `evaluateScore()` method that evaluates an integer value (`score`) and returns a message string. As you can see, its logic is totally based on a `switch` statement. Each `case` declares a variable `n` that takes the current value of the `score` parameter. This variable is inspected in the `when` clause to determine the message to be returned. Of course, you can use any boolean expression with the `when` clause.

You can also use the `when` keyword with `catch`, as shown in this example:

``` csharp  
public static async Task<string> MakeRequest()
{
  var client = new System.Net.Http.HttpClient();
  var streamTask = client.GetStringAsync("https://auth0.com/this-page-doesnt-exist");

  try
  {
    var responseText = await streamTask;
    return responseText;
  }
  catch (HttpRequestException e) when (e.StatusCode == HttpStatusCode.MovedPermanently)
  {
    return "The page moved.";
  }
  catch (HttpRequestException e) when (e.StatusCode == HttpStatusCode.NotFound)
  {
    return "The page was not found";
  }
  catch (HttpRequestException e)
  {
    return e.Message;
  }
}
```

Here, you catch an `HttpRequestException` and analyze its status code through a `when` clause.

In both cases, the `when` keyword is extremely useful when you need to match a complex condition since it allows you to keep your code pretty readable.

## Top-Level Statements

Typically, a minimal console application has at least the following code:

``` csharp  
using System;

namespace standard_console
{
  class Program
  {
    static void Main(string[] args)
    {
      Console.WriteLine("Hello World!");
    }
  }
}
```

This program is composed of eleven lines of code, but only one line is actually operative. All the other lines are needed to set up the program infrastructure: a namespace, a class, and a method.

Do you know that you can get rid of this stuff and focus on just one line? In fact, you can replace the code shown above with just the following:

``` csharp 
System.Console.WriteLine("Hello World!");
```

This is possible thanks to the top-level statement feature introduced by C# 9. You can try it [starting with .NET 5](https://auth0.com/blog/dotnet-5-whats-new/).

Of course, you can use multiple top-level statements to create your console application, as in this example.

``` csharp  
using System;

Console.Write("Enter your name: ");
var userName = Console.ReadLine();

Console.WriteLine($"Hello {userName}!");
```

However, remember that you can have only one file using this feature in your .NET project.

Using the top-level statements feature enables a script-oriented approach for C# programming. This may be a more friendly approach for new C# learners or a handy alternative to quickly set up a small console application. For complex applications, you may feel the top-level statements approach is inappropriate because of the lack of a structure.

## The *init* Setter

Assume you have the following `Person` class:

``` csharp  
public class Person
{
  public string FirstName { get; set; }
  public string LastName { get; set; }
  public string Address { get; set; }
}
```

It's a very simple class with just `FirstName`, `LastName`, and `Address` properties. As it *usually* happens in the real world, once you assign a first name and last name to a person, you do not want anyone to change it anymore. So, you would like to assign the values for the `FirstName` and the `LastName` properties to a `Person` instance at the creation time, and those values should not be changed anymore. How can you accomplish this behavior?
If you define the `Person` class by using the usual `get` and `set` accessors, you will not be able to get the expected result. After creating an instance of the `Person` class, you can change the value of its `FirstName` and `LastName` properties whenever you want, as in the following example:

``` csharp  
var person = new Person
{
  FirstName = "John",
  LastName = "Doe",
  Address = "124 Conch Street, Bikini Bottom, Pacific Ocean"
};

person.Address = "17 Cherry Tree Lane";
person.FirstName = "Jack";

Console.WriteLine($"Hello {person.FirstName} {person.LastName}!");
```

Fortunately, C# 9 provides you with the `init` accessor. If you apply the `init` accessor to the `FirstName` and `LastName` properties in place of `set`, you will achieve your goal:

``` csharp  
public class Person
{
  public string FirstName { get; init; }  //👈 changed code
  public string LastName { get; init; }   //👈 changed code
  public string Address { get; set; }
}
```

This way, after the instance is created, the `FirstName` and `LastName` properties become read-only.
Remember that this feature is supported only starting with C# 9.

## Accessing Private Variables

Of course, you know that a private variable is not accessible from outside a class. In the following example, you have a `Life` class that defines the `birthTime` private variable:

``` csharp  
public class Life
{
  private DateTime birthTime;

  public Life()
  {
    birthTime = DateTime.Now;
  }

  public int GetLength()
  {
    return DateTime.Now.Subtract(birthTime).Milliseconds;
  }
}
```

The `birthTime` private variable is assigned in the class constructor and is used within the `GetLength()` method. Normally, the `birthTime` variable is not accessible from outside the `Life` class. However, there is a special case where you can access the `birthTime` private variable. Take a look at this new `YoungerThan()` method:

``` csharp  
public class Life
{
  // ...other code...

  public bool YoungerThan(Life livingBeing)
  {
    return livingBeing.birthTime < birthTime;
  }
}
```

Within this new method, you are actually accessing the `birthTime` private variable of a `Life` instance!

You may be scared by the consequences of accessing a private variable. Don’t panic! Only instances of a class can access private variables of other instances of the same class. In other words, the context of this access possibility is limited to one specific class.

This feature is useful when you need to implement some sort of internal comparison methods like the one shown above. However, you should use this approach **only when you don't want to expose a private value**. Otherwise, you should expose the private variable through a public property or method and use it for any processing. This way, you keep the idiomatic Object-Oriented Programming approach.

## Summary

In this article, you discovered five C# features that maybe you didn't know. The C# language and [the .NET platform](https://auth0.com/blog/what-is-dotnet-platform-overview/) are growing and evolving very quickly to adapt to developers' needs and simplify their work. So there's nothing bad with missing some feature.

If you know other little-known C# features, please share them with us in the comments below.

<include src="asides/DotNetCore" />


Five C# Features You Might Not Know

Learn how to use Spring and Java to build a feature-complete API. Learn how to use Spring Boot to create, read, update, delete, and validate data.

Spring Boot Tutorial: Build a CRUD API (Java)

Learn how to use TypeScript to build a feature-complete Express API. Tutorial on how to use TypeScript with Express to create, read, update, and delete data.

Node.js and TypeScript Tutorial: Build a CRUD API

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

Learn how to use the Delegated Administration Dashboard extension to build a powerful user management workflow.

Better User Management with the Delegated Administration Dashboard

Advanced contextual-based feature only triggered by risky logins, mitigating hacking attacks, and reducing threat of data breaches while preserving user experience.



**BELLEVUE, Wash. – Dec. 15, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Adaptive Multi-factor Authentication (MFA)](https://auth0.com/blog/auth0-introduces-adaptive-mfa), a sophisticated security feature that helps reduce the threat of hacks and data breaches. Adaptive MFA is an important addition to Auth0's expanding security portfolio&mdash;which also includes Bot Detection, Breached Password Detection, Brute Force Protection, and Suspicious IP Throttling&mdash;and is one of the platform's most advanced context-based security features.

Adaptive MFA is designed to help companies address the inherent challenges of enabling security while preserving user experience. Unlike traditional MFA, which is triggered upon every login attempt and creates an additional step for the end user, Adaptive MFA only appears when a login is deemed risky. This is calculated by an overall risk score that measures abnormal behavior from known devices, impossible travel, and/or IP reputation. Customers can have the confidence that with Adaptive MFA, their end users are asked for secondary authentication only when behavioral signals don't conform to usual patterns for a particular user. 

For example, for a user who normally signs into their account at the same time every morning in San Francisco from a personal laptop, Adaptive MFA would only present a second-factor authenticator if login was attempted outside of the region, usual timeframe, or from a different computer or IP address. Developers can determine how much weight each signal is given to define the risk score that sets off the trigger. 

Many companies are reluctant to implement MFA&mdash;proven to be an effective defense against account hacking attacks&mdash;out of fear of negatively impacting user experience and thus their conversion and retention performance. However, additional friction during the signup, login, or checkout experiences can affect user conversion/retention, resulting in lost sales, and can potentially increase support incidents. Forrester predicts that the MFA market will grow to $2 billion by 2023[1], and this anticipated growth signals the need for a more intelligent and contextually-based MFA solution.   

"Auth0's mission is to provide secure access for everyone. Securing identities is core to that mission, and this new capability adds to the already powerful features in our security profile, designed to counter a variety of sophisticated threats, such as automated attacks, account takeovers, and phishing attacks," said Shiven Ramji, Chief Product Officer at Auth0. "Adaptive MFA should be a key consideration for any enterprise that has previously had to make a tradeoff between security and user experience. The ability to reduce friction while increasing security is a competitive differentiator for our customers."

More detailed information on Adaptive MFA can be found here: [When is MFA the Right Choice?](https://auth0.com/resources/whitepapers/is-mfa-the-right-choice) (whitepaper) and on Auth0's [Multi-factor Authentication](https://auth0.com/multifactor-authentication) page.

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications <br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com) <br />

Matter for Auth0 <br />
[auth0@matternow.com](mailto:auth0@matternow.com) <br />

(1): Forrester Analytics: IAM Software Forecast, 2018 to 2023 (Global)


Auth0 Launches Adaptive MFA to Increase Security and Reduce Friction for End Users

5e074956ee8ba1fea26e30d28c190495?s=300 avatar

5e074956ee8ba1fea26e30d28c190495?s=300

Full stack developer creating content at Auth0. I love taking a deep dive into hard-to-understand concepts and creating content that makes them easier to grasp. In my free time you can usually find me reading, hanging out with my dogs, or curling in the squat rack.

Former Developer Content Manager

Holly Guevara

Learn about the new features and changes in the latest Laravel 8 release.




It feels like just yesterday we were reading about what's coming in Laravel 6. And here we are today, learning about what's new in Laravel 8! 🤯

Whether you're getting started with Laravel or just want to check out the [latest and greatest](https://laravel.com/docs/8.x/releases), keep on reading.

## Laravel Jetstream

[Laravel Jetstream](https://jetstream.laravel.com/1.x/introduction.html), the new Laravel application scaffolding, was released with the new version of Laravel.

Jetstream provides a fantastic starting point for your Laravel applications with the following built-in options:

- Login and registration
- Email verification
- Two-factor authentication (2FA)
- Session management
- [Laravel Sanctum](https://laravel.com/docs/8.x/sanctum) API support
- Designed with Tailwind CSS
- Choice of two frontend stacks: [**Livewire + Blade**](https://laravel-livewire.com/) or [**Inertia.js + Vue.js**](https://inertiajs.com/)

![Laravel Jetstream Livewire installation](https://images.ctfassets.net/23aumh6u8s0i/5bC4p3YLjRj30EO0VlIRSs/aa91442260d3618589c60fcd808383f6/laravel-jetstream-livewire)

### How to use Laravel Jetstream

You can create a new application with Jetstream using the [Laravel installer](https://laravel.com/docs/8.x/installation#installing-laravel). Make sure the Laravel installer is updated to `v4.0`, and then run the following:

``` bash  
laravel new your-project --jet
```

Choose which stack you want to use: Livewire or Inertia. Next, run your database migrations with:

``` bash  
php artisan migrate
```

Finally, see your application at [`http://localhost:8000`](http://localhost:8000) by running:

``` bash  
php artisan serve
```

And now, you're ready to [explore your new Laravel Jetstream application](https://jetstream.laravel.com/1.x/installation.html)!

If you'd prefer to use Composer, you can find the [Composer installation instructions](https://jetstream.laravel.com/1.x/installation.html#composer-installation) in the Laravel Jetstream documentation.

## Models Updates

### Welcome back, `Models` directory!

The `app/Models` directory is back! Years ago, when Laravel 5 launched, a lot of developers noticed the `Models` directory was missing. Instead, new models were created directly in the `app` directory. Surprisingly, this caused quite the uproar in the community. You could still manually create the folder, and a lot of developers did, but it was considered an extra nuisance by some.

With Laravel 8, the beloved `app/Models` directory has been restored! If you prefer the old structure, you can always modify your codebase to remove the `Models` directory again.

### Model factory classes

[Taylor Otwell](https://github.com/taylorotwell) spent some time rewriting the Eloquent model factories as classes.

Let's compare the changes by looking at the default `User` factories from both Laravel 7 and 8. 

**User factory in Laravel 7.x:**

``` php  
// database/factories/UserFactory.php

use Faker\Generator as Faker;
use Illuminate\Support\Str;

$factory->define(App\User::class, function (Faker $faker) {
    return [
        'name' => $faker->name,
        'email' => $faker->unique()->safeEmail,
        'email_verified_at' => now(),
        'password' => '$2y$10$92IXUNpkjO0rOQ5byMi.Ye4oKoEa3Ro9llC/.og/at2.uheWG/igi', // password
        'remember_token' => Str::random(10),
    ];
});
```

**User factory in Laravel 8:**

``` php  
// database/factories/UserFactory.php

namespace Database\Factories;

use App\Models\User;
use Illuminate\Database\Eloquent\Factories\Factory;
use Illuminate\Support\Str;

class UserFactory extends Factory
{
    /**
     * The name of the factory's corresponding model.
     *
     * @var string
     */
    protected $model = User::class;

    /**
     * Define the model's default state.
     *
     * @return array
     */
    public function definition()
    {
        return [
            'name' => $this->faker->name,
            'email' => $this->faker->unique()->safeEmail,
            'email_verified_at' => now(),
            'password' => '$2y$10$92IXUNpkjO0rOQ5byMi.Ye4oKoEa3Ro9llC/.og/at2.uheWG/igi', // password
            'remember_token' => Str::random(10),
        ];
    }
}
```

In Laravel 8, factories are now classes that extend the base Laravel factory class. Glancing at the default file, you'll see the `model` property and `definition` method. The `definition` method then returns the model attributes.

Compare this to Laravel 7 and below, where the `UserFactory` is defined with a [Closure](https://www.php.net/manual/en/class.closure.php) and returns the specified model attributes.

Both of these still have access to Faker, as expected. Let's look at the difference between *using* factories in Laravel 7 versus Laravel 8.

**Using factories in Laravel 7:**

Before this update, you would use the `factory` helper function in your seeder files to generate model instances.

``` php  
// database/seeds/UserSeeder.php

class UserSeeder extends Seeder
{
  /**
  * Run the database seeds.
  *
  * @return void
  */
  public function run()
  {
    // Create three App\User instances
    $users = factory(App\User::class, 3)->create();
  }
}
```

**Using factories in Laravel 8:**

With Laravel 8, you can use the `factory` directly on the model instance. This is because the default models now include a `HasFactory` trait, as shown in the simplified code below. 

``` php  
// database/seeders/UserSeeder.php

class UserSeeder extends Seeder
{
  /**
    * Run the database seeds.
    *
    * @return void
    */
  public function run()
  {
    // Create three App\User instances
    User::factory(3)->create();
  }
}
```

``` php  
// app/Models/User.php
<?php
namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;
// ...

class User extends Authenticatable
{
    use HasFactory;
    // ...
}

```

> ❗ If you have existing factories on a Laravel 7.x project or older and you're planning on upgrading, you can use the [`laravel/legacy-factories`](https://github.com/laravel/legacy-factories) package that was created to simplify the upgrade process.

## Migration Squashing

😱 Laravel 8 introduces another exciting feature: migration squashing! No longer do you have to scroll for five minutes when you open up your `migrations` folder! With migration squashing, you can now condense your migration files into a single SQL file with the following commands:

``` bash  
php artisan schema:dump
php artisan schema:dump --prune
```

Laravel will write the new `schema` file to `database/schema`. Then when you run your migrations, Laravel will run the SQL from the schema file first before moving on to anything created later in the `migrations` folder.

> Note: Migration squashing is currently only supported for MySQL and Postgres.

## Job Batching

In Laravel, jobs are tasks that can be performed as part of a queue to accomplish something in the background. The new [job batching feature](https://laravel.com/docs/8.x/queues#job-batching) allows you to execute several [jobs](https://laravel.com/docs/8.x/queues#creating-jobs) together.

To use the new batching feature, first define your job as you normally would. The example below has been simplified to show the new `Batchable` trait.

``` php  
<?php
namespace App\Jobs;

use Illuminate\Bus\Batchable;
// ...

class SendEmail implements ShouldQueue
{
  use Batchable;

  /**
    * Execute the job.
    *
    * @return void
    */
  public function handle()
  {
    if ($this->batch()->cancelled()) {
      // Detected cancelled batch...

      return;
    }
    // Batched job executing...
  }
}
```

Once you have your job defined, you can dispatch a batch of jobs in your controller using the `batch` method of the `Bus` facade.

``` php  
  use App\Jobs\SendEmail;
  use App\User;
  use Illuminate\Bus\Batch;
  use Illuminate\Support\Facades\Batch;
  use Throwable;

  $batch = Bus::batch([
    new SendEmail(User::find(1)),
    new SendEmail(User::find(2)),
    new SendEmail(User::find(3)),
  ])->then(function (Batch $batch) {
    // All jobs completed successfully...
  })->catch(function (Batch $batch, Throwable $e) {
    // First batch job failure detected...
  })->finally(function (Batch $batch) {
    // The batch has finished executing...
  })->dispatch();

  return $batch->id;
```

You'll also notice the addition of the `then`, `catch`, and `finally` methods. You can use these to define completion callbacks for your batch of jobs.

## Better Rate Limiting


**Rate limiting in Laravel 7**

``` php  
Route::middleware('auth:api', 'throttle:10,1')->group(function () {
  Route::get('/login', function () {
    //
  });
});
```

**Rate limiting in Laravel 8**

In Laravel 8, you can define your rate limiters in `app/Providers/RouteServiceProvider.php` using the `for` method of the `RateLimiter` facade. The `for` method will accept a name and a Closure, which returns the rate limiting details that you set up. 

``` php  
use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Support\Facades\RateLimiter;

RateLimiter::for('login', function (Request $request) {
  return Limit::perMinute(10);
});
```

You can now apply this pre-configured rate limiter to routes with `throttle:` followed by the rate limiter name.

``` php  
Route::middleware(['throttle:login'])->group(function () {
  Route::post('/login', function () {
    //
  });
  Route::post('/register', function () {
    //
  });
});
```

> Note: The `throttle` middleware API from previous Laravel versions will still remain functional.

For more about rate limiting options, see the [Laravel routing docs](https://laravel.com/docs/8.x/routing#rate-limiting). 

## Maintenance Mode

Laravel 8 also brings some improvements to maintenance mode. Maintenance mode is a really helpful feature that allows you to "disable" your application while you're making updates to it.

In previous versions, you would have to specify the IPs that would still be allowed to access the application with the `allow` option:

``` bash  
php artisan down --allow=127.0.0.1 --allow=192.168.0.0/16
```

With Laravel 8, you no longer need to allow certain IPs explicitly. Instead, you can use the `secret` option to create a maintenance mode bypass token:

``` bash  
php artisan down --secret="1630542a-246b-4b66-afa1-dd72a4c43515"
```

You can then access your application while in maintenance mode by appending the token to your application's URL, e.g., `https://example.com/1630542a-246b-4b66-afa1-dd72a4c43515`. The bypass cookie will be saved to your browser, and you can continue navigating your application from its normal URL, e.g., `https://example.com`.

## Routing Namespacing

In Laravel 8, the `namespace` property in `app/Providers/RouteServiceProvider.php` is now `null` by default, as you can see below.

``` php  
// app/Providers/RouteServiceProvider.php
<?php

namespace App\Providers;

// ...
class RouteServiceProvider extends ServiceProvider
{
    // ...
    /**
     * If specified, this namespace is automatically applied to your controller routes.
     *
     * In addition, it is set as the URL generator's root namespace.
     *
     * @var string
     */
    protected $namespace = null; // <--- LARAVEL 8 CHANGE
    // ...
}
```

In previous versions, the `$namespace` property was set to `App\Http\Controllers`.

This change means that controller route definitions will no longer include automatic namespace prefixing. The example below demonstrates how routing namespacing differs between Laravel 7 and Laravel 8.

**Laravel 7:**

``` php  
// routes/web.php

Route::get('/posts', 'PostController@index'); 
```

**Laravel 8:**

``` php  
// routes/web.php
use App\Http\Controllers\PostController;

Route::get('/posts', [PostController::class, 'index']);
```

If you prefer the old way, you can change the `$namespace` value back to `App\Http\Controllers` in `app/Providers/RouteServiceProvider.php`.

For more about routing namespacing updates, see the [Laravel routing documentation](https://laravel.com/docs/8.x/routing#basic-routing).

## Wrap Up

As always, Taylor Otwell and the rest of the Laravel team have been hard at work to deliver us some awesome and welcome updates to Laravel! Now that you have some background about what's new and what changed with Laravel 8, feel free to go off and [explore on your own](https://laravel.com/docs/8.x)! Leave a comment below letting me know your favorite change in Laravel 8 and what you're planning on building. Cheers!

<include src="asides/AboutAuth0" />


"feature"