Michelle Agroskin

Michelle Agroskin is a Staff Product Marketing Manager for Okta. She leads the Customer Identity AI, Authorization, and Consumer portfolios; driving go-to-market strategy, messaging, launches, and strategic growth initiatives.

She lives in NYC and in her free time, loves to travel the world and try new restaurants!

Staff Product Marketing Manager, Auth0

Auth0’s latest features enhance user experience with secure, customizable logins, flexible authentication, and improved security—without compromising convenience.

Customer expectations are higher than ever. They want security, convenience, and personalization, all without friction. Businesses need to deliver seamless experiences while keeping user data safe. The challenge? Balancing security with ease of access.

At Auth0, we believe you shouldn’t have to choose between security and experience. That’s why we’re introducing innovations that strengthen security and improve user experience—before, at, and after login.

## Powerful New Features for Secure, Seamless Login

Today’s businesses need to build trust with their users. Customers *expect* engaging experiences, convenient journeys, and secure digital platforms. Before they give you their business, they need to know that you can cater to their unique needs, provide ease of use across multiple channels, and protect their data and sensitive information. When security and user experience are seamlessly integrated, customers engage more, businesses grow, and digital experiences become effortless. And that starts with getting identity right. 

> We’ve updated the authentication journey to help businesses deliver trusted, customized experiences while keeping users safe.

#### **Before login**: greater flexibility with Tenant Access Control

**Security starts before users even log in. **Tenant Access Contro**l (Generally Available, March 2025) helps protect applications and APIs from threats like denial-of-service attacks. Stopping lousy traffic before it reaches your applications prevents disruptions and keeps them running. This feature allows organizations to create granular policies to manage access and mitigate threats, giving them more control over protecting their applications and users.

#### **At login**: Advanced Customization for Universal Login

**The login box is often the first interaction users have with your brand and the one they repeatedly return to as they continue engaging with it. Now, with **Advanced Customization for Universal Login** (Early Access, February 2025), businesses can control every piece of their login experience while leveraging Auth0’s security and built-in authentication process. Create pixel-perfect experiences and tailor every detail to match your brand with the same built-in security Auth0 is known for. 

#### **After login**: strengthen security

**Security doesn’t stop after users are logged in. We’re introducing key enhancements to secure the entire customer journey:

 * **FAPI 2 Certification **(Achieved, March 2025) strengthens API security with financial-grade protections that prevent transaction tampering and data leaks within our Highly Regulated Identity product.
 * **Client-initiated backchannel Authentication** (Limited Early Access, Generally Available Q2 2025) enables a client application (e.g., call center system, POS terminal, autonomous AI agent) to initiate the authentication process on behalf of the customer, making authentication easier.
 * **Native to Web SSO** (Early Access, April 2025) keeps users signed in as they move between mobile and web apps, eliminating unnecessary logins (and frustrated customers!).

## Identity Is the Key to Better Experiences 

In the past, businesses struggled with trade-offs, prioritizing security at the expense of user experience or vice versa. Modern identity removes that compromise, ensuring that security enhances, rather than hinders, customer experience.

Businesses that get identity right can deliver effortless logins, personalized interactions, and enterprise-grade security without slowing growth. These latest innovations make it easier than ever to:

* Protect against fraud and unauthorized access
* Build seamless, branded login experiences
* Maintain compliance with industry standards
* Enable flexible, secure authentication
* Keep users signed in across platforms

## Get Started Today

Auth0 makes identity **simple**, **scalable**, and more **secure.** These latest innovations help businesses stay ahead by offering users the frictionless, secure experiences they expect.

> Stop building identity from scratch. Start building with Auth0.

Learn more about these updates in our [documentation](https://auth0.com/docs/get-started) or [contact our team](https://auth0.com/contact-us) today.

_Any products, features, functionalities, certifications, authorizations, or attestations referenced in this material that are not currently generally available or, have not yet been obtained, or are not currently maintained may not be delivered or obtained on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, functionality, certification, or attestation, and you should not rely on them to make your purchase decisions._

Better User Experiences, Stronger Security

deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

arpit-jain

Arpit is a skilled engineering manager and software developer who specializes in Java, JS, and cloud-native technologies. He actively contributes to the developer community and focuses on enhancing the developer experience. Arpit also mentors aspiring developers.

Senior Engineering Manager

Arpit Jain

The Auth0 Terraform provider has many new features and updates. Learn all about what's new.

The [Auth0 Terraform Provider](https://registry.terraform.io/providers/auth0/auth0/latest/docs) allows you to automate the configuration of Auth0 resources like applications, connections, actions, and more. You can also use it to manage users and groups. With the Auth0 Terraform provider, you can automate almost everything you can do via the management UI.

**Check out our blog post to get started with Auth0 and Terraform.**

<include 
    src="LinkCard" 
    title="Get Started with the Auth0 Terraform Provider" 
    link="https://auth0.com/blog/get-started-with-auth0-terraform-provider/" 
    description="Learn how to get started with the Auth0 Terraform Provider to automate your identity infrastructure." 
    img="https://images.ctfassets.net/23aumh6u8s0i/315vJcTNAjaIgQZWxlovOf/a1839ed3bff28c3da8969642252c86a6/terraform-auth0-logo"
/>

## What's New in the Auth0 Terraform Provider

The latest versions (1.4 to 1.7) of the Auth0 Terraform provider have many new features and updates. Here are the top **six** features to look out for.

### Auth0 Forms

[Auth0 Forms](https://auth0.com/features/forms) is a robust visual editor that enables you to create custom, dynamic forms seamlessly integrating with your authentication workflows.

> [Available from v1.7.3](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/form)

<AmpContent>
  <amp-youtube
      data-videoid="jkzwN2xwO5w"
      layout="responsive"
      width="480" height="270">
  </amp-youtube>
</AmpContent>
<NonAmpContent>
  <div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/jkzwN2xwO5w' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Forms offer a secure and controlled experience within your tenant's domain, eliminating the need for external site redirects. You can manage Auth0 Forms and [Flows](https://auth0.com/docs/customize/forms/flows) via Terraform, enabling you to automate the creation and management of forms and flows.

```hcl
# Create an Auth0 Form
resource "auth0_form" "sample_form" {
  name = "KYC Form"

  start = jsonencode({
    coordinates = { x = 0, y = 0 }
    next_node = "username_step"
  })

  nodes = jsonencode([{
    id   = "username_step"
    type = "STEP"
    config = {
      components = [{
        category = "FIELD"
        config = {
          max_length = 50
          min_length = 1
          multiline  = false
        }
        id        = "full_name"
        label     = "Your Name"
        required  = true
        sensitive = false
        type      = "TEXT"
        },
        {
          category = "BLOCK"
          config = { text = "Continue" }
          id   = "next_button_3FbA"
          type = "NEXT_BUTTON"
      }]
      next_node = "$ending"
    }
    coordinates = { x = 500, y = 0 }
  }])

  ending = jsonencode({
    after_submit = {
      flow_id = auth0_flow.sample_flow.id
    }
    coordinates = { x = 1250, y = 0 }
    resume_flow = true
  })

  style = jsonencode({ css = "h1 { color: white; text-align: center; }" })
}

# Create an Auth0 Flow to use the Form
resource "auth0_flow" "sample_flow" {
  actions = jsonencode([{
    action = "UPDATE_USER"
    allow_failure = false
    id            = "update_user_metadata"
    mask_output   = false
    params = {
      changes = {
        user_metadata = { full_name = "{{fields.full_name}}" }
      }
      connection_id = auth0_flow_vault_connection.sample_connection.id
      user_id       = "{{context.user.user_id}}"
    }
    type = "AUTH0"
  }])
  name = "Flow KYC update data"
}

# Create a Flow Vault Connection to use in a Flow
resource "auth0_flow_vault_connection" "sample_connection" {
  app_id = "AUTH0"
  name   = "Auth0 M2M Connection"
  setup = {
    client_id     = var.auth0_client_id # The M2M app must be authorized to use the Auth0 Management API
    client_secret = var.auth0_client_secret
    domain        = var.auth0_domain # without https:// in the domain
    type          = "OAUTH_APP"
  }
}
```

### Machine-to-Machine Access for Organizations

[Machine-to-Machine (M2M) Access for Organizations](https://auth0.com/docs/manage-users/organizations/organizations-for-m2m-applications) enables you to define the organizations that a given application can access for each API using the Client Credentials Flow. This enables customers to sell and operate their services in M2M environments properly, cover scenarios with consumption devices with limited user experience capabilities, and simplify configuration and usage.

This is being implemented so that M2M Apps can be associated with a given organization, as currently done for Connections. This will enable that application to request an access token for that specific Organization.

> Note: This feature is available from B2B Professional, Enterprise, and Enterprise premium plans.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/organization_client_grant)

```hcl
# Create an Auth0 Organization
resource "auth0_organization" "my_organization" {
  name         = "auth0-inc"
  display_name = "Auth0 Inc."

  branding {
    logo_url = "https://example.com/assets/icons/icon.png"
    colors = {
      primary         = "#f2f2f2"
      page_background = "#e1e1e1"
    }
  }
}

# Create a new Auth0 M2M application
resource "auth0_client" "sample_client" {
  name                = "MyCoolApp"
  description         = "My Cool App Client Created Through Terraform"
  app_type            = "non_interactive"
}

# Create a Client Grant for the Client
resource "auth0_client_grant" "my_client_grant" {
  client_id = auth0_client.sample_client.id
  audience  = "https://passkeys-demo.eu.auth0.com/api/v2/"
  scopes    = ["create:foo", "create:bar"]
}

# Create a Client Grant for the Organization
resource "auth0_organization_client_grant" "sample_organization_client_grant" {
  organization_id = auth0_organization.my_organization.id
  grant_id       = auth0_client_grant.my_client_grant.id
}
```

## Bring Your Own Key (BYOK)

[Bring Your Own Key](https://auth0.com/docs/secure/highly-regulated-identity/customer-managed-keys/customer-managed-keys-management-api) allows you to securely replace your tenant’s top-level encryption key with a key of your own, hence gaining control of your key material in Auth0’s hardware security module (HSM). It allows compliance with specific secret custody and key provenance requirements. Once you have uploaded your key, data encryption and decryption operations use that key to encrypt your tenant's secrets and data.

> Note: This feature is available as Early Access on Enterprise plans with the Highly Regulated Identity add-on.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/encryption_key_manager)

```hcl
# Modifying the key_rotation_id causes the keys to be rotated/rekeyed.
resource "auth0_encryption_key_manager" "sample_key_manager_initial" {
  key_rotation_id = "da9f2f3b-1c7e-4245-8982-9a25da8407c4"
}

resource "auth0_encryption_key_manager" "sample_key_manager_rekey" {
  key_rotation_id = "68feba2c-7768-40f3-9d71-4b91e0233abf"
}

# To initialize the process of providing the root key by the customer, create a
# `customer_provided_root_key` block.
resource "auth0_encryption_key_manager" "sample_key_manager" {
  customer_provided_root_key {
  }
}

# The public_wrapping_key and wrapping_algorithm should be available to
# be used to wrap the new key by the customer
output "key_manager" {
  depends_on = [auth0_encryption_key_manager.sample_key_manager]
  value = {
    public_wrapping_key = auth0_encryption_key_manager.sample_key_manager.customer_provided_root_key.*.public_wrapping_key
    wrapping_algorithm  = auth0_encryption_key_manager.sample_key_manager.customer_provided_root_key.*.wrapping_algorithm
  }
}

# The root key should be wrapped using the specified algorithm by the customer and Base64 encoded.
resource "auth0_encryption_key_manager" "sample_key_manager" {
  customer_provided_root_key {
    wrapped_key = "your_base64_encoded_wrapped_root_key"
  }
}
```

## Customize Signup and Login Prompts

[Customize Signup and Login Prompts](https://auth0.com/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts) is a feature that allows customers with a Custom Domain and Custom Page Template enabled to add custom fields and content to their app’s signup and login prompts.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/prompt_screen_partial)

Customize Signup and Login Prompts supports two use cases.

- **Custom content**: Custom content is static content like text, links, or images placed directly on the signup and login prompts.
- **Data capture**: Data capture uses form elements dynamically added to the signup and login prompts, which is useful for collecting and validating user consent or user-produced data like a surname.

```hcl
# For managing a single prompt screen
resource "auth0_prompt_screen_partial" "login" {
  prompt_type = "login"
  screen_name = "login"
  insertion_points {
    form_content_start = "<div>Form Content Start</div>"
    form_content_end   = "<div>Form Content End</div>"
  }
}

# For managing multiple prompt screens
resource "auth0_prompt_screen_partials" "prompt_screen_partials" {
  prompt_type = "login-passwordless"

  screen_partials {
    screen_name = "login-passwordless-email-code"
    insertion_points {
      form_content_start = "<div>Form Content Start</div>"
      form_content_end   = "<div>Form Content End</div>"
    }
  }

  screen_partials {
    screen_name = "login-passwordless-sms-otp"
    insertion_points {
      form_content_start = "<div>Form Content Start</div>"
      form_content_end   = "<div>Form Content End</div>"
    }
  }
}
```

## Self-Service Single Sign-On

[Self-Service Single-Sign On (SSO)](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO) provides business-to-business (B2B) customers with the tools needed to delegate SSO setup to their enterprise customers. This enables your B2B customers to configure and manage their own ways of logging in to your SaaS application.

Self-Service SSO provides a packaged experience that Auth0 customers can offer to their business customers so that they can set up their own SSO access. Customers can take advantage of this time-saving feature to reduce support costs and time-to-value for their business customers.

> Note: This feature is available as limited Early Access on Enterprise plans.

> [Available from v1.5.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/self_service_profile)

```hcl
resource "auth0_self_service_profile" "my_self_service_profile" {
  user_attributes {
    name        = "sample-name"
    description = "sample-description"
    is_optional = true
  }
  branding {
    logo_url = "https://mycompany.org/v2/logo.png"
    colors {
      primary = "#0059d6"
    }
  }
}
```

## SCIM Configuration

[System for Cross-domain Identity Management (SCIM)](http://www.simplecloud.info/), is a [protocol](https://tools.ietf.org/html/rfc7644) and [schema](https://tools.ietf.org/html/rfc7643) used by enterprise organizations for provisioning, de-provisioning, and managing user identity-related information across systems in a standardized way. SaaS developers selling their SaaS apps and services to large enterprises may be asked, or even required, by those customers to implement a SCIM-based API to integrate with the user provisioning tooling they use.

With support for [inbound SCIM](https://auth0.com/docs/authenticate/protocols/scim/configure-inbound-scim), SaaS application builders will be able to:

- Use the Auth0 Dashboard or APIs to quickly and easily enable support inbound SCIM user provisioning and de-provisioning workflows to their Auth0 user identity stores
- Get out-of-box support for top Workforce IDPs that implement outbound SCIM (including Okta Workforce Identity Cloud and Azure AD) without needing to build or self-host any custom endpoints

> Note: This feature is available on Enterprise plans.

> [Available from v1.4.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/connection_scim_configuration)

```hcl
resource "auth0_connection" "my_enterprise_connection" {
  name         = "my-enterprise-connection"
  display_name = "My Enterprise Connection"
  strategy     = "okta"

  options {
    client_id              = "1234567"
    client_secret          = "1234567"
    issuer                 = "https://example.okta.com"
    jwks_uri               = "https://example.okta.com/oauth2/v1/keys"
    token_endpoint         = "https://example.okta.com/oauth2/v1/token"
    authorization_endpoint = "https://example.okta.com/oauth2/v1/authorize"
  }
}

# A resource for configuring an Auth0 Connection SCIM Configuration, specifying `user_id_attribute` and `mapping`.
# Only one can be specified for a connection.
resource "auth0_connection_scim_configuration" "my_conn_scim_configuration" {
  connection_id     = auth0_connection.my_enterprise_connection.id
  user_id_attribute = "attribute1"
  mapping {
    auth0 = "auth0_attribute1"
    scim  = "sacim_attribute1"
  }
  mapping {
    auth0 = "auth0_attribute2"
    scim  = "sacim_attribute2"
  }
}
```

## Learn More

I hope that you found this article helpful. Here are some additional resources to learn more about Auth0 and DevOps.

- [Get Started with the Auth0 Terraform Provider](https://auth0.com/blog/get-started-with-auth0-terraform-provider/)
- Be a DevOps Hero\! Automate Your Identity Infrastructure with Auth0 CLI and Ansible
- [Deploy Secure Spring Boot Microservices on Amazon EKS Using Terraform and Kubernetes](https://auth0.com/blog/terraform-eks-java-microservices/)
- [Shhhh... Kubernetes Secrets Are Not Really Secret\!](https://auth0.com/blog/kubernetes-secrets-management/)
- [Auth0 CLI Basics \- Lab](https://developer.auth0.com/resources/labs/tools/auth0-cli-basics#introduction)

You can also sign up for our [newsletter](https://a0.to/nl-signup/java) to stay updated on everything about identity and security.

If you liked this tutorial, chances are you'll enjoy the others we publish. Please follow [@auth0 on Twitter](https://twitter.com/auth0) and [subscribe to our YouTube channel](https://youtube.com/oktadev) to get notified when we publish new developer tutorials.


What's New in the Auth0 Terraform Provider?

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

With .NET 9.0, some interesting authentication and authorization features have been added to the platform. Let’s take an overview of them.

.NET 9 introduces interesting new features, primarily focused on cloud-native development and performance. However, the [list of improvements](https://learn.microsoft.com/en-us/dotnet/core/whats-new/dotnet-9/overview) in other areas of the platform is long. This article will focus on the main innovations introduced by .NET 9.0 in authentication and authorization.

## Support for Pushed Authorization Requests (PAR)

One of the most interesting features brought by .NET 9.0 is support for [Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) (PAR), an OAuth 2.0 and OpenID Connect extension that strengthens the security profile of these protocols. PAR allows applications to not expose the parameters of an authorization request through the browser. Instead, it enables direct communication of these parameters between the application and the authorization server. This is very important when you implement applications in a high-security context, such as in the financial, healthcare, or other regulated sectors. If you want to learn the details of [how PAR works, read this article](https://auth0.com/blog/what-are-oauth-push-authorization-requests-par).

ASP.NET Core adds support for PAR to the native [OpenID Connect middleware](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnecthandler). This is a typical configuration of the middleware if you are not using the [Auth0 SDK](https://github.com/auth0/auth0-aspnetcore-authentication):

```csharp
// Program.cs
...
  
builder.services.AddAuthentication(options =>
  {
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
  })
  .AddCookie()
  .AddOpenIdConnect("Auth0", options =>
  {
    options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";

    options.ClientId = builder.Configuration["Auth0:ClientId"];
    options.ClientSecret = builder.Configuration["Auth0:ClientSecret"];
    options.ResponseType = "code";
});

...
```

If the Identity provider you are using supports PAR, you don't need to do anything different from this. In fact, the OpenID Connect middleware transparently supports PAR by default. In other words, if the middleware detects PAR support by analyzing the standard `.well-known/openid-configuration` discovery document, it automatically leverages the PAR endpoint to pass the authorization request parameters. You can change the default behavior by modifying the value of the new option property `PushedAuthorizationBehavior`. For example, the following setting disables PAR support:

```csharp
// Program.cs
...
  
  .AddOpenIdConnect("Auth0", options =>
  {
    options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
    ...
    options.ResponseType = "code";
    
    options.PushedAuthorizationBehavior = PushedAuthorizationBehavior.Disable;
});

...
```

If you want to force your application to use PAR, you can set the value of `PushedAuthorizationBehavior` to `PushedAuthorizationBehavior.Require`. In this case, you get an error if the Identity provider does not support PAR.

Finally, to help customize PAR support, the [`OnPushAuthorization`](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnectevents.onpushauthorization?view=aspnetcore-9.0#microsoft-aspnetcore-authentication-openidconnect-openidconnectevents-onpushauthorization) event has been added to `OpenIdConnectEvents`.

## OAuth and OIDC Parameters Customization

Staying in the context of the OpenID Connect middleware, now you have a simplified way to add custom parameters to the authorization request. Up to .NET 8, if you wanted to add a custom parameter, such as `audience`, to the authorization request, you had to handle the `OnRedirectToIdentityProvider` event as shown in the following code snippet:

```csharp
// Program.cs
...

.AddOpenIdConnect(options =>
{
  options.Events.OnRedirectToIdentityProvider = context =>
  {
    context.ProtocolMessage.SetParameter("audience", "https://myapi.com");
    return Task.CompletedTask;
  };
});
...
```

> If you are using the [Auth0 SDK for ASP.NET Core](https://github.com/auth0/auth0-aspnetcore-authentication), you already have [an easier way to add the audience parameter](https://github.com/auth0/auth0-aspnetcore-authentication/blob/main/EXAMPLES.md#calling-an-api).

.NET 9 introduces the `AdditionalAuthorizationParameters` option to simplify this process. The previous code is equivalent to the following:

```csharp
// Program.cs
...
  
  .AddOpenIdConnect("Auth0", options =>
  {
    ...
    
    options.AdditionalAuthorizationParameters.Add("audience", "https://myapi.com");
});

...
```

## Configuration Flags for Windows Authentication

When using [HTTP.sys](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/httpsys) as a web server for ASP.NET Core applications on Windows systems, you can now configure [Windows Authentication](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth) by setting two new properties:

- `EnableKerberosCredentialCaching`. If this boolean value is `true`, the Kerberos authentication credentials are cached.
- `CaptureCredentials`. If this boolean value is `true`, the HTTP Server API captures the caller's credentials and uses them for Kerberos or Negotiate authentication.

The following code shows an example of usage of these properties:

```csharp
// Program.cs
...
builder.UseHttpSys(options =>
{
    options.Authentication.Schemes = AuthenticationSchemes.Negotiate;
    options.Authentication.EnableKerberosCredentialCaching = true;
    options.Authentication.CaptureCredentials = true;
});
...
```

## Authentication State Serialization for Blazor Web Apps

If you are a Blazor developer, you know how complicated authentication is since [render modes](https://www.telerik.com/blogs/getting-started-blazor-new-render-modes-net-8) have been introduced in .NET 8. You can get an idea by reading [this excerpt](https://auth0.com/blog/auth0-authentication-blazor-web-apps/#Why-Is-Blazor-Authentication-More-Complicated-Now) from my tutorial on adding authentication to Blazor Web Apps. Basically, in an application model where components can be rendered on the server side, on the client side, and on both sides dynamically, you need to keep the user authentication state in sync between the two sides of your Blazor application. This leads to writing a fair amount of code, as you can see by taking a look [here](https://auth0.com/blog/auth0-authentication-blazor-web-apps/#Syncing-the-Authentication-State). In practice, you need to serialize the user authentication state on the server, then send it to the WebAssembly client, which in turn needs to deserialize it. In addition, both authentication states must be kept in sync in order to reflect on the client side the actual authentication state on the server.

Fortunately, .NET 9 simplifies this approach by providing two new methods:

- `AddAuthenticationStateSerialization()`, which adds the services to serialize the authentication state on the server.
- `AddAuthenticationStateDeserialization()`, which adds the services to deserialize the authentication state in the WebAssembly client.

Instead of creating the serializing and deserializing classes yourself, you can now simply call the two methods respectively on the server and on the client to sync the authentication state.

On the server, you will have:

```csharp
// Program.cs
...
builder.Services.AddRazorComponents()
    .AddInteractiveWebAssemblyComponents()
    .AddAuthenticationStateSerialization();
...
```

On the client, you will write the following:

```csharp
// Program.cs
...
builder.Services.AddAuthorizationCore();
builder.Services.AddCascadingAuthenticationState();
builder.Services.AddAuthenticationStateDeserialization();
...
```

Read the [documentation](https://learn.microsoft.com/en-us/aspnet/core/blazor/security/server/?view=aspnetcore-9.0&tabs=visual-studio#manage-authentication-state-in-blazor-web-apps) to learn more.

## Conclusion

Although they are not revolutionary innovations in authentication and authorization, these new features are very convenient because they aim to simplify the work of .NET developers.
In particular, PAR support prevents developers from implementing the extension specifications themselves and encourages the adoption of increasingly advanced security. Also, simplifying the serialization and deserialization of the authentication state in Blazor relieves developers of the burden of implementing specific classes, resulting in potentially fewer bugs.

Authentication and Authorization Enhancements in .NET 9.0

Nelson Matias

As a Group Product Manager at Auth0, I focus on delivering innovative solutions that enhance security and user experience for both businesses and developers. With hands-on experience as a Developer, Consultant, and Solution Architect, along with years of working in Technical Account Management, I’m passionate about solving complex problems and shaping the future of identity management.
Outside of work, I often watch football, listen to music, or spend quality time with my kids.

Group Product Manager

Continuous Session Protection empowers customers to meet a wide range of session and refresh token security needs, including custom lifetimes and revocation capabilities. Let’s dive deeper into how these features can enhance your security strategy.

Continuous Session Protection Now Available for Enterprise Customers

auth0_by_okta_hero copy

Auth0 Team

Offering expanded access and optionality for self-service plans and features

**TLDR**: 
Self-service customers have access to Auth0 capabilities that previously required a call with sales. Effective immediately: (1) customers can now upgrade to our B2B Professional Plan directly through the dashboard, (2) the Enterprise Connection limit in the B2B Pro plan has been increased from 3 to 5, and (3) Pro plans customers can now add a single Enterprise MFA factor (called 'Enterprise MFA Lite') via self-service.

In November 2023, we introduced [updated self-service plans and pricing](https://auth0.com/blog/upcoming-pricing-changes-for-the-customer-identity-cloud/) to scale with our customers. As a continuation of this work and based on your feedback, we now offer self-service customers easier access to plans and capabilities that previously required a discussion with sales.

### Here’s what’s new, effective May 2024:

* You can now choose our [B2B Professional Plan](https://auth0.com/pricing) using your dashboard! The B2B Pro Plan includes: 
    * 5,000 M2M Authentications (more available as add-ons)
    * M2M Add-on
    * External Database
    * Cross App SSO
    * 5 Enterprise Connections (increased from 3)
    * 100 organizations
    * And other features included in the B2B Essentials plan.

    _To upgrade: [Dashboard > Settings (Subscription Tab)](https://manage.auth0.com/#/tenant/billing/subscription) > Select Plan & Quota > Click Upgrade or you can continue to purchase this plan through our Sales team._

* **5 Enterprise Connections** for the B2B Professional Plan's Enterprise Connection limits have increased from 3 connections to 5 connections via self-service. This will allow more of our SaaS customers to scale more effectively. As a reminder, there is no limit on [Okta Enterprise Connections](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/okta) for customers on all of our B2B plans.
* **Enterprise MFA Lite** is now available through self-service for both B2C and B2B Professional. This capability was only available via a contract with Sales, but it can now be added via the dashboard.
    * Enterprise MFA Lite allows you to add either SMS, push, or voice notifications to Professional plans for an additional fee. Fees vary by the amount of MAUs; find more information on [Dashboard > Settings (Subscription Tab.)](https://manage.auth0.com/#/tenant/billing/subscription)
    * This includes the support of push, [SMS, and voice notifications](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa), (SMS charges for MFA are charged separately by carriers supported by Auth0). Under Enterprise MFA Lite, subscriptions will be limited to one MFA factor on the subscription. 

### MFA Offerings Explained

MFA ([Multi-Factor Authentication](https://auth0.com/blog/multifactor-authentication-mfa/)) provides a method to verify a user's identity by requiring them to provide more than one piece of identifying information. For example, **something you know**: a password, PIN, or security question, **something you have**: a smartphone, security token, or smart card, or **something you are**: your fingerprint, face scan, or voice pattern.

Some of our MFA offerings include: 

* **Pro MFA** &mdash; included in B2C Professional, B2B Essentials, B2B Professional, and Enterprise plans 
* **Enterprise MFA Lite Add-on** &mdash; an add-on for B2B and B2C Professional plans and Enterprise plans
* **Enterprise MFA** &mdash; included in our Enterprise Plans 

![Pro Plan Improvements for Self-Service Customers - May 2024](https://images.ctfassets.net/23aumh6u8s0i/sTrHbEBf42kTVlbfp6mRt/2459de4604259c2031a9808dd2111efa/MFA_Table.png)

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b> Please note that upgrading to B2B Professional and adding Enterprise MFA Lite to B2B and B2C Professional plans will incur additional fees. Visit our <a href="https://auth0.com/pricing">pricing page</a> for more information.</b><br> 
</div>

### Which MFA factor(s) are best for my product?

Choosing the right [MFA factor](https://auth0.com/docs/secure/multi-factor-authentication#mfa-factors) is all about striking a balance between security and user experience. Consider the sensitivity of the accounts you're protecting, the technical comfort level of your users, and the accessibility of the MFA factor across different devices. 

![Not All MFA is Created Equal](https://images.ctfassets.net/23aumh6u8s0i/5TgjqFrUJwTDkldGCqov7o/6d80ca9d9c0d29faebea01578a02e0b6/Not_All_MFA_is_Created_Equal.png "Not All MFA is Created Equal")
<p align="center"><i>From blog post: <a href="https://auth0.com/blog/not-all-mfa-is-created-equal/">Not All MFA is Created Equal</a></i></p>

<p align="left"</p>
To help evaluate our MFA offerings, visit this [blog post](https://auth0.com/blog/not-all-mfa-is-created-equal/) to learn about your options and for more details on factor types and authentication assurance levels, check out [this datasheet](https://www.okta.com/resources/datasheet-factor-assurance/).

### Have more questions about your plan or our MFA offerings?

We’re here to help! If you’re on a paid plan, our [Support team](https://support.auth0.com/) can help, and if you’re on a free plan, you can post in our [Community forum](https://community.auth0.com/). Thanks for being a valued customer. We hope this allows for more flexibility and optionality during your auth journey. Happy authenticating!

Pro Plan Improvements for Self-Service Customers - May 2024

A new version of the Auth0 Templates for .NET package has been released: discover the new powerful features.

In May, we [announced the release of Auth0 Templates for .NET](https://auth0.com/blog/introducing-auth0-templates-for-dotnet/), a NuGet package that allows .NET developers to scaffold a new project with Auth0 embedded. Today, we are announcing the release of a new powerful version of the package: [Auth0 Templates for .NET 2.1](https://www.nuget.org/packages/Auth0.Templates). 🎉

Go to your terminal window and install the new package by running the following command:

```bash
dotnet new install Auth0.Templates
```

> ⚠️ If you already have a previous version of the package installed on your machine, please uninstall it using the following command before installing the new package:
>
> ```bash
> dotnet new uninstall Auth0.Templates
> ```
>
> 

Let's explore what's new and how you can now create **a working application with Auth0 authentication in less than a minute!**

## Auth0 CLI integration

The most prominent feature introduced in this new release is the integration with the [Auth0 CLI](https://github.com/auth0/auth0-cli), the command line tool that allows you to manage your Auth0 tenants and your application registration from your terminal window.

> 📖 If you are new to the Auth0 CLI, take a look at [the Auth0 CLI Basics Lab](https://developer.auth0.com/resources/labs/tools/auth0-cli-basics) to learn how to use it.

If you have the Auth0 CLI installed on your machine and are already logged in to your Auth0 tenant, you can have your new application automatically registered. Let's do an example to better explain.

### Self-Registration in .NET CLI

Suppose you want to create a Blazor Server application with Auth0 authentication embedded. You can start by running the following command in a terminal window:

```bash
dotnet new auth0blazorserver -o MyBlazorServerApp
```

This command uses the `auth0blazorserver` template to create a Blazor Server application in the `MyBlazorServerApp` folder.

After launching the command, you will see a message similar to the following:

```bash
The template "Auth0 Blazor Server App" was created successfully.

Processing post-creation actions...

Template is configured to run the following action:
Actual command: register-with-auth0.cmd 
Do you want to run this action [Y(yes)|N(no)]?
```

With this message, the template engine asks if you want to register the newly created application with Auth0.

Once you confirm, the new Blazor application will be registered on your current Auth0 tenant. You will see the registration data onscreen for documentation purposes only, as you don't need to configure it manually. In fact, your new application will be automatically configured. All you need to do is run your Blazor application with `dotnet run`!

As you can see, using the integration with the Auth0 CLI allows you to have **an application up and running in less than a minute!**

Of course, you can still pass the configuration options on the command line in case you don't have the Auth0 CLI installed or if you have already registered the application with Auth0. See the [specific options for each template](https://github.com/auth0/auth0-dotnet-templates#usage) for more details.

### Auth0 registration in Visual Studio

If you are using the templates with Visual Studio, you can't leverage the self-registering feature. This is not a limitation of the template, but a restriction imposed by Visual Studio (see [this issue](https://github.com/dotnet/templating/issues/4575) for context).

However, you can run the registration action manually. So, assuming you want to create your Blazor Server application with Visual Studio, select the Auth0 Blazor Server App template as shown in the following picture:

![Auth0 Blazor Server template in Visual Studio](https://images.ctfassets.net/23aumh6u8s0i/4vIKOhrrozhmSDMkYPsEUr/5bd66766af25db726fb3aca5c4d731ab/auth0-blazorserver-app-vs.png)

Then, accept the default values proposed by the template configuration window and create the project.

After the project is created, go to the newly created application and run the following command:

```bash
./register-with-auth0.cmd
```

This command will automatically register your Blazor Server application with Auth0 and configure your application.

> Note: On MacOS you must enable the script to execute. Run the following command before launching the automatic registration:
>
> ```bash
> chmod +x register-with-auth0.cmd
> ```

## .NET 8 Support

The new release of Auth0 Templates for .NET supports .NET 8 by default for most templates. When you use the `dotnet new` command without specifying a framework version, you will get a .NET project with .NET 8 as the target framework. This is also the default .NET version when you are using Visual Studio, as shown below:

![Auth0 Template for ASP.NET Core MVC targeting .NET 8](https://images.ctfassets.net/23aumh6u8s0i/1mnYGKi2t006MED0sC2raQ/902bd9cb7b94be9e4b0d4c6c14b9d3ea/auth0-mvc-app-vs-options.png)

Blazor templates do not currently support .NET 8, but they still target .NET 7. The reason for this choice depends on the new .NET 8 Blazor model, which provides a more fluid approach between the Server and the WebAssembly hosting models. Currently, there are no official guidelines on how to integrate OpenID Connect with the new Blazor model. If you are interested in this topic, you can follow [this thread in the Auth0 Community forum](https://community.auth0.com/t/net-8-0-blazor/119691) to stay updated.

<include src="ebook-ads/dotnetIdentity" />

## Minimal API Template

The [Auth0 Templates for .NET package](https://www.nuget.org/packages/Auth0.Templates/) contains four templates since its first release:

- ASP.NET Core MVC
- ASP.NET Core Web API
- Blazor Server
- Blazor WebAssembly (ASP.NET Core hosted)

This new release adds a new template for [ASP.NET Core minimal API](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis). To use this template, add the `--minimal` option to the `dotnet new auth0webapi` command, as shown in the following example:

```bash
dotnet new auth0webapi -o MyWebAPI --minimal
```

This command creates a minimal API project in the `MyWebAPI` folder, and if you have the .NET CLI installed on your machine, it also registers it with Auth0.

In Visual Studio, you can simply select the *Use minimal API* checkbox as shown in the following picture:

![Options for the Auth0 ASP.NET Core Web API template in Visual Studio](https://images.ctfassets.net/23aumh6u8s0i/30Wl7yaOdnuWBhmdbRZa3v/259aa7ca9bb215da9fba8e62bfee8d87/auth0-webapi-app-vs-options.png)

## Looking Ahead

We hope that these new features will help .NET developers set up their new applications with Auth0 more easily than before. Our goal for the next release is to include a template for the missing Blazor model and add templates for other .NET application types.

Your feedback is valuable. If you experience a problem or have a request, please [open an issue](https://github.com/auth0/auth0-dotnet-templates/issues/new/choose) on the project's GitHub repository.

Remember that [Auth0 Templates for .NET](https://github.com/auth0/auth0-dotnet-templates) is an open source project, so your contribution is welcome! If you think you can help, check out [our contribution policy](https://github.com/auth0/auth0-dotnet-templates/tree/main#contributing) and get involved.



Auth0 Templates for .NET: A New Powerful Version Released

Let’s explore the new features brought by .NET 8 to support authentication and authorization in your applications.

The release of **.NET 8** is just around the corner. Among the amazing features it brings to developers, it offers a minor revolution in support for authentication and authorization: moving ASP.NET Core Identity from a page-oriented approach to an API-oriented approach.

Let's explore what's going on.

## ASP.NET Core Identity and Token-based Authentication

ASP.NET Core developers have the built-in [ASP.NET Core Identity](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity) framework to add support for local authentication and authorization. The identity framework includes everything that developers typically need to authenticate and authorize users against a local user store. By default, a SQL Server database is created on Windows and a SQLite database is created on macOS, but you can change it to the DBMS of your choice.

The ASP.NET Core Identity framework is designed for server-rendered web applications, such as ASP.NET Core MVC or Razor Pages applications, and has challenges with SPAs, where token-based authentication seems more appropriate. To address this problem, Microsoft has provided built-in project templates for SPAs based on Angular and React with Identity Server support since .NET Core 3.1. However, the .NET community [has not been totally happy with this approach](https://github.com/dotnet/aspnetcore/issues/42158). To [meet the community's demands](https://github.com/dotnet/aspnetcore/issues/42158#issuecomment-1481742187), Microsoft removed the default support for Identity Server in .NET 8 and redesigned the internal architecture of ASP.NET Core Identity to be more suitable for SPAs and native apps. .NET 8 introduces a new set of Identity API endpoints and support for token-based authentication. But let's go in order.

## Bearer Token Authentication Handler

The first building block of this new infrastructure is the new [bearer token authentication handler](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.bearertokenextensions.addbearertoken). This handler is similar to the classic [cookie authentication handler](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.cookieextensions.addcookie) that ASP.NET Core Identity uses by default. The cookie authentication handler is responsible for two things:

- Creating a new session cookie after the user authenticates.
- Building a `ClaimsPrincipal` user object based on a valid session cookie received in the incoming HTTP request.

Similarly, the bearer token authentication handler is responsible for:

- Creating a new token after the user authenticates.
- Building a `ClaimsPrincipal` user object based on a valid token received in the incoming HTTP request.

In other words, the bearer token handler mimics the behavior of the cookie handler to manage authenticated sessions based on a token instead of a cookie.

> Note that the tokens generated by the bearer token handler are not in JWT format. Also, they don't follow any specific standard. While the documentation mentions [access tokens](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.bearertoken.accesstokenresponse.accesstoken?view=aspnetcore-8.0) and [refresh tokens](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.bearertoken.accesstokenresponse.refreshtoken?view=aspnetcore-8.0), they do not implement the [OAuth 2.0 authorization framework](https://oauth.net/2/).

How can this bearer token handler be used in practice?

Consider the following code:

```csharp
// Program.cs

using Microsoft.AspNetCore.Authentication.BearerToken; //👈
using System.Security.Claims;
 
var builder = WebApplication.CreateBuilder(args);
 
builder.Services
    .AddAuthentication()
    .AddBearerToken();  //👈
builder.Services.AddAuthorization();
 
var app = builder.Build();
 
app.MapGet("/login", (string username) =>
    {
        var claimsPrincipal = new ClaimsPrincipal(
          new ClaimsIdentity(
            new[] { new Claim(ClaimTypes.Name, username)},
            BearerTokenDefaults.AuthenticationScheme  //👈
          )
        );

        return Results.SignIn(claimsPrincipal);
    });
 
app.MapGet("/user", (ClaimsPrincipal user) =>
    {
        return Results.Ok($"Welcome {user.Identity.Name}!");
    })
    .RequireAuthorization();
 
app.Run();
```

This application defines two API endpoints:

- The `/login` endpoint creates a `ClaimsPrincipal` user object based on the username sent in the HTTP request and returns the result of signing in.
- The `/user` endpoint returns the username of the authenticated user.

Note the highlighted lines in the code. You have a reference to the new `Microsoft.AspNetCore.Authentication.BearerToken` namespace, which gives you access to the `BearerTokenDefaults.AuthenticationScheme` value. You also configure the bearer token middleware by using the `AddBearerToken()` extension method.

Now, assume you call the `login` endpoint with curl, as shown below:

```bash
curl 'https://<YOUR_HOST>/login?username=joe'
```

You will see a result like the following:

```json
{
  "token_type": "Bearer",
  "access_token": "CfDJ8Ha5YkqG...omitted content...",
  "expires_in": 3600,
  "refresh_token": "CfDJ8Ha5YkqG...omitted content..."
}
```

This JSON contains an access token and a refresh token that you can use to make your calls to the protected APIs exposed by your application. For example, you can now call the protected `/user` endpoint as follows:

```bash
curl -i https://<YOUR_HOST>/user \
-H 'Authorization: Bearer CfDJ8Ha5YkqG...omitted content...'
```

And you will get the following response:

```json
Welcome joe!
```

In summary, the bearer token authentication handler makes it very easy to set up token-based authentication. This is the building block of the whole ASP.NET Core Identity transition to token-based authentication.

## Identity API Endpoints

The second step in adding token-based authentication to ASP.NET Core Identity is to introduce the Identity API endpoints. Basically, this is an API version of the actions that you can perform with ASP.NET Core Identity through the classic web UI. Once you enable the [Identity API endpoints](https://github.com/dotnet/aspnetcore/blob/main/src/Identity/Core/src/IdentityApiEndpointRouteBuilderExtensions.cs), you will get endpoints like `/register`, `/login`, `/forgotPassword`, `confirmEmail`, etc.

The Identity API endpoints solve two of the most complained problems:

- You can build your own UI for user authentication and account management while maintaining the overall UI style of your application.
- After authentication, your app can get access tokens instead of cookies, so it's a more suitable approach for SPAs and native applications.

> Keep in mind that the Identity API endpoints do not implement [OpenID Connect (OIDC)](https://auth0.com/docs/authenticate/protocols/openid-connect-protocol). They simply expose the standard functionality provided by the ASP.NET Core Identity UI through a custom API. They are intended for first-party authentication.

Adding the Identity API endpoints to an ASP.NET Core application relies on two new methods:

- `AddIdentityApiEndpoints()`, which configures the token-based authentication using the bearer token handler in addition to the cookie authentication, and adds a set of identity services.
- `MapIdentityApi()`, which actually adds the Identity endpoints to your application.

The code in your `Program.cs` file will look like the following:

```csharp
// Program.cs

using System.Security.Claims;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthorization();

builder.Services.AddDbContext<ApplicationDbContext>(
    options => options.UseSqlite(builder.Configuration["ConnectionString"]));

builder.Services.AddIdentityApiEndpoints<IdentityUser>()
    .AddEntityFrameworkStores<ApplicationDbContext>();

var app = builder.Build();

app.MapIdentityApi<IdentityUser>();

app.MapGet("/user", (ClaimsPrincipal user) =>
    {
        return Results.Ok($"Welcome {user.Identity.Name}!");
    })
    .RequireAuthorization();

app.Run();
```

Your client will be able to register a user by calling the `/register` endpoint, authenticate the user through the `/login` endpoint, and so on.

While the Identity API endpoints seem to solve the two main complaints about the classic ASP.NET Core Identity, there are [some concerns about using them in a production context](https://andrewlock.net/should-you-use-the-dotnet-8-identity-api-endpoints/), mainly on the security and scalability side.

## Blazor Identity UI

In addition to the changes to ASP.NET Core Identity, .NET 8 integrates the authentication framework into the Blazor project template. You can create a new .NET 8 Blazor application with identity support by running the following command:

```bash
dotnet new blazor -au Individual
```

You will get a Blazor application with everything you need to manage users and authentication locally. You will get a SQLite database to store the user accounts. You will get a SQL Server database if you use Visual Studio to scaffold the application instead of the .NET CLI. You also will get all the pages that allow users to register, authenticate, and manage their account.

The following image shows the built-in login page of a Blazor app:

![Blazor login page](https://images.ctfassets.net/23aumh6u8s0i/3J8DlVMk9qsHw9tLIAwpue/cd94d62d51ce5dc6627bda3c75d14a42/blazor-identity-ui-login.png)

The user authentication and management pages that implement the Blazor Identity UI are not Razor pages as it happens with the classic ASP.NET Core Identity, but [Razor components](https://learn.microsoft.com/en-us/aspnet/core/blazor/components). The template provides you with the source code for all of the UI components in the `Pages/Account` folder of the project. This allows you to customize them according to your application design.

<include src="ebook-ads/dotnetIdentity" />

## Custom Authorization Policies Simplification

Apart from the new features related to ASP.NET Core Identity, .NET 8 introduces a simplification to the definition of custom authorization policies. Previously, you had to write a lot of code to define a parameterized authorization policy to apply to an API endpoint.

For example, suppose you want to define a policy for an endpoint that only authorizes users over the age of 18 and that can be used as shown below:

```csharp
[ApiController]
[Route("api/[controller]")]
public class DrinkController : Controller
{
    [MinimumAgeAuthorize(18)]
    [HttpGet("beer")]
    public string BeerDispenser(ClaimsPrincipal user) => $"Here is your beer, {user.Identity?.Name}!";
}
```

With previous .NET versions, to implement your custom authorization policy, you must write the code outlined in the following code snippet:

```csharp
class MinimumAgeAuthorizeAttribute : AuthorizeAttribute
{
  ...
}

class MinimumAgePolicyProvider : IAuthorizationPolicyProvider
{
  ...
}

class MinimumAgeRequirement : IAuthorizationRequirement
{
  ...
}

class MinimumAgeAuthorizationHandler : AuthorizationHandler<MinimumAgeRequirement>
{
  ...
}
```

You must define an `AuthorizeAttribute`. Then you need to implement an `IAuthorizationPolicyProvider` to handle your custom policy and an `IAuthorizationRequirement` to define the requirement. Finally, you have to implement the `AuthorizationHandler`.

The code snippet shown above outlines the classes you need to implement. To see an example of the actual implementation, take a look at this [code sample](https://gist.github.com/captainsafia/309e408cb5e2c2e5acd44d2e19f7f88e).

Using the new `IAuthorizationRequirementData` interface, your implementation code becomes as follows:

```csharp
class MinimumAgeAuthorizeAttribute : AuthorizeAttribute, IAuthorizationRequirement, IAuthorizationRequirementData
{
  public MinimumAgeAuthorizeAttribute(int age) => Age =age;
  public int Age { get; }

  public IEnumerable<IAuthorizationRequirement> GetRequirements()
  {
    yield return this;
  }
}

class MinimumAgeAuthorizationHandler : AuthorizationHandler<MinimumAgeAuthorizeAttribute>
{
  protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, MinimumAgeAuthorizeAttribute requirement) 
  {
    ...
  }
}
```

You only need to implement two classes instead of four as in the previous example. See [here](https://gist.github.com/captainsafia/7c54e92d12df695ff0908e989fb8531f) for the complete code.

## Summary

Throughout this article, you have learned about the new features that .NET 8 brings to support authentication and authorization. Most of these features are related to the extension of the ASP.NET Core Identity framework to support token-based authentication, which paves the way for authentication in SPAs and native applications.

As a side effect, you get access to the bearer token authentication handler, which allows you to issue access tokens, and to the Identity API endpoints, which allow you to embed authentication support in your Web API.

In addition, the Blazor project template now supports authentication through the Identity API endpoints and a rich set of Razor components designed for user authentication and management.

Finally, the new `IAuthorizationRequirementData` interface allows you to create custom authorization policies with less code.


.NET 8: What's New for Authentication and Authorization

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Juan Cruz Martinez

Let's explore the main features of the new Auth0 SDK for NextJS release.

For almost a year now, the team at Next.js has been building the foundations for the future of Next.js, a future based on the React architecture, which includes Server Components, Server Actions, and much more.

With the introduction of Next.js 13.4 a few months ago, the new [App router](https://nextjs.org/blog/next-13-4#nextjs-app-router) architecture with support for React Server Components, nested routes, layouts, and new data fetching design, was promoted to stable and is the recommended option for newly built Next.js applications.

These new fundamental changes in architecture and APIs on Next.js meant that many libraries with support for Next.js had to undergo changes to fully utilize and benefit from the latest release.

<AmpContent>
<amp-youtube
    data-videoid="9ubpQ_VW158"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/9ubpQ_VW158' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Auth0's first SDK for Next.js dates back to 2021. Since then, we have been committed to the Next.js community by providing a robust, scalable, and developer-friendly SDK for implementing user authentication. We are **very happy to announce the stable release of the [Auth0 Next.js SDK v3](https://github.com/auth0/nextjs-auth0/releases/tag/v3.0.0)** with support for App Router, Edge Runtime, and Responses in Middleware.  We’ve created this [quickstart guide](https://auth0.com/docs/quickstart/webapp/nextjs/01-login) that demonstrates how to integrate Auth0 with any new or existing Next.js application using the Auth0 Next.js SDK.

## What Do I Need to Do With Existing Applications Using Pages Router?

Not much. Like Next.js, the Auth0 Next.js SDK `v3` continues to support the Pages Router and the new App Router. When updating to the new SDK, there are three considerations to keep in mind:

- As is the case for Next.js `v13.4`, the new SDK requires [Node `v16` LTS or newer releases](https://nodejs.org/en/download).
- For TypeScript applications, differences in function signatures that support both the Pages and App Router may require you to use explicit declarations for the `request` and `response` objects to help TypeScript infer their type correctly. For example:
    - Before:
    
    ```typescript
    import { withApiAuthRequired } from '@auth0/nextjs-auth0'
    
    export default withApiAuthRequired(async function handler(req, res) {
      res.status(200).json({});
    });
    ```
    
    - After:
    
    ```typescript
    import { NextApiRequest, NextApiResponse } from 'next';
    import { withApiAuthRequired } from '@auth0/nextjs-auth0'
    
    export default withApiAuthRequired(async function handler(req: NextApiRequest, res: NextApiResponse) {
      res.status(200).json({});
    });
    ```
    
- The `/401` handler has been removed: As of Next.js `v13.1`, you can now return responses from middleware. As such, the unauthorized handler has been removed in favor of an unauthorized response.

If you need to migrate your application from the Auth0 Next.js SDK `v2` to the latest version, please follow our official [`v3` migration guide](https://github.com/auth0/nextjs-auth0/blob/main/V3_MIGRATION_GUIDE.md).

## Working with the New App Router

Working with the new App Router requires a shift in the architecture and project structure of your Next.js application, and as a result of this new architecture, there are a [few limitations](https://github.com/auth0/nextjs-auth0/tree/main#important-limitations-of-the-app-directory) that you need to understand before implementing authentication for your application or working with cookies and sessions in general.

These are the steps to add authentication to your Next.js application using the latest version of the Auth0 Next.js SDK:

### Install the Auth0 SDK for Next.js

First and foremost, install the Auth0  Next.js SDK using the following command:

```bash
npm install @auth0/nextjs-auth0
```

### Add the dynamic API route

As was the case for Pages Router, the Auth0 SDK automatically creates a series of API routes or endpoints to handle essential authentication features such as login, logout, and getting user information.

For the Auth0 Next.js SDK to create such routes, it is necessary to create a [catch-all, dynamic API route handler](https://nextjs.org/docs/app/building-your-application/routing/dynamic-routes) under the `/app/api` directory. Technically speaking, you don’t need to use the `api` directory anymore to specify API routes. However, our SDK follows that convention for simplicity and clarity.

Then, create a `route.js` or `route.ts` file under the `/app/api/auth/[auth0]/` directory and populate it with the following code:

```javascript
import { handleAuth } from '@auth0/nextjs-auth0';

export const GET = handleAuth();
```

### Make the Auth0 hooks accessible throughout your application

When working on the client side of your Next.js application, you can use the `useUser()` hook from the Auth0 Next.js SDK to retrieve information about the current user and session. Since this hook leverages the React Context API to manage and communicate the authentication state of the user, you’ll have to wrap your components with a `UserProvider`. 

When using the Next.js App Router, you should wrap your [root layout](https://nextjs.org/docs/app/building-your-application/routing/pages-and-layouts#layouts) with `UserProvider` as follows:

```javascript
// app/layout.js
import React from 'react';
import { UserProvider } from '@auth0/nextjs-auth0/client';

export default function App({ children }) {
  return (
    <UserProvider>
      <body>{children}</body>
    </UserProvider>
  );
}
```

### Access user and session information

You can check if a user is authenticated by verifying that the `user` object returned by the `useUser()` hook is defined. Additionally, you can log in or log out of your users from the client layer of your Next.js application by redirecting them to the corresponding automatically-generated route.

Here is an example of a client component accessing and using user information to build a basic login, logout user flow.

```javascript
// pages/index.js
'use client';
import { useUser } from '@auth0/nextjs-auth0/client';

export default function Index() {
  const { user, error, isLoading } = useUser();

  if (isLoading) return <div>Loading...</div>;
  if (error) return <div>{error.message}</div>;

  if (user) {
    return (
      <div>
        Welcome {user.name}! <a href="/api/auth/logout">Logout</a>
      </div>
    );
  }

  return <a href="/api/auth/login">Login</a>;
}
```

## What’s Next

With the release of the Auth0 Next.js SDK v3, we are excited to continue supporting the Next.js community with a comprehensive solution for user authentication and route protection.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b>To get started, create a free account at <a href="https://auth0.com/signup?utm_source=partner&utm_medium=vercel-okta&utm_campaign=2023-03%7CINB-ORG%7CVercel-Auth0-SignupUserCreationForm-SU&ocid=7014z000000zJItAAM-aPA4z0000008OZeGAM&utm_id=aNK4z000000blT4GAI">Auth0.com</a>.</b><br> 
</div>

In this article, we only covered the basics, and if you want to learn more about how to secure your application, please check the official [GitHub repository for the SDK](https://github.com/auth0/nextjs-auth0) as well as some [examples of practical use cases](https://github.com/auth0/nextjs-auth0/blob/main/EXAMPLES.md), or check out our [Next.js code samples](https://developer.auth0.com/resources/code-samples/web-app/nextjs/basic-authentication). To get started on Next.js Authentication with Auth0 check out this [blog post](https://auth0.com/blog/ultimate-guide-nextjs-authentication-auth0/).

Auth0 by Okta is committed to providing our community and customers with a smooth yet robust developer experience to secure their applications. We continue to look for ways to improve our products and shape the future of authentication. We'd love to hear about your experience using our latest iteration of the Auth0 Next.js SDK.

Thanks for reading!

Auth0 Stable Support For Next.js App Router!

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Auth0 at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community.

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [**Products That Count**](https://productsthatcount.com/) and [**Aiven.io**](http://Aiven.io).


President, Auth0

Shiven Ramji

Over the last 6 months, Okta has delivered capabilities designed with security, scalability, and resiliency in mind. Read about what we delivered and our future roadmap.

Our teams have been heads down and focused on delivering capabilities that empower our customers to continue to provide seamless customer experiences and power their SaaS ambitions. As we are now halfway through the calendar year, I wanted to reflect on the capabilities we have delivered and give you a glimpse of what's to come next. 

## Unveiling New and Improved Product Features

We strive for innovation and resiliency in our work since we know it translates into direct value for our customers. Over the past six months, our teams have worked across domains to deliver capabilities meticulously designed with security, scalability, and resiliency in mind.

### Flexibility Focus

We continue to double down on improving our customers' ability to build great user experiences within consumer apps. The team has persistently strived to provide a flexible way to build identity flows. In the past few months, we've launched a few enhancements to support this goal further.

* [Passwordless support on New Universal Login](https://auth0.com/docs/authenticate/passwordless/passwordless-with-new-universal-login) allows users to provide an email address or phone number and receive a one-time password (OTP) to complete authentication.
* [Additional email provider support](https://auth0.com/changelog#3yVUYwYINRo7edOw8tP7kG) (Azure Communication Service & Microsoft Modern Auth) enables customers to use Outlook on Microsoft 365 or the recently released Azure Communication Services as preferred authentication methods.

### SaaS Excellence

With a keen eye for enhancing user experiences and elevating customer satisfaction, we continue to make strides that redefine and advance SaaS excellence. To that end, the teams have released several new features:

* [PKCE and attribute mapping are available on OIDC and Okta Workforce Connections](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/configure-pkce-claim-mapping-for-oidc), allowing customers to build more secure connections between Auth0 and your connected identity provider. With attribute mapping, you can sync more attributes from your IDP into your Auth0 tenant.
* [Improved Login Flow for SaaS Users](https://auth0.com/docs/manage-users/organizations/login-flows-for-organizations) includes options for tying identifier first Home Realm Discovery to Connections with IdP domains associated with Organizations and a New Universal Login Prompt that displays when configured for end users with multiple organization memberships. 
* [Organization Name support for launching Login flows](https://auth0.com/docs/manage-users/organizations/configure-organizations/use-org-name-authentication-api), making Organizations easier to use by enabling the Organization Name to launch login flows via the Authentication API.

### Making Security Easy

At the core of everything we do is the desire to make security seamless and straightforward. Safeguarding data should be uncomplicated yet foolproof. Our latest releases offer protection and make it intuitive, empowering our customers and their users to navigate the digital world without compromise.

* [Security Center is now available on Converged Platform](https://auth0.com/docs/secure/security-center), a new security feature that provides real-time monitoring of potential security events.
* [Bot Detection Slider for Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection#use-bot-detection-slider) provides the ability to adjust the level of friction of the "When Risky" setting on our Bot Detection model.
* [Bot Detection is Now Integrated with Friendly Captcha and hCaptcha](https://auth0.com/docs/secure/attack-protection/bot-detection#configure-bot-detection), supporting additional Captcha Providers and their capabilities. 
* [Teams: Security Policies - SSO Enforcement Early Access](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#configure-security-policies), providing the option to mandate login to Teams and Manage Dashboard through the organization's enterprise IdP.

### Developer Experience

Our Developer Experience teams built the following enhancements with intention, care, and a complete developer experience in mind. With streamlined workflows and a suite of tools, developers quickly translate their application experience vision into reality.

* [Node 18 is now available for Actions, Rules, and Hooks](https://auth0.com/changelog#2xzzvhZDXiRbThfc7XsfO). You can start using Node 18 in your tenants' settings and/or when creating new Actions in the Auth0 Manage Dashboard.
* [Auth0 Terraform Provider V1 - BETA](https://auth0.com/changelog#515sGCwZW2u6bD06rzS1uC), with the v1 release, managing your Auth0 resources using Terraform has never been easier. 
* [Auth0 Management API](https://auth0.com/docs/api/management/v2) launched, which includes numerous new features and enhancements for the UI experience.
* [Teams: Security Policies - SSO Enforcement](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#configure-security-policies), allowing you to mandate login to Teams and Manage Dashboard through the organization's enterprise IdP.

### Customer Delight

We obsess over giving customers the complete capabilities to deliver a delightful customer experience. Every interaction and every touchpoint is an opportunity to elevate the customer journey. Our latest achievements stand as a testament to our dedication to not only meeting but exceeding the expectations that define customer delight.

* [Guardian App Localization](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian): The Guardian app is available as an authenticator to deliver push notifications to a user's pre-registered device (mobile phone or tablet) and supports English - US (en-us), French - Canada (fr-ca), French - France (fr), Portuguese - Brazil (pt-br), and Spanish - Argentina (es-ar).
* [Universal Login: New Language Support](https://auth0.com/docs/customize/internationalization-and-localization/universal-login-internationalization): Six new languages are now available as supported translations for Universal Login: Basque: eu-ES; Catalan: ca-ES; Galician: gl-ES; Norwegian: no; Norwegian Nynorsk: nn; and Welsh: cy.
* [Custom Domains in Guardian SDKs](https://auth0.com/changelog#7brExNHNLtHshVHvayBm6L), building your users' confidence that they are providing their credentials to the proper party. Custom Domains allow authentication to happen within the context of your brand.

The [Auth0 Changelog](https://auth0.com/changelog) has the full details and documentation on these updates and serves as the real-time release center. 

## Looking Forward to the Next Half

We've made good progress on delivering our roadmap and have steadily released capabilities that help our customers deliver seamless and secure experiences for their customers. 

A big thank you to all of our teams, and looking forward to penning another post full of releases in the next six months. 

[Oktane](https://www.okta.com/oktane/) is just around the corner, where we'll pull back the curtain on what's still to come! Registration is now open, and we hope to see you there.

Unveiling New and Improved Product Features — 6 Month Lookback

The Auth0 team released a new major version of the [Auth0 NextJS SDK](https://github.com/auth0/nextjs-auth0) which incorporates much of the received feedback from our v1, including support for NextJS middleware, changes in the API, first-class testing support, optimizations on the Front End package, and lots more.

This article will cover some of the most significant changes, but for a complete set, plus indications on how to migrate your current project to the new SDK, I recommend following the official [migration guide](https://github.com/auth0/nextjs-auth0/blob/v2.0.0/V2_MIGRATION_GUIDE.md).


## NextJS Middleware Support

The introduction of NextJS middleware in v12 was a big step for the framework that allows you to run code before a request is completed.

This support has been highly requested by the community, and the benefits can be summarized in two aspects: simplification and performance improvement.

### It's a lot easier to add authentication code

Prior to middleware support, each page that required authentication would need to add a snippet of code to tell NextJS only to allow access to authenticated users.

In v2, all that spread-out code can be rewritten at a single location by using middleware like the following:

```javascript
// middleware.js
import { withMiddlewareAuthRequired } from '@auth0/nextjs-auth0/middleware';

export default withMiddlewareAuthRequired();

export const config = {
  matcher: '/user/:path*',
}
```

With that simple configuration, NextJS will run the middleware `withMiddlewareAuthRequired` when the URL matches the given `matcher` expression. The matcher expressions are a feature of NextJS, they are very customizable, and you can read more information about them on [NextJS's middleware docs](https://nextjs.org/docs/advanced-features/middleware#matcher).

### Performance

Since middleware in NodeJS runs on the [NextJS Edge Runtime](https://nextjs.org/docs/api-reference/edge-runtime), validating user sessions at that level gives an immediate performance boost by simply reducing the latency for users. It is no longer required for the request to be sent to the origin server and back if the user is not authenticated.

In the image below, you can see how the NextJS Middleware Architecture plays a role in performance by being closer to the user's location.

![NextJS Middleware Architecture](https://images.ctfassets.net/23aumh6u8s0i/6jmWEwH1yBEc8Mb9lchAUk/313ee1de712bc6bd0cbe8e106154c5be/nextjs-middleware.png)

## A Delightful New Declarative Routing API

From v1, the SDK has been deeply customizable, but users often have to write full request handlers to access some of the lower-level features of the SDK. With the new declarative API for creating request handlers, this can be done simply and beautifully through the API.

Take a look at the following snippets of code.

### Using SDK v1

```javascript
export default handleAuth({
  signup: async function signup(req, res) {
    try {
      await handleLogin(req, res, {
        authorizationParams: {
          screen_hint: 'signup'
        }
      });
    } catch (error) {
      res.status(error.status || 400).end(error.message);
    }
  },
  invite: async function invite(req, res) {
    try {
      await handleLogin(req, res, {
        authorizationParams: {
          invitation: req.query.invitation
        }
      });
    } catch (error) {
      res.status(error.status || 400).end(error.message);
    }
  },
  'login-with-google': async function loginWithGoogle(req, res) {
    try {
      await handleLogin(req, res, {
        authorizationParams: {
          connection: 'google'
        }
      });
    } catch (error) {
      res.status(error.status || 400).end(error.message);
    }
  },
  'refresh-profile': async function refreshProfile(req, res) {
    try {
      await handleProfile(req, res, {
        refetch: true
      });
    } catch (error) {
      res.status(error.status || 400).end(error.message);
    }
  },
}
```

### Using SDK v2

```javascript
export default handleAuth({
  signup: loginHandler({ authorizationParams: { login_hint: 'signup' } }),
  invite: loginHandler({ authorizationParams: (req) => { invitation: req.query.invitation } }),
  'login-with-google': loginHandler({ authorizationParams: { connection: 'google' } }),
  'refresh-profile': profileHandler({ refetch: true }),
}
```

Isn't that much nicer?

## First Class Testing Support

Testing routes that require login has always been a complex problem for developers. The new SDK release includes built-in support for seeding the session cookie on your tests to make testing authenticated pages a breeze. 

Instead of having to manage secrets in tests, visit third-party websites or mock complex internals of authentication libraries, users can use the new testing functionality built right into the SDK.

Consider the following code:

```javascript
import { generateSessionCookie } from '@auth0/nextjs-auth0/testing';

test('should visit profile page', async () => {
  const cookie = await generateSessionCookie(session, config);
  const res = visit('/profile', { headers: { cookies: `appSession=${cookie}` } });
  expect(res.status).toBe(200);
})
```

The code above uses Auth0 NextJS SDK to generate a session cookie which is later sent as part of the `visit` request.

If the session is not provided, the request would respond with a `403 Forbidden` as the URL is protected against unauthenticated requests.

## And LOTS more…
But that is not all. The new SDK offers you:

- New session lifecycle and `updateUser` method.
- New package export profile to support React Server Components. 
- Improved API Docs.
- Improved Error Handling.
- Lighter Front-End binary.
- Support for custom Logout Options.
- Easier options for managing cookie size.

## Summary

The [Auth0 NextJS SDK](https://github.com/auth0/nextjs-auth0) v2 introduced some pretty neat changes that will ultimately provide a better developer and end-user experience.

For those projects migrating from the SDK v1, I recommend reading the official [migration guide](https://github.com/auth0/nextjs-auth0/blob/v2.0.0/V2_MIGRATION_GUIDE.md).

Thanks for reading!

Auth0 SDK for NextJS v2.0 released!

Let's explore the main features of the new Auth0 SDK for SPA release.

> The Auth0 team released the new Auth0 Single Page App SDK v2.0, and it's now available in the [npm registry](https://www.npmjs.com/package/@auth0/auth0-spa-js). It is a major new release with a focus on development and user experience.

The new release makes an important step towards improving usability and reducing the footprint (size) of the SDK.

## Quick Start with the New SDK

You can follow the [quick start guide](https://auth0.com/docs/quickstart/spa/vanillajs) if you build a new application or connect your SPA with Auth0 using the SDK for the first time.

If you use frameworks such as React, Angular, or Vue, you can use framework-specific libraries instead. You can learn more about specific frameworks in our [SPA guides section](https://auth0.com/docs/quickstart/spa).

> All of the mentioned improvements will be available in the next beta versions of our framework-specific SDKs. Be sure to keep an eye on them to be notified when their beta versions are available.

## Migrating from v1.x

With the improvements from v1.x, it was necessary to introduce some breaking changes. We will cover the most impactful changes in this post, but we recommend reviewing the [migration guide](https://github.com/auth0/auth0-spa-js/blob/master/MIGRATION_GUIDE.md) for the details of all breaking changes and their corresponding migration path.

## Reduced Bundle Size by 60%

Auth0 SPA SDK V1.x shipped with built-in polyfills to compensate for the lack of native support on some browsers for features such as:

- [AbortController](https://caniuse.com/mdn-api_abortcontroller_abortcontroller)
- [Promise](https://caniuse.com/promises)
- [TextEncoder & TextDecoder](https://caniuse.com/textencoder)
- [Fetch](https://caniuse.com/fetch)

As the above APIs are now available for most browsers, we believe there's no more need to include those polyfills. Primarily users of IE11 would require them, and with [Microsoft dropping support for IE11](https://blogs.windows.com/windowsexperience/2022/06/15/internet-explorer-11-has-retired-and-is-officially-out-of-support-what-you-need-to-know/), we believe it makes sense to capitalize on the gains and **drop support for IE11 as of V2**.

By removing these polyfills, and with some small improvements on our side, we **reduced the bundle size by an outstanding 60%**.

Such a reduction will allow for faster download and processing times for application users.

## API Consistency

Our SDK offers a variety of settings that can be divided into two categories:

- Properties used to configure our SDK
- Properties used solely to pass through to Auth0

In v1.x, passing both types of properties to the SDK was possible when instantiating a new `Auth0Client`. Because the different types of arguments were differentiated only by the case (camel vs. snake case), with no additional separation in the object argument, it wasn't very evident what arguments were SDK properties and which ones were authorization parameters.

Here is an example of what setting such options on v1.x looks like:

```javascript
const client = new Auth0Client({
  client_id: '...',
  useRefreshTokens: true,
  useRefreshTokensFallback: false,
  redirect_uri: '...',
  custom_param: '...',
  screen_hint: 'signup'
});
```

With v2, we are ensuring the distinction between the two categories is clear by putting any property solely used to pass through to Auth0 in a property bag named `authorizationParams`. On top of that, any property outside of `authorizationParams` will now be using camel casing.

Here is what the configuration looks like in v2:

```javascript
const client = new Auth0Client({
  clientId: '...', // <= camelCasing
  useRefreshTokens: true,
  useRefreshTokensFallback: false,
  authorizationParams: { // <= new property bag
    redirect_uri: '...', // <= moved into authorizationParams
    custom_param: '...', // <= moved into authorizationParams
    screen_hint: 'signup' // <= moved into authorizationParams
  }
});
```

## `localOnly` Logout

In v1.x of the SDK, it was possible to pass a `localOnly` when calling `logout`. In the current release, we dropped the `localOnly` argument in favor of a new `onRedirect` event that allows for more control, including the possibility of not redirecting, and thus produces the same effect the `localOnly` property intended.

To replicate the `localOnly` behavior, you can implement the following:

```javascript
await client.logout({
  onRedirect: async (url) => {
    // Do not do anything
    // Or do something else but redirecting
  }
})
```

## Removed `buildAuthorizeUrl` and `buildLogoutUrl`

In v1.x, it was possible to use the methods `buildAuthorizeUrl` and `buildLogoutUrl` for applications that couldn't rely on `window.location.assign` to redirect to Auth0 when calling `loginWithRedirect` or `logout` respectively. A typical example of this was when developers needed to set a specific URL in the context of a mobile application using frameworks such as Ionic.

In v2, developers would rely on `onRedirect` to specify such behavior.

For example:

```javascript
await client.loginWithRedirect({
  async onRedirect(url) {
    // Redirect using Capacitor's Browser plugin
    await Browser.open({ url });
  }
});
```

## `getUser` and `getIdTokenClaims`

As part of our optimization efforts, we reworked the SDK's internal cache to store tokens. Consequently, it was possible to simplify the methods `getUser` and `getIdTokenClaims`.

In v1.x, developers could pass a specific scope and audience when calling either of those functions.

Here are some examples of how these functions were used in v1:

```javascript
const user = await getUser();
const user = await getUser({ audience, scope });

const claims = await getIdTokenClaims();
const claims = await getIdTokenClaims({ audience, scope });
```

However, as an application should only have one user, such parameters wouldn't be required. So from v2, we dropped those parameters and simplified the methods to:

```javascript
const user = await getUser();
const claims = await getIdTokenClaims();
```

## Retrieve a Token from the Cache

With v2, we are introducing the possibility of retrieving a token from the cache without contacting Auth0 if no entry is found. To achieve that, we reworked the already existing `ignoreCache` argument for `getTokenSilently`, which takes a boolean, to `cacheMode`, which can accept three values:

- **on** (default value): Use the cache, but call the `oauth/token` endpoint when no entry is found. This is the equivalent of when `ignoreCache` was omitted or its value was set to false in v1.
- **off**: Do not use the cache, always call the `oauth/token` endpoint. This is the equivalent of `ignoreCache: true` in v1.
- **cache-only**: Use the cache, do not call the `oauth/token` endpoint when no entry is found.

To use our SDK and see if we have a token in the cache without contacting Auth0, you must set `cacheMode` to `cache-only` when calling `getTokenSilently`.

```javascript
const token = await client.getTokenSilently({
  cacheMode: 'cache-only'
});
```

## URL Encoded Form Data

V1 of SPA-JS defaults to sending payloads using JSON when calling Auth0's `oauth/token` endpoint, but users can opt-in to send the data as `x-www-form-urlencoded` instead.

With the release of v2, we will default to sending the requests to the `oauth/token` endpoint using `x-www-form-urlencoded`, while users can opt-in to using JSON as needed. Using `x-www-form-urlencoded` has shown to have a small performance optimization and aligns more with what the [spec describes](https://datatracker.ietf.org/doc/html/rfc6749#section-3.2).

## Summary

The Auth0 Single Page App SDK v2 improves both the developer and the user experience. On the one hand, it simplifies and makes working with the SDK API easier. On the other hand, it reduces the bundle size, which translates into faster downloads and processing times.

Thanks for reading!

Auth0 SDK for Single Page Applications v2.0 released!

Let’s explore the new .NET 7 features for improving and simplifying authentication and authorization support in .NET applications.

The release of .NET 7 continues the simplification effort that began with .NET 5. Following this line, the new release provides .NET developers with a few features related to authentication and authorization that make .NET developers' lives a bit easier. Let's take a quick look at those features, which range from simplifications in authentication configuration to the addition of new authorization test tools, to improvements to Blazor's authentication support.

## Default Authentication Scheme

When you configure authentication for your application, you need to register the authentication service through `AddAuthentication()`. For example, the following is the code needed to configure `JwtBearer` as the authentication scheme in an ASP.NET Core Web API:

```csharp
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
     .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
     {
         options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
         options.TokenValidationParameters = 
           new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
             ValidAudience = builder.Configuration["Auth0:Audience"],
             ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
         };
     });
```

Although you are defining just one authentication scheme (`JwtBearerDefaults.AuthenticationScheme`), the  `AddAuthentication()` method requires that you specify the default scheme to use when it is not specified in your API endpoints (see [this document for more details on multiple authentication schemes in ASP.NET Core](https://learn.microsoft.com/en-us/aspnet/core/security/authorization/limitingidentitybyscheme?view=aspnetcore-6.0#use-multiple-authentication-schemes)).

Starting with .NET 7, the default scheme is no longer required when you define just one authentication scheme. It is automatically inferred by the framework. In practice, you can write the previous code as follows:

```csharp
builder.Services.AddAuthentication() //👈 no default scheme specified
     .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
     {
         options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
         options.TokenValidationParameters = 
           new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
             ValidAudience = builder.Configuration["Auth0:Audience"],
             ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
         };
     });
```

In case you need to restore the old behavior for any reason, you can disable the new feature using the following statement:

```csharp
AppContext.SetSwitch("Microsoft.AspNetCore.Authentication.SuppressAutoDefaultScheme", true);
```

## Simplified Configuration

One of the recurrent critiques of .NET authentication and authorization is its complexity (see [this thread](https://www.reddit.com/r/dotnet/comments/vttrib/is_auth_way_too_hard_in_net/) and [this one](https://social.msdn.microsoft.com/Forums/en-US/4d3844d5-9175-49ba-8c2f-8257f2c67639/authentication-and-authorization-is-too-complicated-too-abstract?forum=aspdotnetcore), for example). Actually, .NET provides developers with an articulate system for managing authentication and authorization. This system is great for the flexibility it offers, but it may be hard for a beginner to digest all the details. It may be hard even for a more experienced developer who is not used to dealing with the identity features every day.

To overcome this issue, the .NET team started an initiative aiming at simplifying the authentication and authorization configuration. The .NET 7 release introduces the first step in this direction, bringing you a simplified approach to configure ASP.NET Core Web APIs authorization based on access tokens in JWT format.

> Check out [this article to learn how to protect your ASP.NET Core Web API](https://auth0.com/blog/aspnet-web-api-authorization/).

If you ever had secured an ASP.NET Core Web API with Auth0, the following code should look familiar to you:

```csharp
using Microsoft.AspNetCore.Authentication.JwtBearer;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
     .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
     {
         options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
         options.TokenValidationParameters = 
           new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
             ValidAudience = builder.Configuration["Auth0:Audience"],
             ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
         };
     });

builder.Services.AddAuthorization();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();
```

Now, you can directly rely on the built-in configuration system to define your Web API's authorization options. In fact, in addition to default authentication schemes, .NET 7 automatically loads the options to configure the authentication service from the new  `Authentication` section of the `appsettings.json` configuration file. With this new feature, the code shown earlier becomes as follows:

```csharp
using Microsoft.AspNetCore.Authentication.JwtBearer;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication().AddJwtBearer(); //👈 new feature

builder.Services.AddAuthorization();

var app = builder.Build();
```

All the configuration settings are moved to the `appsetting.json` file as follows:

```json
{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  //👇 new section
  "Authentication": {
    "Schemes": {
      "Bearer": {
        "Authority": "https://YOUR_AUTH0_DOMAIN",
        "ValidAudiences": [ "YOUR_AUDIENCE" ],
        "ValidIssuer": "YOUR_AUTH0_DOMAIN"
      }
    }
  }
  //👆 new section
}
```

The new `Authentication` section keeps the configuration settings for any authentication scheme supported by your application, although currently only the `JwtBearer` scheme is supported.

Notice that now you don't need anymore to call `UseAuthentication()` and `UseAuthorization()`. The framework takes care of automatically adding the required middleware to the request pipeline.

## Authorization Policies for Specific Endpoints

ASP.NET Core allows you to specify policies to make more accurate authorization decisions based on the access token content or other advanced criteria. Usually, these policies are defined globally at the application level and attached to the endpoint definitions the policy applies to.

> Take a look at [this article to learn how to use policies to protect ASP.NET Core Web APIs](https://auth0.com/blog/permission-based-security-aspnet-webapi/), for example.

Defining policies globally is pretty good for reuse. However, sometimes you may need just a specific policy for one endpoint. In this case, you can specify your policy directly on the endpoint definition.

The following is an example of how you can use this new feature:

```csharp
app.MapGet("/api/special-endpoint", () => "A special endpoint!")
    .RequireAuthorization(p => p.RequireClaim("scope", "api:special"));
```

## The `user-jwts` Tool

Testing a token-protected Web API could be complex. You can easily use tools like curl or Postman, but you need to pass a valid access token along with your HTTP request. To get a valid access token, you usually need a working identity and access management system at your disposal, such as [Auth0](https://auth0.com/). You need to configure your API with this system and log in by providing valid credentials.

Auth0 allows you to test your registered API using a token issued directly in the [Auth0 dashboard](https://manage.auth0.com/), but you still need to register your application with Auth0.

.NET 7 brings a new CLI tool that helps simplify protected Web API testing: `user-jwts`. This tool is integrated with the .NET CLI and allows you to generate access tokens in JWT format. The tool is based on the same infrastructure as the [secret manager](https://auth0.com/blog/secret-management-in-dotnet-applications/) and enables your application to validate the generated access token. Basically, the following command allows you to generate a new access token:

```bash
dotnet user-jwts create
```

You can use this token with curl, Postman, or any other HTTP client to make your call to the protected endpoints of your Web API without the need to register your application with an actual identity and access management system.

Beyond the basic usage, the `user-jwts` tool allows you to customize your access token by specifying the scopes, custom claims, and other properties so that you can also test endpoints with access policies. See the [official documentation](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/jwt-authn) to learn more.

<include src="ebook-ads/dotnetIdentity" />

## Dynamic Authentication Requests in Blazor WASM

Blazor WebAssembly uses the `Microsoft.AspNetCore.Components.WebAssembly.Authentication` package to handle OpenID Connect authentication. This package allows you to statically define at the startup time how authentication will occur. However, there are scenarios where you may need to authenticate users at runtime with a different configuration. For example, you may need to perform [step-up authentication](https://auth0.com/docs/secure/multi-factor-authentication/step-up-authentication) or may want the user to change their account.

In .NET 7, Blazor WebAssembly supports the creation of dynamic authentication requests using the new `InteractiveRequestOptions` class and the `NavigateToLogin()` method of the `NavigationManager` object.

The following example shows the basic use of these new features:

```csharp
InteractiveRequestOptions requestOptions = new()
{
    Interaction = InteractionType.SignIn,
    ReturnUrl = NavigationManager.Uri,
};
NavigationManager.NavigateToLogin("authentication/login", requestOptions);
```

The `InteractiveRequestOptions` class also provides a way to add custom parameters to the authentication request. For example, consider [Auth0's `screen_hint` parameter](https://auth0.com/docs/authenticate/login/auth0-universal-login/new-experience#signup) that allows you to show the signup form instead of the default login form. You can send this parameter to Auth0 as shown below:

```csharp
InteractiveRequestOptions requestOptions = new()
{
    Interaction = InteractionType.SignIn,
    ReturnUrl = NavigationManager.Uri,
};
requestOptions.TryAddAdditionalParameter("screen_hint", "signup");
NavigationManager.NavigateToLogin("authentication/login", requestOptions);
```

## Blazor WASM Authentication Diagnostics

Detecting authentication issues is not easy, especially if you are running a WebAssembly code, as it happens with Blazor WebAssembly applications. The .NET 7 release tries to improve its support for authentication diagnostics by introducing the debug level for the `Microsoft.AspNetCore.Components.WebAssembly.Authentication` library. After [enabling logging for Blazor WebAssembly](https://learn.microsoft.com/en-us/aspnet/core/blazor/fundamentals/configuration?view=aspnetcore-7.0#logging-configuration), you can add the following setting in the `wwwroot/appsettings.json` configuration file to get detailed information about the authentication process:

```json
"Logging": {
    "LogLevel": {
        "Microsoft.AspNetCore.Components.WebAssembly.Authentication": "Debug"
    }
}
```

<include src="SignupCTA" text="Try out Auth0 authentication for free." linkText="Get started →" />

## Conclusion

Probably the new features introduced by .NET 7 to mitigate the complexity of authentication and authorization support will not drastically change your life as a developer. However, they confirm the effort Microsoft is making to simplify the use of its development platform. In the area of authentication and authorization, the commitment to reduce configuration complexity with an [initiative](https://github.com/dotnet/aspnetcore/issues/34545) that will continue in subsequent .NET releases looks pretty promising.

I hope that the combination of these and future simplifications will go in the right direction of making authentication and authorization integration into .NET applications less and less challenging.


What's New in .NET 7 for Authentication and Authorization

Learn about the essential features of the Auth0 Flutter SDK and how it helps developers build and secure Flutter iOS and Android applications.

Today we are announcing the release of the [Auth0 Flutter SDK](https://pub.dev/packages/auth0_flutter), a new SDK that makes it easy to secure Flutter applications with Auth0. Whether you need to secure access to an iOS or Android application, the Auth0 Flutter SDK got you covered!

The new Flutter SDK builds on a strong foundation by wrapping our existing and robust [Auth0.Android](https://github.com/auth0/Auth0.Android) and [Auth0.swift](https://github.com/auth0/Auth0.swift) libraries while focusing on the developer experience first.

Our SDK team optimized the Auth0 Flutter SDK for quick integration into your applications and for flexibility to accommodate simple and advanced use cases.

Since the introduction of [Flutter 3](https://medium.com/flutter/introducing-flutter-3-5eb69151622f), the framework allows for building cross-platform applications, extending from mobile applications to desktop applications and platforms. Our SDK allows for extension in such platforms by leveraging federated plugins, which means you can easily add support for other platforms without forking the SDK.

## Auth0 Flutter SDK Features

The new SDK offers features for multiple use-cases and complexity, going from magically getting the job done to providing a rich set of APIs enabling you to build your authentication flow per your specific requirements.

Let's explore the essential features of the Auth0 Flutter SDK that enable developers to do more:

- ⚡️ Quick implementation of login, logout, and automatic storage and renewal of tokens functionality into Flutter apps using WebAuth and the [Auth0 Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login) page.
- ⚙️ For more advanced use-cases, developers have access to the [Authentication API](https://pub.dev/documentation/auth0_flutter/latest/auth0_flutter/AuthenticationApi-class.html), which at the time of release supports:
	- Logging in with a username or email and password
	- Signing up new users
	- Getting user information from `/userinfo`
	- Renew tokens
	- Reset passwords
- 🔐 Auth0 provides a default instance of [Credentials Manager](https://pub.dev/documentation/auth0_flutter/latest/auth0_flutter/DefaultCredentialsManager-class.html) that automatically stores the user's credentials. If you need your own solution for handling credentials, you can create your own [custom credentials manager](https://pub.dev/documentation/auth0_flutter/latest/auth0_flutter/CredentialsManager-class.html).
- ➕ And more [advanced features](https://pub.dev/packages/auth0_flutter#advanced-features) like accepting user invites, login into organizations, and bot detection.

## Requirements

The Auth0 Flutter SDK doesn't require any other library to work. However, there are SDK version and platform requirements for your project:

<table style="width:100%" cellspacing="2" cellpadding="5">
    <thead>
        <tr style="border-bottom: solid 1px">
            <td>**Flutter**</td>
            <td>**Android**</td>
            <td>**iOS**</td>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>SDK 3.0+</td>
            <td>Android API 21+</td>
            <td>iOS 12+</td>
        </tr>
        <tr>
            <td>Dart 2.17+</td>
            <td>Java 8+</td>
            <td>Swift 5.3+</td>
        </tr>
        <tr>
            <td></td>
            <td></td>
            <td>Xcode 13.x / 14.x</td>
        </tr>
    </tbody>
</table>

Check the [project on GitHub](https://github.com/auth0/auth0-flutter/tree/main/auth0_flutter#requirements) to for the most up-to-date set of requirements.

## Installing the SDK

The Auth0 Flutter SDK is distributed via [pub.dev](https://pub.dev/packages/auth0_flutter).

To add the SDK, run the following command from the root directory of your project:

```bash
flutter pub get auth0_flutter
```

## Adding Universal Login to Your Flutter Application

Adding the full-featured [Auth0 Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login) authentication page to your application is easy with the SDK.

Please explore the [Flutter Quickstart guide](https://auth0.com/docs/quickstart/native/flutter/interactive) to see in detail how to set up your Flutter application to use the Auth0 SDK. For now, let's take a quick peak at how the Flutter SDK integration goes!

### Add login to your app

Integrate Auth0 Universal Login in your Flutter app by using the Auth0 class. Redirect your users to the Auth0 Universal Login page using `webAuthentication().login()`. This is a `Future` and must be awaited for you to retrieve the user's tokens.

```dart
await auth0.webAuthentication(scheme: 'YOUR CUSTOM SCHEME').login();
```

### Add logout to your app

Logging out users is as easy as calling the Auth0 Flutter SDK `webAuthentication().logout()` function. The `logout()` function is responsible for calling the `logout` endpoint to clear their login session and to clear the user login state from the device session.

```dart
await auth0.webAuthentication(scheme: 'YOUR CUSTOM SCHEME').logout();
```

## Next Steps

There are a lot of options to work with with the SDK, and in this post, we only barely scratch the surface of it. If you want to learn more about the SDK, please check out the [quick start guide](https://auth0.com/docs/quickstart/native/flutter/interactive) and the [SDK documentation](https://pub.dev/packages/auth0_flutter).

Thanks for reading!

Introducing the Auth0 Flutter SDK

philippederyck

Philippe De Ryck helps developers protect companies through better web security. His Ph.D. in web security from KU Leuven lies at the basis of his exceptional knowledge of the security landscape. As the founder of Pragmatic Web Security, Philippe delivers security training and security consulting to companies worldwide. His online course platform allows anyone to learn complex security topics at their own pace. Philippe is a Google Developer Expert and an Auth0 Ambassador/Expert for his community contributions on the security of web applications and APIs.

Web Security Expert, Founder of Pragmatic Web Security

Philippe De Ryck

Single Page Applications clash with modern CSP features. In this article, we discuss concrete strategies for securing SPAs with CSP.

The recommended best practice for modern CSP policies relies on hashes, nonces, and `'strict-dynamic'`. Unfortunately, these features conflict with modern SPAs. This article proposes three concrete strategies to deploy secure CSP policies for SPAs. The first relies on a simple policy allowing `'self'`, which is acceptable under certain circumstances. The second strategy enables CSP hashes by rewriting the main page to use a script loader. The third strategy inserts nonces into a dynamically served main page.

## Recapping CSP

The [first article in this series](https://auth0.com/blog/defending-against-xss-with-csp/) offered an in-depth look at using CSP as a second line of defense against XSS attacks. 

We covered the configuration of CSP using URL-based entries but also [highlighted why such policies are often insecure](https://auth0.com/blog/defending-against-xss-with-csp/#CSP-is-Dead--Long-Live-CSP). In response, we discussed [Google's "universal CSP policy"](https://auth0.com/blog/defending-against-xss-with-csp/#Google-s-Universal-CSP-Policy), shown below, which offers an excellent trade-off between security and complexity: 

```
Content-Security-Policy: 
  script-src 'report-sample' 'nonce-3YCIqzKGd5cxaIoTibrW/A' 'unsafe-inline'
             'strict-dynamic' https: http: 'unsafe-eval';
  object-src 'none';
  base-uri 'self';
  report-uri /webchat/_/cspreport
```

This policy relies on nonces to identify an initial set of legitimate script blocks and script files in the page. Once these scripts execute, they can rely on the automatic trust propagation mechanism of `'strict-dynamic'` to load additional scripts.

Unfortunately, this type of policy does not work well with Single Page Applications, as we pointed out in the [conclusion of the first article](https://auth0.com/blog/defending-against-xss-with-csp/#Using-CSP-with-SPAs).

So, what is up with that? Let's take a look at the challenges of configuring CSP in SPAs and discuss a couple of solutions.

## The Challenges with SPAs

Single Page Applications load a single `index.html`, which then bootstraps the necessary JavaScript code to launch the application. The code snippet below shows the `index.html` page of an Angular application:

```html
<!doctype html>
<html lang="en">
<head>
  ...
</head>
<body>
  <app-root></app-root>
  <script src="runtime.7b63b9fd40098a2e8207.js" defer></script>
  <script src="polyfills.00096ed7d93ed26ee6df.js" defer></script>
  <script src="main.8e56a2a77fee2657fb91.js" defer></script>
</body>
</html>
```

To deploy CSP in a SPA, we first have to tell the browser that the application's JavaScript bundle is a legitimate resource that can be loaded. In the snippet above, the bundle consists of three separate JavaScript files.

One way to do that is by approving scripts coming from the application's origin (`https://example.com`). A policy with a `script-src https://example.com` directive would allow the loading of these files.

Unfortunately, as we discussed in the [previous article](https://auth0.com/blog/defending-against-xss-with-csp/), such URL-based policies are often insecure and are deprecated. Additionally, URL-based expressions cannot be used together with `'strict-dynamic'`, which prevents the use of automatic trust propagation.

One alternative is the use of hashes, a CSP Level 2 feature. However, the application's JavaScript bundle is hosted as a remote file, and hashes only work on inline code blocks. So CSP hashes are not compatible with SPAs.

CSP Level 2 also supports nonces, which are compatible with the loading of remote resources. However, [one requirement for nonces](https://auth0.com/blog/defending-against-xss-with-csp/#CSP-Level-2) is that they are unique on every page load. In essence, this means that the server has to inject a fresh nonce every time it serves a page. Doing so is easy for dynamic server-side applications but not very compatible with serving a static `index.html` file for a SPA. So nonces are also not compatible with SPAs.

With both hashes and nonces out, there is no straightforward way for SPAs to use modern CSP policies. Additionally, they are incapable of using `'strict-dynamic'` for loading additional scripts. The lack of support for `'strict-dynamic'` makes it impossible to reliably incorporate third-party components such as a Twitter timeline.

Right about now, I'm sure you're somewhat disappointed with CSP, and righteously so. But don't worry, we're only getting started. Let's take a look at three concrete strategies to implement CSP in a SPA.

## Keep It Simple

The first strategy for enabling CSP in SPAs is straightforward. If the SPA only needs to load its application bundle and no third-party resources, the following CSP policy could be a very simple solution:

```
script-src 'self'
```

This policy allows the application to load JavaScript files from its own origin. Such a policy suffices to load all of the additional resources of an isolated, self-contained application. You will often encounter such applications in enterprise settings, where the dynamic integration of remote components is less common.

But weren't URL-based policies ineffective and open to bypasses?

Yes, they are, under the right circumstances. [The paper](https://research.google/pubs/pub45542/) that described numerous bypass attacks against CSP outlines a few scenarios where approving `'self'` is problematic. For example, CSP can be bypassed if ...

* The application's origin also hosts vulnerable libraries
* The application's origin also hosts JSONP endpoints
* The application's origin hosts untrusted files uploaded by users

However, these threats are not an issue if the application's origin contains nothing else but the statically deployed application bundle. And if there are no bypasses, this policy is still considered secure. 

> To summarize, if you're building an isolated SPA with nothing else running in the same origin, this policy is a straightforward way to deploy CSP.

However, if you rely on third-party components, you will likely need to support `'strict-dynamic'`. In that case, you can rely on one of the following two strategies.

## Using `'strict-dynamic'` with Hashes

When a policy is configured with `'strict-dynamic'`, all script code approved by a hash or a nonce is allowed to load additional dependencies. This mechanism is extremely useful to allow a third-party component to load additional code or to enable lazy-loading of application components.

Unfortunately, `'strict-dynamic'` causes browsers to ignore URL-based entries, so it cannot be used in conjunction with `'self'`. This means that when we enable `'strict-dynamic'`, we have to find a different way to allow the loading of the application's bundle. 

Loading the bundle with hashes is not an option because hashes cannot be used with remote code files. Instead, we can modify the `index.html` file to include an inline code block, which we can approve with a hash. This inline code block contains a script loader, which uses proper DOM APIs to load additional script code. This behavior is automatically approved by having `'strict-dynamic'` in the policy. 

The code snippets below show the modified `index.html` of an Angular application and the corresponding CSP policy. The HTML page contains two code blocks: The script loader and the code for loading a Twitter timeline. The corresponding CSP policy approves both blocks with a hash:

```html
<!doctype html>
<html lang="en">
<head>
  ...
</head>
<body>
  <app-root></app-root>
  <script>
    let scripts = ["runtime.7b63b9fd40098a2e8207.js", "polyfills.00096ed7d93ed26ee6df.js", "main.8e56a2a77fee2657fb91.js"];
    scripts.forEach(function(scriptUrl) {
      var s = document.createElement('script');
      s.src = scriptUrl;
      s.async = false; // preserve execution order.
      document.body.appendChild(s);
    });
  </script>
  <script>
    window.twttr = (function(d, s, id) {
      ...
    }(document, "script", "twitter-wjs"));
  </script>
</body>
</html> 
```

```
Content-Security-Policy: script-src 
  'sha256-qaOxCJong9pt6ICami7oNScwNCv2sn3HUTzbEaQ3vrU=' 
  'sha256-BYW1ZgvEbfyQi82B604a0EdxK+Od5iqb/I2hgknBhiw='
  'strict-dynamic'
```

This workaround is not pretty but quite effective: It enables a modern CSP policy on a statically deployed SPA. At the time of writing, the [strict-csp](https://www.npmjs.com/package/strict-csp) package offers experimental support for transforming any HTML file to use a script loader as described here. This package is also available as a [webpack plugin](https://www.npmjs.com/package/strict-csp-html-webpack-plugin). Of course, you can also perform this task in a more manual fashion.

> To summarize, adding an inline script loader enables the use of hashes and `'strict-dynamic'`.

Finally, note that CSP Level 3 may support the use of hashes for remote code files. However, at the time of writing, (widespread) support for that feature is still far off.

## Using `'strict-dynamic'` with Nonces

Nonces are a more flexible alternative to hashes, as they can also be used on remote script files. Nonces are also quite compatible with `'strict-dynamic'` but must be unique on every page load. Unfortunately, that requirement clashes with a statically deployed `index.html`.

To enable the use of nonces in a SPA, we have to serve our `index.html` dynamically to insert a fresh nonce in each response. This process sounds complicated but is not that difficult in practice.

The code example below shows a minimal NodeJS Express server that dynamically serves our main Angular application file. The Express server uses the [express-csp-header](https://www.npmjs.com/package/express-csp-header) middleware to configure a policy and handle nonce generation. The nonce is passed along to the view rendering engine, which inserts it into the page. The modified `index.html`, now stored as `index.ejs`, is included below:

```javascript
const express = require("express");
const { expressCspHeader, NONCE } = require('express-csp-header');

const app = express();
const port = 3000;

app.set('view engine', 'ejs');

 app.use(expressCspHeader({
   directives: {
       "script-src": [NONCE, "'strict-dynamic'"]
   }
}));

// Rewrite index.html
app.get("/", (req, res) => {
  res.render(`views/index`, { nonce: req.nonce });
})

app.listen(port, () => {});
```

```html
<!doctype html>
<html lang="en">
<head>
  ...
</head>
<body>
  <app-root></app-root>
  <script nonce="<%= nonce %>" src="runtime.7b63b9fd40098a2e8207.js" defer></script>
  <script nonce="<%= nonce %>" src="polyfills.00096ed7d93ed26ee6df.js" defer></script>
  <script nonce="<%= nonce %>" src="main.8e56a2a77fee2657fb91.js" defer></script>

  
  <script nonce="<%= nonce %>">
    window.twttr = (function(d, s, id) {
      ...
    }(document, "script", "twitter-wjs"));
  </script>
</body>
</html>
```

At first glance, running a dynamic server for serving a SPA seems quite complicated. However, if you take a closer look, the Express server is quite simple. Additionally, it is completely stateless, making it easy to deploy as a stateless function on various cloud platforms. 

Note that only the main HTML file needs to be served dynamically. All other resources, such as JS or CSS files, can still be served statically.

>  To summarize, serving `index.html` dynamically enables the use of nonces and `'strict-dynamic`'.

<include src="ebook-ads/WebSecurity" />

## Overview of CSP for SPAs

In a nutshell, deploying modern CSP policies with SPAs is perfectly feasible, albeit with a bit more effort than you would expect. 

In this article, we covered two scenarios: isolated applications and more complex applications with dynamic code loading. We recap our recommendations for both scenarios below.

### Isolated applications without third-party components

Use a simple `'self'` policy that approves the application's origin. Note that this policy is only secure if nothing else is hosted in the application's origin.

### Applications relying on third-party components

To enable the use of `'strict-dynamic'`, initial scripts must be approved with a hash or a nonce. To use hashes, the SPA's main page has to be rewritten at build time, but can be served statically. To use nonces, the SPA's main page requires slight modifications at build time and has to be dynamically served by a web server.

<include src="SignupCTA" text="Try out the most powerful authentication platform for free." linkText="Get started →" />

## Coming Up Next

I know you're excited to get started. But before you dive into CSP yourself, take a look at the next article in this series, where we offer practical tips and tricks for deploying CSP.

Deploying CSP in Single Page Applications

332d7898dae6bc56031ac3507a0248ba

I'm a full-stack developer with a passion for technology and code. I love writing tutorials for developers to showcase a particular technology whilst building something useful at the same time. Right now  I can mostly be found developing for the front-end, playing around with Docker, or tinkering with Unreal Engine and electronics!

Developer Experience Engineer

Steve Hobbs

Learn about the essential features of the Auth0 Vue SDK and how it helps developers secure Vue 3 apps.

Today, we are announcing the release of the [Auth0 Vue SDK](https://www.npmjs.com/package/@auth0/auth0-vue), a new SDK that makes it easy to integrate Auth0 with any Vue 3 apps. This new SDK only supports Vue 3 apps. To secure Vue 2 (Vue.js) apps, developers can use the [Auth0 SPA SDK](https://auth0.com/docs/libraries/auth0-single-page-app-sdk) instead.

[Vue.js](https://vuejs.org/) is a progressive JavaScript framework designed for building user interfaces using HTML, JavaScript, and CSS. It makes building apps for the modern web easy while providing developers with a lot of flexibility.

The Auth0 Developer Experience team designed the new [Auth0 Vue SDK](https://github.com/auth0/auth0-vue) to follow idiomatic patterns that are familiar to Vue developers. The Vue SDK abstracts the features of the [Auth0 SPA SDK](https://github.com/auth0/auth0-spa-js) into a Vue plugin that developers can consume in Vue 3 components either using the Options API or the new Composition API.

Starting today, Vue developers can:

- [Install the `auth0-vue` package from `npm`](https://www.npmjs.com/package/@auth0/auth0-vue)
- [View the Auth0 Vue SDK source code on GitHub](https://github.com/auth0/auth0-vue)
- [Read and follow the quickstart](https://auth0.com/docs/quickstart/spa/vuejs)
- [Grab the sample apps](https://github.com/auth0-samples/auth0-vue-samples)

## Auth0 Vue SDK Features

This new Auth0 Vue SDK arrives at a great time as Evan You announced on February 7th, 2020, that [Vue 3 is now the default version of Vue](https://blog.vuejs.org/posts/vue-3-as-the-new-default.html). As such, the Auth0 Vue SDK fully supports Vue 3 along with the Options API and the Composition API. The SDK also provides full TypeScript support.

Here’s a breakdown of the essential features that developers can enjoy when using the new Auth0 Vue SDK:

- Quick implementation of login and logout functionality into Vue 3 apps using the [Auth0 Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login) page.
- Easy access to profile information about the logged-in user.
- Availability of access tokens to retrieve protected user data from an external API.
- Simple mechanism to protect Vue 3 routes using a router guard from the SDK with the [Vue Router](https://next.router.vuejs.org/).

## Vue 2 Auth0 SDK Support

The new Auth0 Vue SDK only works with Vue 3. If you’re working on an app that uses Vue 2, you can use the [Auth0 SPA SDK](https://auth0.com/docs/libraries/auth0-single-page-app-sdk) instead to implement authentication in your application.

To see the integration of Vue.js (Vue 2) with the Auth0 SPA SDK in action, take a look at the ["Vue.js/JavaScript Authentication" code sample](https://auth0.com/developers/hub/code-samples/spa/vue-javascript/basic-authentication) from the 
 [Auth0 Developer Hub](https://auth0.com/developers/hub/code-samples/spa/vue-javascript)!

## Integrate Auth0 Vue into Your Vue 3 Application

You can quickly integrate the Auth0 Vue SDK with your Vue 3 application by following a few steps.

If you don’t already have an Auth0 application to work with, create a Single Page Application in your [Auth0 Dashboard](https://manage.auth0.com/) and configure the following URLs for your application under **Application URLs**:

- **Allowed Callback URLs**: `http://localhost:8080`
- **Allowed Logout URLs**: `http://localhost:8080`
- **Allowed Web Origins**: `http://localhost:8080`

You can replace `http://localhost:8080` with the root URL of your application.

Take note of the **Client ID** and **Domain**, as you will need those in the next step.

Install the Auth0 Vue SDK from npm:

```bash
npm install @auth0/auth0-vue
```

Import the Vue plugin and use the `createAuth0` function to register it with your Vue 3 app:

```javascript
import { createAuth0 } from '@auth0/auth0-vue';

const app = createApp(App);

app.use(
  createAuth0({
    domain: '<YOUR AUTH0 DOMAIN>',
    client_id: '<YOUR AUTH0 CLIENT ID>',
    redirect_uri: window.location.origin,
  }),
);

app.mount('#app');
```

Replace the `<YOUR AUTH0 DOMAIN>` and `<YOUR AUTH0 CLIENT ID>` placeholders with the actual **Client ID** and **Domain** values you got from the Auth0 dashboard.
Create a `LoginButton.vue` component and use the Auth0 Vue SDK to log the user in. Here’s an example using a [Single File Component](https://vuejs.org/guide/scaling-up/sfc.html) and the Composition API:

```js
// LoginButton.vue
<template>
  <button @click="login">Log in</button>
</template>

<script>
import { useAuth0 } from "@auth0/auth0-vue";

export default {
  setup() {
    const { loginWithRedirect } = useAuth0();

    return {
      login() {
        loginWithRedirect();
      },
    };
  },
};
</script>
```

If you prefer to use the Options API, the same thing can be achieved using the `$auth0` accessor:

```js
<template>
  <button @click="login">Log in</button>
</template>

<script>
export default {
  methods: {
    login() {
      this.$auth0.loginWithRedirect();
    },
  },
};
</script>
```

Add a `LoginComponent` to your app, start it up, and click the button to see the magic of authentication!

Please check out [the Quickstart](https://auth0.com/docs/quickstart/spa/vuejs) for more things you can do with the SDK and the [repository on GitHub](http://github.com/auth0/auth0-vue) for a more detailed description of the setup and usage of the SDK.

Enjoy!

Introducing the Brand-New Auth0 Vue SDK

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

The software’s latest features will help users bolster their data security.



If you happened to catch Apple’s initial June 4, 2018 announcement of iOS 12, you might have noticed that it was lacking the “big splash” that we’ve seen from other iOS announcements. That’s partially because Apple was so busy focusing on new iOS 12 data security features.

Though more is to be unveiled at the September 12, 2018 Apple Keynote event, many of the features of iOS 12 that have been revealed likely won’t catch the average consumer’s attention. That’s intentional. Good data security features are relatively unnoticeable to most users. If anything, those features in Apple’s newest mobile OS will make life a little bit easier for the average iPhone user.

But, if you happen to be an IT or security pro, the new iOS 12 probably piqued your interest.

This emphasis on personal data privacy and security from Apple prompts one question: is iOS 12 the most secure operating system Apple has ever released?

In a word, yes. Let’s dig into what makes it so secure.

## Better Anti-Hacking Technology for Data Privacy

One of the biggest changes Apple is making to the new iOS’s security is the introduction of USB Restricted Mode. 

On iOS 11 and earlier iOS versions, USB-based communications stay active for up to seven days after the phone is locked. This means that if an iPhone is stolen, the would-be hackers have seven days to plug a brute force device, such as GrayKey, into the phone and force it to unlock.

_[The New York Times](https://www.nytimes.com/2018/06/13/technology/apple-iphone-police.html)_ calls this seven-day window a massive security vulnerability in iOS 11.

The good news is that Apple is closing this window. With USB Restricted Mode on iOS 12, Apple is reducing the time for USB-based communications to just one hour after the phone is locked. 

That makes a brute force attack on iOS 12 nearly impossible. According to one app developer we talked to, “USB Restricted Mode essentially turns the phone into a battery-powered brick after one hour.” Unless the phone is unlocked by an authorized user in that hour timeframe, it’s useless to would-be hackers.

To illustrate this further, if an employee at your company has their iPhone stolen with iOS 11 on it, there’s a very good chance the thief will be able to gain access to the phone within seven days. However if iOS 12 is installed, the thief will only have one hour to attempt a brute force attack. The chances of that being accomplished in an hour are very unlikely. 

This data privacy feature is automatically turned on in the new OS, but Apple does give you the option of disabling it:

![Turn USB Restricted Mode Off in iOS 12](https://images.ctfassets.net/23aumh6u8s0i/43Cy7OyrsRaEn2felz1YVf/dce0db81be1260e1be29ba15fad941c2/ios12-usb-restricted-mode-off)

_[Image Source](https://www.macrumors.com/how-to/access-controls-usb-restricted-mode-ios-12/)_

We're excited by both the strength and flexibility of this for greater personal data security.

## Password Reuse Auditing

As is the case with any data security system, humans are the weakest link. If you develop the best tools in the world but the actual human operators aren’t using it, then it’s worthless.

That’s why Apple is trying to make password management as simple as possible in iOS 12. One of the features that makes this easier is Password Reuse Auditing. This feature monitors the passwords that iPhone owners use for different services. When it catches someone [using the same password on different websites](https://www.godaddy.com/garage/10-best-practices-for-creating-and-securing-stronger-passwords/), it flags the duplicate, offers a more secure password, and then saves it to the iCloud Keychain.

![iOS 12 Password Autofill - Password Reuse Auditing flag present on online service](https://images.ctfassets.net/23aumh6u8s0i/4xFwJwR593h6HlGI5SjAo/59a1d22b1766872c1ecc233dcf3a8cac/ios-12-password-reuse-auditing-flag-present-on-online-service)

_[Image Source](https://www.macrumors.com/how-to/automatic-passwords-and-auditing-in-ios-12/)_

The issues with using one password across different websites are well documented. Security experts have been trying to get around these issues for years and Apple is doing their best to help. Auth0 offers secure authentication using [token-based, passwordless authentication](https://auth0.com/passwordless) that features a brute-force protection system.

### iCloud: The Elephant in the Room

At first glance, this iOS 12 security feature seems slightly less secure. For this feature to work, Apple has to record your current passwords and be able to crawl them for matches. While at the same time, Apple stores everything in the iCloud. 

That concern caused Apple to make this system as secure as possible. This feature uses a highly secure 256-bit AES for encryption. 256-bit AES is nearly impossible to crack. It’s actually the same encryption standard that the US government uses to transmit top secret data. It seems that Apple is pretty serious about security. 

In addition to using the uncrackable 256-bit AES, Apple also recommends users enable two-factor authentication for their iCloud Keychain. That combination makes it extremely unlikely that some nefarious individual would be able to compromise the iCloud. 

Speaking of two-factor authentication…

## Making Two-Factor Authentication Easier

_[Two-Factor Authentication](https://auth0.com/learn/two-factor-authentication/)_ (2FA) is the next big security feature in iOS 12. 

For years, data privacy experts have been begging and pleading with website users to set up 2FA. It's one of the best ways to [protect individuals and small teams from cyber attacks](http://blog.idonethis.com/security-ringcaptcha/). Adoption has still been relatively low because 2FA adds an extra step for users.

The most common type of Two-Factor Authentication is SMS text message 2FA. This authentication protocol sends users a text with a passcode before they are granted access to a system.

The problem is, it requires a lot of switching back and forth between apps to get the code, memorize the code, and then plug it into the app. And, if the user mistypes or misremembers the code, then it's back to square one.

Luckily, Apple is coming to the rescue. With iOS 12, SMS security codes will autofill without the user having to switch from app to app. No memorization, either. It does this by making specific API calls to the messaging app. When iOS 12 recognizes an SMS 2FA security code, it will automatically pull it into autofill for the user. 

![iOS 12 SMS 2FA security code and autofill example](https://images.ctfassets.net/23aumh6u8s0i/5fZy2u7OvyQocoyZ7jLsLh/225753ebf85204d06fa4e6ddc2ad7feb/ios-12-recognizes-an-sms-2fa-code-and-autofills-it-for-user)

There is one downside here. It has been well established that SMS 2FA can be compromised. We recently mentioned this _[in a post about a Reddit data breach](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/)_. Even still, any 2FA is better than no 2FA. With Apple including this feature in iOS 12’s security, they’ve made users significantly less prone to hacking.

## What Else is New in Data Security for iOS 12?

There are a few other security features worth mentioning in iOS 12. First up is group video chat. What makes this a security feature? Facetime is fully encrypted and extremely secure. Adding group chat to Facetime simply means that Apple is now supporting fully encrypted group chats. 

Apple also introduced a new Face ID feature. The tech company is giving iPhone owners the ability to add a “second face.” This allows two different users to unlock an iPhone using Face ID. We’ve covered the _[security of Face ID](https://auth0.com/blog/is-faceid-really-secure/)_ is another blog post. It’s good to see Apple improving upon this feature.

## Final Thoughts iOS 12 Release

We’re really impressed with Apple’s new iOS 12 security features. Not only are they making the operating system more secure, they’re making security easier to use. That combination is one that security experts are always after. Be looking for "A new iOS update is now available" as iOS 12 will be released soon.

<include src="asides/AboutAuth0" />


Apple iOS 12: Is it the Most Secure iOS Ever?

What's new in .NET 6? What are the main relevant features brought by the new version of the .NET platform? Let's take a quick look.

With the release of .NET 6, Microsoft consolidates its plan to create a unified platform to develop applications for any device and operating system. Together with this vision, .NET 6 brings many new features aiming to simplify development and gain performance. Let's take a quick look at the main points.

## Unified Platform Support
The vision of a [unified platform for the .NET world started with .NET 5](https://auth0.com/blog/dotnet-5-whats-new/). That release was meant to be the unified successor of [the various .NET flavors: .NET Framework, .NET Standard, .NET Core, Mono](https://auth0.com/blog/navigating-dotnet-maze/), etc. Beyond this goal, .NET 5 wanted to be a development platform to create any kind of application for any platform. However, at that time, an important piece was missing to complete the puzzle: a unified framework to create cross-platform UIs. Now, with [.NET MAUI](https://devblogs.microsoft.com/dotnet/announcing-net-maui-preview-10/), i.e., the **.NET Multi-platform App UI** framework, the puzzle is complete. Although at the time of writing [.NET MAUI is in preview](https://devblogs.microsoft.com/dotnet/announcing-net-maui-preview-10/), it is mature enough to be considered part of the .NET 6 release.

Now with .NET 6, you can really create the application you want and run it practically everywhere: from desktop to mobile, from the web to the cloud.

![.NET 6 unified platform](https://images.ctfassets.net/23aumh6u8s0i/GOa5gfL6LckpRRhqaBRJe/69341464075cbd46cf88fcbe36af4aa5/dotnet-unified-platform.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6/)]
</p>

In particular, the new [.NET MAUI](https://github.com/dotnet/maui) framework allows you to build desktop and mobile native user interfaces with a single codebase.

![.NET MAUI overview](https://images.ctfassets.net/23aumh6u8s0i/4WkvXpMRwu7j5T82HiW04A/069649d85ea4e1def0831672b5fc8698/dotnet-maui-overview.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/introducing-net-multi-platform-app-ui/)]
</p>

## Simplified Development
One of the main goals of the .NET 6 release is to provide developers with features that simplify their work. You can find support for simplified development throughout the platform, but three contexts are really exciting: new C# features, Hot Reload support, and minimal web APIs.

### C# 10 features
.NET 6 brings you [C# 10 with plenty of new features](https://devblogs.microsoft.com/dotnet/welcome-to-csharp-10/) that help you write code more easily. Let's take a quick look at a few of them.

#### Global and implicit usings

As a C# developer, you know how annoying it is to declare the same namespace in every file of your project. Consider, for example, the `System` namespace. Its use is very common, and I'm pretty sure you forget it all the time and let Visual Studio suggest it.

Now you can declare namespaces using a global `using`, as shown in the following example:

```csharp
global using System;
```

With this declaration, you don't need to insert the `using System;` declaration in all files anymore. You can declare a namespace through `global using` in any file, and it will be available in the entire project.

If you prefer (and I think it's a good practice), you can declare your namespaces in a file named `GlobalUsings.cs`.

You can also take advantage of implicit `using`s by configuring the `<ImplicitUsings>` element in your `.csproj` file, as shown below:

```xml
<PropertyGroup>
    
    <ImplicitUsings>enable</ImplicitUsings>
</PropertyGroup>
```

This way, the compiler will automatically add the required `global using` directives based on the type of your project.

#### New namespace syntax

You know that the usual way to declare a namespace is as follows:

```csharp
namespace Geometry
{
  class Triangle 
  {
    // ...class members...
  }
}
```

Now you can use the file-scoped namespace syntax to get the same result:

```csharp
namespace Geometry

class Triangle 
{
  // ...class members...
}
```

With this approach, everything you define in the current file belongs to the declared namespace. By removing a nesting level, you make the code a bit cleaner. However, you can't create nested namespaces with this new syntax.

#### Natural types for lambda expressions

Consider the following assignment of a lambda expression to a variable:

```csharp
Func<string, int> parse = (string s) => int.Parse(s);
```

You need to declare the target type of the lambda expression, `Func<string, int>` in the example. Starting with C# 10, you can write the above code as follows:

```csharp
var parse = (string s) => int.Parse(s);
```

The compiler will try to infer the "natural" type of the lambda expression.

### Hot Reload
To improve the developer's productivity, .NET 6 extends [the Hot Reload feature](https://devblogs.microsoft.com/dotnet/announcing-net-6/#hot-reload) to Visual Studio and almost any type of project. It allows you to run an application in your development environment, make changes, and get the changes applied without stopping, rebuilding, and rerunning the application.

In previous .NET releases, this feature was available just for the .NET CLI via the `dotnet watch` command. Not without [some minor hiccups with the community](https://www.theverge.com/2021/10/22/22740701/microsoft-dotnet-hot-reload-removal-decision-open-source), you can now benefit from it in [Visual Studio 2022](https://devblogs.microsoft.com/dotnet/update-on-net-hot-reload-progress-and-visual-studio-2022-highlights/#improved-user-experience-in-visual-studio-2022) as well by simply clicking a button:

![Visual Studio 2022 Hot Reload button](https://images.ctfassets.net/23aumh6u8s0i/3wu09sA8C4IQ5uKfmGoITK/e13d618f3f497e72281665de780b472d/vs2022-hot-reload-button.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/update-on-net-hot-reload-progress-and-visual-studio-2022-highlights/)]
</p>

### Minimal web APIs
One astonishing feature introduced by .NET 6 to simplify your code is [minimal web APIs](https://docs.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis). Along the lines of top-level statements, now you can build a fully working web API application with a few lines of code. Consider the following sample:

```csharp
//Program.cs
var app = WebApplication.CreateBuilder(args).Build();

app.MapGet("/", () => "Hello World!");
app.Run();
```

This is all the code you need to run a simple *Hello World!* web API.

If you have some experience building web APIs with ASP.NET Core, you know that you usually need a more articulate project. You need at least a `Program.cs` file with the setup code for the application, a `Startup.cs` file where you configure your API, and a controller class defining the API routes and implementing the endpoints.

That's a lot of simplification!

## Performance Improvements
In the last years, the .NET team put a lot of effort into improving the platform performance in compiling and execution time and reducing memory consumption. With .NET 6, you can appreciate these improvements in many parts of the framework. For example, the effort to [improve inner-loop performance](https://github.com/dotnet/core/issues/5510) in building .NET projects has given awesome results, as you can see from the following diagram:

![dotnet6-build-improvements](https://images.ctfassets.net/23aumh6u8s0i/2ZVS4o4DKc6OroBO0Lb76b/187a5cbf18d934d9a1cefae71f1535f5/dotnet6-build-improvements.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6-preview-2/)]
</p>

Other performance improvements include the IO subsystem. For example, the `FileStream` class [was almost completely rewritten](https://devblogs.microsoft.com/dotnet/file-io-improvements-in-dotnet-6/) with amazing results even with respect to .NET 5, as the following table summarizes for the writing operation:

![FileStream performance improvement](https://images.ctfassets.net/23aumh6u8s0i/6RgFjbKytdIQk6pHtEaHxT/1d524bb8a02e4688979d71f3151aef3f/filestream-performance-improvement.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6/)]
</p>
You can check out [a detailed report on performance improvements in .NET 6](https://devblogs.microsoft.com/dotnet/performance-improvements-in-net-6/) with related benchmarks for more information.

## Summary

This quick overview of .NET 6 shows that this is a consolidation release of the .NET platform. It aims to complete the unified platform vision started with .NET 5, improves the internals of the platform to provide the best performance, and starts a process of development simplification that probably will go further in future releases.

<include src="asides/DotNetCore" />

.NET 6 Highlights

Learn about the new features introduced by the .NET Core 3.0 release.

Exploring .NET Core 3.0. What's New?

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

New feature removes the need for passwords and offers unique progressive enrollment features, paving the way for the ultimate user experience.


**BELLEVUE, Wash. – June 15, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced the launch of [Auth0 WebAuthn Passwordless](https://auth0.com/passwordless), an authentication feature that enables end-users to seamlessly log in with a biometric identifier — such as facial recognition or a fingerprint — as a convenient and secure alternative to a traditional password. Removing the need for long, complex passwords, Auth0 WebAuthn Passwordless provides a frictionless experience for end-users while reducing the significant password management burden for companies. 

<include src="WebAuthnMeCTA" group="B"/>

Today’s abundance of applications and systems have never had more access points, leaving organizations and their end-users vulnerable to attacks. A reliance on passwords as a primary means of authentication, combined with users’ tendency to re-use passwords across applications, presents a number of security, user experience, and cost issues. According to a [2021 Data Breach Investigations Report by Verizon](https://www.verizon.com/business/resources/reports/dbir/), compromised passwords are responsible for 84% of breaches. Passwordless authentication mitigates these challenges and offers increased security and trust for applications, devices, and services providers; faster and smoother login experiences for their end-users; and cost savings by eliminating the need for password management support. 

“Despite ongoing guidance around proper password creation and repeated warnings against password reuse, consumers crave convenience and continue to use the easiest and most convenient path for application access,” said Shiv Ramji, Chief Product Officer at Auth0. “A passwordless future is largely being driven by two primary forces — security and convenience. Companies want to secure the vulnerabilities that come with passwords, and they also want to offer their users a better digital experience. Auth0 WebAuthn Passwordless is a modern option for organizations looking to attract and retain users.”

With Auth0 WebAuthn Passwordless, users can authenticate with Web Authentication-powered (WebAuthn) biometrics, the official web standard for passwordless authentication as published by [W3C and used by FIDO](https://fidoalliance.org/fido2/fido2-web-authentication-webauthn/), for first-factor authentication. This form of authentication eliminates security weaknesses based on password reuse since passwords are not required. Additionally, Auth0 WebAuthn Passwordless is an ideal option for companies looking to build and provide an authentication experience supporting conversion and retention of users who want more choice and less friction in their login experience.

Auth0 WebAuthn Passwordless eliminates the need for users to enter username and password credentials and enables simpler login with a biometric identifier such as facial recognition like Apple Face ID or a fingerprint scan on a mobile device or laptop. The biometric data remains stored on the device, alleviating privacy and security concerns for end-users. The feature also allows end-users to progressively enroll devices one at a time, as they use them, without needing a centralized portal, giving them the flexibility of having multiple passwordless authentication options — an advanced, unique capability that maximizes end-user adoption and enables a faster transition from passwords to passwordless, benefiting both end-users and organizations.

More detailed information on Auth0 WebAuthn Passwordless can be found here: [7 Things You Need to Know About Passwordless Authentication](https://auth0.com/resources/whitepapers/passwordless-authentication) (whitepaper) and on [Auth0’s blog](https://auth0.com/blog/freedom-from-passwords-with-auth0-webauthn-passwordless). 

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), provides a modern identity platform that helps organizations meet the security, privacy, and convenience needs of their users. Please visit [The Auth0 Identity Platform](https://auth0.com/identity-os) to learn more.


<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

Auth0 WebAuthn Passwordless Offers New Levels of Ease and Security for Modern Authentication

daniel-krzyczkowski-2020

Software Engineer passionate about Microsoft technologies. Awarded with Microsoft Most Valuable Professional title. The main part of his activities is to share knowledge and passion about Microsoft Azure, IoT, Universal Windows Platform and DevSecOps.


Software Engineer

Daniel Krzyczkowski

Learn what software supply chain is and how to improve security with GitHub security features.

Secure Software Supply Chain with GitHub Security Features

vincenzo-chianese

Vincenzo Chianese is an Italian Software Developer focused on Web APIs and User Interfaces. He has been working for the last years in API companies such as Apiary, Oracle, LunchBadger, Stoplight. Currently, he is working for Microsoft to help move Microsoft Graph forward and authored some open-source tools in the market (Prism, Express Gateway).

API Architect

Vincenzo Chianese

A bird's view look to the Typing features in Python 3.x

## Introduction

Python is a dynamically typed language. This means that the Python interpreter does type checking only as code runs, and the type of a variable is allowed to change over its lifetime.

However — Python has included a gradual type system for a very long time through the [PEP 484](https://www.python.org/dev/peps/pep-0484/).

Gradual Typing is the ability of a type system to have expressions that are typed (and thus checked) while also having some that are untyped. The final program is still valid and executable by the interpreter.

In this article, we're going to take a look at how the typing annotations have been introduced, what tools we can use today to enforce typings, and then have a rundown to the typing capabilities that Python 3.9 is offering.

## Function Annotations

Python 3 introduced the support of function annotations through the [PEP3107](https://www.python.org/dev/peps/pep-3107/). It was essentially a way to store metadata and attributes to function parameters and return values that somebody _could_ be using. For instance, consider the following function that sums two numbers:

```python
def add(a, b):
    return a + b
```

In Python 3, it is possible to add annotations by using the `:` for the parameters and `->` for the return value:

```python
def add(a: "first number", b: "second number"):
    return a + b
```

The annotations do not modify the function's behavior in any way. Such data is stored in the `__attributes__` mutable dictionary of the function itself and can be retrieved and also modified:

```python
def add(a: "first number", b: "second number"):
     return a + b 

print(add.__annotations__)

$ {'a': 'first number', 'b': 'second number'}
```

Technically speaking, the annotations are a shortcut to set up the `__attributes__` dictionary of a function.

Any expression is a valid annotation. So the following is also valid:

```python
operation = "square root"

def do_math(a: "Should be a positive number" if operation=='square root' else "Should be a number" ):
    if(operation == "square root"):
        return sqrt(a)
    return a**2
```

and the relative `__annotations__` will contain the evaluated expressions:

```python
print(do_math.__annotations__)

# {'a': 'Should be a positive number'}
```

Things get more interesting when we start to annotate function parameters and return values with dictionaries. Consider, for instance, the following annotated function:

```python
def subtract(
    a: {"description": "first number", "exampleValue": 10},
    b: {"description": "second number", "exampleValue": 15}
) -> {"description": "subtraction of the numbers"}:
    return a - b

print(subtract.__annotations__)

$ {'a': {'description': 'first number', 'exampleValue': 10},
   'b': {'description': 'second number', 'exampleValue': 15},
   'return': {'description': 'subtraction of the numbers'}}
```

Any other Python program can read such metadata and use it. In this specific case, a theoretic program could use such annotations to display or even generate documentation. [pydoc](https://docs.python.org/3/library/typing.html), for instance, displays the type annotations in the generated artifacts.

## Type Annotations

Because any expression is a valid annotation, it is possible to level up the game by annotating the function parameters with the type constructors that represent the parameter type and have a linter check them out for us.

Linters are programs that will statically analyze the source code of a project and, based on its configuration, can point out sections that might be problematic. In some cases, they can also suggest corrections. In this specific case, a linter can take such annotations, track all the function usages and check whether the type passed as a parameter corresponds to the one, and alert in case the types do not align. This is exactly what [mypy](https://mypy.readthedocs.io) does.

Consider the following function concatenating a string to a constant, and let's use type constructors as type annotations:

```python
def greeting(name: str) -> str:
    return "Hello " + name

greeting(10)
```

Now let's install mypy and run the checked on the newly created file:

```bash

# Create a new directory for your project
mkdir python-typings

# Make your project directory the current directory
cd python-typings
 
pip3 install mypy

touch greetings.py

# Open the file with your favorite editor and paste the content of the snippet above

$ mypy ./greetings.py

$ greetings.py:4: error: Argument 1 to "greeting" has incompatible type "int"; expected "str"
$ Found 1 error in 1 file (checked 1 source file)
```

mypy has identified a misusage in the function typings and alert us with some appropriate error messages. It does so by looking at the annotations that the function provides and then use them in all the function calls it is able to detect, alerting when mismatches are detected.

Just as we have done previously, let's take a look at the annotations on the function:

```python
print(greeting.__annotations__)

$ {'name': <class 'str'>, 'return': <class 'str'>}
```

This is a very different model than, for example, the one that [TypeScript is using](https://auth0.com/blog/working-with-typeScript-a-practical-introduction/).

While TypeScript code needs to be transpiled (which is the procedure that, among other things, strips all the types out) in order to produce regular untyped JavaScript — Python has not a real type erasure. The annotations are left in place and can even be accessed at runtime.

mypy is available as a command-line tool or, in case you are not a fan of the terminal, as a [VSCode extension](https://code.visualstudio.com/docs/python/linting) or with [Pycharm](https://plugins.jetbrains.com/plugin/11086-mypy). These plugins can boost your experience when writing code significantly since they will report type errors directly in your IDE and in real-time.

Now that we know how to type annotations work, let's do a typing tour to see the capabilities of the typing system.

## Typing Fundamentals

All the primitives offered by Python are supported through a type constructor. So any variable, function parameter, and return value can be naturally typed with `int, str, float, bool, None`.

On top of these, there's a number of special types that are provided for a better experience:

* `Any`: specified an unconstrained type, effectively skipping the type check for anything annotated with so
* `NoReturn`: specifies a function that does *NOT* return in any case. Infinite loops or functions throwing exceptions are some examples
* `Literal`: constrains the parameter or the return value to be only one of the provided possible values, effectively subtyping a type

```python
from typing import Literal

def return_literal() -> Literal[1, 2, 3, 4]:
    t: int = 10 
    # return t # Incompatible return value type (got "int", expected "Union[Literal[1], Literal[2], Literal[3], Literal[4]]")
    return 4 # OK
```

### Aggregated

Aggregates are collections of related information we wish to treat as a unit. Python's typing module supports them too.

#### Dictionaries

Dictionaries can be annotated by creating a subclass of the provided `TypedDict` class:

```python
from typing import TypedDict


class Movie(TypedDict):
    name: str
    year: int


m: Movie = {"name": "The Avengers", "year": 2018}
```

It is also possible to use the `Movie` constructor, yielding the same result:

```python
m = Movie("Batman Begins", 2005)
```

All the variable annotations on a module are being held on the `__annotations__` dictionary in the module itself, so `print(__annotations__)` is legit.

mypy will also make sure to alert in case the code is trying to access a property that has not been declared:

```python
m["ratings"] = 5 # TypedDict "Movie" has no key 'ratings'
```

By default, all the keys specified in the Typed Dictionary must be present. It is possible to relax such constraint through the `total` boolean value:

```python
class Movie(TypedDict, total=False):
    name: str
    year: int


m: Movie = {"year": 2018} # The name is missing, but this is still ok
```

As long as the key is a string and the value is an integer, the type checker will mark it as valid.

In case some of the keys are mandatory while some are not, the `Optional[T]` key can be used:

```python
from typing import Optional


class Movie(TypedDict):
    name: str
    year: Optional[int]


m: Movie = {"name": "Batman Begins", "year": None}
```

The `Optional[T]` can also be used to annotate function parameters that are not required:

```python
from typing import Optional, Union


def greet(name: Optional[str], surname: Union[str, None]):
    n = name or "Clark"
    s = surname or "Kent"
    # return "Hello, " + name + " " + s
    return "Hello, " + n + " " + s
```

You can see that we have also used `Union[str, None]`, which is effectively the same thing as `Optional[str]`.

The `Mapping` type can be used when we have fewer constraints about the keys/values of the dictionary we want to operate with:

```python
from collections.abc import Mapping

m: Mapping[str, int] = {"year": 2018, "randomProperty": 1000}
```

You can see that, as long as the key of the dictionary is a string and the value is an integer, the dictionary is valid, and we do not have to specify the property names ahead of time.

While the `dict` class is the only one effectively implementing `Mapping`, it is advised to use the less specific type as possible so that future code won't be broken in case the standard Mapping gets changed in a different Python version. This also happens for List, as we'll see shortly.

#### Sequences

Python has the `Sequence[T]` base class that can be used to model a number of classes, such as `list`, `str`, `tuple`, and `bytes`. The `Sequence` protocol only supports accessing items (but not modify them), so you will need to type according to your use case:

```python
from collections.abc import Mapping


seq: Sequence[int] = [1,2,3,4]
seq[0] = 10 # Unsupported target for indexed assignment ("Sequence[int]")

lst: list[int] = [1,2,3,4]
lst[0] = 10 # This is OK
```

In case you're a fan of immutability, you've just gained a powerful tool to clearly mark the fact that function will *NOT* touch the passed sequence.

### Type Guard

Type Guard is a feature found in different languages (including TypeScript), where the Type System is capable of narrowing down a type in a block based on a condition.

For instance, if we consider this code:

```python
from typing import Optional


def func(val: Optional[str]) -> str:
    if val is not None:
        return val
    return "default"
```

The type checker, by statically analyzing the code, is able to understand `val` is a string (and only a string) in case the statement on the first line is true and narrows down to just `None` in case the condition is false.

There are cases where type narrowing cannot be applied based on static information only, and in such cases, custom type guards can come to help. For instance, consider this code example:

```python
def is_str_list(val: List[object]) -> bool:
    return all(isinstance(x, str) for x in val)

lst: List[object] = ["hello", "world", 1, 3, 4]


def capitalize_first_element(lst: List[object]) -> str:
    if is_str_list(lst):
        return lst[0].capitalize()
    return str(lst[0]).capitalize()
```

If we run mypy on it, we will receive the following error:

`code.py:8: error: "object" has no attribute "capitalize"`

The Type System is not able to infer that, when `is_str_list` returns `true` — it's safe to assume that the entire list contains only `str` types, where the `capitalize` method exists.

Custom Type Guards allow us to instruct the Type Checker about a type "assumption" based on a boolean value.

```python
from typing import TypeGuard


def is_str_list(val: List[object]) -> TypeGuard[List[str]]:
    return all(isinstance(x, str) for x in val)
```

By using this function instead of the one provided above, the Type Checker will be able to refine from `List[object]` to `List[string]` (when the return value is `true`) where the `capitalize` function is defined for every element.

The accuracy of the type guard function is left to the developer. If the function is returning an incorrect value, the type checker has no way to figure that out, and it will flow on the wrong branch. For instance, let's say we have a bug in our function:

```python
from typing import TypeGuard


def is_str_list(val: List[object]) -> TypeGuard[List[str]]:
    return all(not isinstance(x, str) for x in val)
```

In such a case, the type checker will still assume the List of object has strings inside when the function returns `true` even if it's semantically incorrect, leading to possible bugs.

Unfortunately, custom type guards are not available yet, but they are going to be added in [Python 3.10](https://www.python.org/dev/peps/pep-0647/)

## Conclusion

Typing in Python works — it is a success story. It is gradually integrated into the language with no significant modifications and does not modify the dynamic nature of the language. While the features are long to be completed, the way paved is definitely the good one and, in some circumstances,  might lead to better software.

Types in Python

yigit

I am an Informatics MSc. student at TU Münich and a Software Engineer. My areas of interest include but are not limited to Computer Networks, Software Engineering, Databases, and Network/Web Security.

Most of my practical experience revolved around Java and backend development with the Spring framework. I also like exploring the huge world of JavaScript and especially love using Vue.js and exploring new technologies.

I am a big fan of real agile development, startups, and fast-paced environments. I believe one of the major things that makes tech a very exciting field is: Gaining the ability and knowledge to create products that will make people’s lives easier and more fun.

MSc. student and Software Engineer

Yiğit Kemal Erinç

A bird's view look to Spring Security and its features

Spring Security Overview

michael hsu

I am a full stack engineer on the Auth0 attack protection team. I’m passionate about all things software and enjoy solving problems that make the world a better place. I’ve spent my career working in different software fields such as space mission control, video processing and smart assistants before working on protecting our customers at Auth0.

Engineer - Continuous Auth

Michael Hsu

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

Easily maximize user friction to protect your applications with our improvement on the CAPTCHA™: The CRAPTCHA!

**TL;DR:** Auth0 announces the release of ***auth0-craptcha***. CRAPTCHAs are a creative improvement on CAPTCHAs that make proving you’re not a bot more fun (or more annoying) — and just in time for the first day of April!

<AmpContent>
<amp-youtube
    data-videoid="eylQ82zG9GE"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<iframe width="560" height="315" src="https://www.youtube.com/embed/eylQ82zG9GE" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
</NonAmpContent>

For years, the [CAPTCHA™](https://en.wikipedia.org/wiki/CAPTCHA) — which is an acronym for “Completely Automated Public [Turing test](https://www.sciencedirect.com/topics/neuroscience/turing-test) to tell Computers and Humans Apart” — has been one of the most effective and widely-used tools to differentiate between actual human users and bots:

![Example CAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/1G2aaQm0x156we1OM558gv/57aec3b7283f62480273dc2e1a623533/captcha-example.png)

Just as the resistance movement in the Terminator movies used dogs to tell the difference between humans and evil machines in disguise, we’ve all relied on CAPTCHAs to sort actual users from bots.

**One of the problems with traditional CAPTCHAs is that they assume that certain puzzles can only be solved by humans.** In the age of data science and the current artificial intelligence renaissance, this assumption is becoming increasingly wrong. Between the growing power of machine learning algorithms and the fact that we’ve been stuck at home due to the pandemic, computers have become much better at picking out pictures that contain buses than we are.

**Another problem is that CAPTCHAs aren’t annoying enough.** Let’s face it, a year of being stuck at home has made bored users more patient. They’re now more willing to solve CAPTCHA puzzles in order to log in.

We are a leader in authentication and authorization, and we want to add aggravation to our repertoire. We’re proud to announce the next generation of “Are you human or not?” tools. We give you: The **CRAPTCHA**. That’s short for “Complex Redundant Auth0 Problem To Confound Human Access”.

With CRAPTCHAs, users are challenged to prove that they’re not robots by performing truly human activities. They’re also discouraged from logging in, which makes your system more secure!

Let’s take a look at our CRAPTCHA catalog. As you review them, think about how much more secure your site or application will be once you’ve incorporated them.

## CRAPTCHA #1: Play the Piano

![Piano CRAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/5lY8BABmqfmC7dHfYLQRha/552bf30073d4c9d2eca768f0ff33d930/piano.png)

A popular regret among adults is that they never learned to play the piano. There are also many musicians who “play by ear” and wish that they’d learned to sight-read music. This CRAPTCHA capitalizes on both these regrets and will keep out bots and humans who quit their piano lessons!

<a  target="_blank" rel="noopener" rel="noreferrer" href="https://auth0-craptcha-piano.us.auth0.com/authorize?client_id=iVGwMsN3KT2d0qsWlmV7xdEpbfNwkQM3&response_type=code&connection=Username-Password-Authentication&prompt=login&scope=openid profile&redirect_uri=https://manage.auth0.com/tester/callback?connection=Username-Password-Authentication"><strong>🎹 Try out the Piano CRAPTCHA for yourself!</strong></a>


## CRAPTCHA #2: Shoot Some Ducks

![Duck Hunt CRAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/6aVhNYvmseT2Nh4b9lWthz/a1da9c155b727d57655bcc32efb8fa3a/duck-hunt.png)

This CRAPTCHA forces the user to play the classic videogame [_Duck Hunt_](https://en.wikipedia.org/wiki/Duck_Hunt) for some amount of time before being granted access to the system or service. There’s nothing that user love more than an unskippable, mandatory interruption prior to using an application!

No animals were harmed in the making of this CAPTCHA. We can’t guarantee that users won’t be harmed by it, though.

<a target="_blank" rel="noopener" rel="noreferrer" href="https://auth0-craptcha-duckhunt.us.auth0.com/authorize?client_id=d0e6AVpg5WZNOQrz4vcwrxhI6yc3sBvm&response_type=code&connection=Username-Password-Authentication&prompt=login&scope=openid profile&redirect_uri=https://manage.auth0.com/tester/callback?connection=Username-Password-Authentication"><strong>🦆 Try out the Duck Hunt CRAPTCHA for yourself!</strong></a>

> Credit goes to
[Matthew Surabian](https://github.com/MattSurabian/) for his [amazing JavaScript implementation of _Duck Hunt_](https://github.com/MattSurabian/DuckHunt-JS).

## CRAPTCHA #3: Scratch and Win to Get In!

![Scratch and win CRAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/rEAwa0A9GjiFk9Ouvl0XO/f808fb558e3e77e128fab6052abcc755/scratch.png)

Someone once called lotteries “a way to tax optimists”, and this lottery-themed CRAPTCHA is a way to tax your users’ patience! In order to access a system or service, users have to scratch 3 boxes before they can proceed. Access to your application is the ultimate prize and it’s definitely worth filtering out unlucky users.

<a target="_blank" rel="noopener" rel="noreferrer" href="https://auth0-craptcha-scratcher.us.auth0.com/authorize?client_id=uCYUiWwHcRBO6PR3nSwUEjvcjuFwsMxw&response_type=code&connection=Username-Password-Authentication&prompt=login&scope=openid profile&redirect_uri=https://manage.auth0.com/tester/callback?connection=Username-Password-Authentication"><strong>💰 Try out the Scratch and Win CRAPTCHA for yourself!</strong></a>


## CRAPTCHA #4: Beat the Crooked Dealer at Blackjack

![Blackjack CRAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/4OBWpiQItvBWyG6KemroDm/1562a64ff71f614a06ed7ee4d8a50ad4/blackjack.png)

Why leave your user experience to chance, when you can leave it to skill *and* chance? Your users — if you still have any at this point — will have to play a rigged game of blackjack and win twice in order to gain access.

<a target="_blank" rel="noopener" rel="noreferrer" href="https://auth0-craptcha-blackjack.us.auth0.com/authorize?client_id=U2WSlCTYAFiYromuRoHR9B0qnLWFRhBJ&response_type=code&connection=Username-Password-Authentication&prompt=login&scope=openid profile&redirect_uri=https://manage.auth0.com/tester/callback?connection=Username-Password-Authentication"><strong>🃏 Try out the Rigged Blackjack CRAPTCHA for yourself!</strong></a>

## Security Through Absurdity
Think about it: what’s more secure than a system that’s too aggravating to get into? That’s the power and promise of Auth0’s new CRAPTCHAs. Our CRAPTCHAs will filter out the bots, and have users simply choose not to log into your applications out of sheer frustration. Not only will your systems be more secure, but they’ll also experience greatly reduced server load and support issues, thanks to fewer users. That’s the power of security through absurdity.


## But Seriously...

We hope you got a laugh out of our **April Fool's Day joke**! While it may be tempting to make CAPTCHAs harder to get through, there are actually better ways to implement bot detection using *real* Auth0 products.  

**Want to actually protect your application with _minimal_ user friction?** Are you one of those people who actually _like_ having users?

Protect your application with Auth0’s [bot detection](https://auth0.com/docs/attack-protection/bot-detection). It’s part of our suite of attack protection feature set. With Auth0, you can choose to present CAPTCHAs only when the login attempt displays suspicious behavior or characteristics. It’s security *and* usability!

> CAPTCHA™ is a trademark of Interactiv Corporation.


Introducing Auth0 CRAPTCHAs!

A quick tour about five C# features that even experienced developers might not know: from variable scopes to the top-level statements and others.



Even if you are an experienced C# developer, there are features you might not be aware of. In this article, you will explore five little-known C# features that allow you to accomplish things in a slightly different way than you are used to. These features allow you to declare local variables in an unusual way, create conditions with the `switch` command and the `try/catch` block, reduce the number of lines to set up a console program, define properties that can only be initialized, and access private variables of a class instance.

Let's get started.

## Variable Scope and Braces

In C#, you can declare variables within code blocks surrounded by braces to define methods, conditional statements, loops, among others. For example, the braces define a variable scope within a method:

``` csharp  
static void Main(string[] args)
{
  Console.Write("Enter your name: ");
  var name = Console.ReadLine();

  Console.WriteLine($"Hello, {name}!");
}
```

Also, you can define a variable scope with an `if` statement:

``` csharp  
if (name.Trim() != "")
{
  var dayOfWeek = DateTime.Today.ToString("dddd");
  Console.WriteLine($"Happy {dayOfWeek}, {name}!");
}
```

And with a `while` statement as well:

``` csharp  
while (name.Trim() != "")
{
  var dayOfWeek = DateTime.Today.ToString("dddd");
  Console.WriteLine($"Happy {dayOfWeek}, {name}!");

  Console.Write("Enter your name: ");
  name = Console.ReadLine();
}
```

Regardless of the context, the braces delimit the scope of the variable. Did you know that **you can define a variable scope with braces even without a specific statement**? Consider the following code:

``` csharp 
using System;

namespace variable_scope
{
  class Program  {
    static void Main(string[] args)
    {
      Console.WriteLine("Hello World!");
      {
        var theVariable = "I'm the variable";
        Console.WriteLine(theVariable);
      }
    }
  }
}
```

Here, we have a code block delimited by braces inside the `Main()` method. The code block defines and initializes the variable `theVariable` and writes its value to the console. Notice that no `if`, `while`, `for`, or any other statement stands right before the braces.
This program works as expected: it will write both strings as shown below:

``` bash 
Hello World!
I'm the variable
```

What happens if we add the following statement outside the code block, as in the following example?

``` csharp 
using System;

namespace variable_scope
{
  class Program  {
    static void Main(string[] args)
    {
      Console.WriteLine("Hello World!");
      {
        var theVariable = "I'm the variable";
        Console.WriteLine(theVariable);
      }
      //👇 new statement outside the code block
      Console.WriteLine(theVariable);
    }
  }
}
```

If you attempt to run this program, you will get the following error:

``` bash 
error CS0103: The name 'theVariable' does not exist in the current context
```

As you can see, the variable defined inside the code block is not accessible outside it.

In other words, you can create a variable scope by simply using braces anywhere in your code. This feature may be useful when you have a short sequence of statements that need to share a value through a variable. You create a code block on the fly, declare the variable, and use it.
However, I suggest not to abuse it. Sometimes, it's a better idea to create a method and invoke it. It may be more readable than a code block.

## The *when* keyword

Another little-known C# feature is the `when` keyword. You can use it to apply a filter condition in the context of a `switch` statement or a `try/catch` block.
Let’s start by seeing how to use it in the context of a `switch` statement. Consider the following code:

``` csharp  
private static string evaluateScore(int score)
{
  var result = "";

  switch (score)
  {
    case int n when (n < 6):
      result = "Your score doesn't look good...";
      break;

    case int n when (n >= 6 && n <= 7):
      result = "Your score is not bad!";
      break;
    
    case int n when (n > 7 && n <= 9):
      result = "Your score is pretty good!";
      break;
    
    case int n when (n > 9):
      result = "Your score is awesome!";
      break;
  }

  return result;
}
```

Here we have the `evaluateScore()` method that evaluates an integer value (`score`) and returns a message string. As you can see, its logic is totally based on a `switch` statement. Each `case` declares a variable `n` that takes the current value of the `score` parameter. This variable is inspected in the `when` clause to determine the message to be returned. Of course, you can use any boolean expression with the `when` clause.

You can also use the `when` keyword with `catch`, as shown in this example:

``` csharp  
public static async Task<string> MakeRequest()
{
  var client = new System.Net.Http.HttpClient();
  var streamTask = client.GetStringAsync("https://auth0.com/this-page-doesnt-exist");

  try
  {
    var responseText = await streamTask;
    return responseText;
  }
  catch (HttpRequestException e) when (e.StatusCode == HttpStatusCode.MovedPermanently)
  {
    return "The page moved.";
  }
  catch (HttpRequestException e) when (e.StatusCode == HttpStatusCode.NotFound)
  {
    return "The page was not found";
  }
  catch (HttpRequestException e)
  {
    return e.Message;
  }
}
```

Here, you catch an `HttpRequestException` and analyze its status code through a `when` clause.

In both cases, the `when` keyword is extremely useful when you need to match a complex condition since it allows you to keep your code pretty readable.

## Top-Level Statements

Typically, a minimal console application has at least the following code:

``` csharp  
using System;

namespace standard_console
{
  class Program
  {
    static void Main(string[] args)
    {
      Console.WriteLine("Hello World!");
    }
  }
}
```

This program is composed of eleven lines of code, but only one line is actually operative. All the other lines are needed to set up the program infrastructure: a namespace, a class, and a method.

Do you know that you can get rid of this stuff and focus on just one line? In fact, you can replace the code shown above with just the following:

``` csharp 
System.Console.WriteLine("Hello World!");
```

This is possible thanks to the top-level statement feature introduced by C# 9. You can try it [starting with .NET 5](https://auth0.com/blog/dotnet-5-whats-new/).

Of course, you can use multiple top-level statements to create your console application, as in this example.

``` csharp  
using System;

Console.Write("Enter your name: ");
var userName = Console.ReadLine();

Console.WriteLine($"Hello {userName}!");
```

However, remember that you can have only one file using this feature in your .NET project.

Using the top-level statements feature enables a script-oriented approach for C# programming. This may be a more friendly approach for new C# learners or a handy alternative to quickly set up a small console application. For complex applications, you may feel the top-level statements approach is inappropriate because of the lack of a structure.

## The *init* Setter

Assume you have the following `Person` class:

``` csharp  
public class Person
{
  public string FirstName { get; set; }
  public string LastName { get; set; }
  public string Address { get; set; }
}
```

It's a very simple class with just `FirstName`, `LastName`, and `Address` properties. As it *usually* happens in the real world, once you assign a first name and last name to a person, you do not want anyone to change it anymore. So, you would like to assign the values for the `FirstName` and the `LastName` properties to a `Person` instance at the creation time, and those values should not be changed anymore. How can you accomplish this behavior?
If you define the `Person` class by using the usual `get` and `set` accessors, you will not be able to get the expected result. After creating an instance of the `Person` class, you can change the value of its `FirstName` and `LastName` properties whenever you want, as in the following example:

``` csharp  
var person = new Person
{
  FirstName = "John",
  LastName = "Doe",
  Address = "124 Conch Street, Bikini Bottom, Pacific Ocean"
};

person.Address = "17 Cherry Tree Lane";
person.FirstName = "Jack";

Console.WriteLine($"Hello {person.FirstName} {person.LastName}!");
```

Fortunately, C# 9 provides you with the `init` accessor. If you apply the `init` accessor to the `FirstName` and `LastName` properties in place of `set`, you will achieve your goal:

``` csharp  
public class Person
{
  public string FirstName { get; init; }  //👈 changed code
  public string LastName { get; init; }   //👈 changed code
  public string Address { get; set; }
}
```

This way, after the instance is created, the `FirstName` and `LastName` properties become read-only.
Remember that this feature is supported only starting with C# 9.

## Accessing Private Variables

Of course, you know that a private variable is not accessible from outside a class. In the following example, you have a `Life` class that defines the `birthTime` private variable:

``` csharp  
public class Life
{
  private DateTime birthTime;

  public Life()
  {
    birthTime = DateTime.Now;
  }

  public int GetLength()
  {
    return DateTime.Now.Subtract(birthTime).Milliseconds;
  }
}
```

The `birthTime` private variable is assigned in the class constructor and is used within the `GetLength()` method. Normally, the `birthTime` variable is not accessible from outside the `Life` class. However, there is a special case where you can access the `birthTime` private variable. Take a look at this new `YoungerThan()` method:

``` csharp  
public class Life
{
  // ...other code...

  public bool YoungerThan(Life livingBeing)
  {
    return livingBeing.birthTime < birthTime;
  }
}
```

Within this new method, you are actually accessing the `birthTime` private variable of a `Life` instance!

You may be scared by the consequences of accessing a private variable. Don’t panic! Only instances of a class can access private variables of other instances of the same class. In other words, the context of this access possibility is limited to one specific class.

This feature is useful when you need to implement some sort of internal comparison methods like the one shown above. However, you should use this approach **only when you don't want to expose a private value**. Otherwise, you should expose the private variable through a public property or method and use it for any processing. This way, you keep the idiomatic Object-Oriented Programming approach.

## Summary

In this article, you discovered five C# features that maybe you didn't know. The C# language and [the .NET platform](https://auth0.com/blog/what-is-dotnet-platform-overview/) are growing and evolving very quickly to adapt to developers' needs and simplify their work. So there's nothing bad with missing some feature.

If you know other little-known C# features, please share them with us in the comments below.

<include src="asides/DotNetCore" />


Five C# Features You Might Not Know

5e074956ee8ba1fea26e30d28c190495?s=300 avatar

5e074956ee8ba1fea26e30d28c190495?s=300

Full stack developer creating content at Auth0. I love taking a deep dive into hard-to-understand concepts and creating content that makes them easier to grasp. In my free time you can usually find me reading, hanging out with my dogs, or curling in the squat rack.

Former Developer Content Manager

Holly Guevara

Learn about the new features and changes in the latest Laravel 8 release.




It feels like just yesterday we were reading about what's coming in Laravel 6. And here we are today, learning about what's new in Laravel 8! 🤯

Whether you're getting started with Laravel or just want to check out the [latest and greatest](https://laravel.com/docs/8.x/releases), keep on reading.

## Laravel Jetstream

[Laravel Jetstream](https://jetstream.laravel.com/1.x/introduction.html), the new Laravel application scaffolding, was released with the new version of Laravel.

Jetstream provides a fantastic starting point for your Laravel applications with the following built-in options:

- Login and registration
- Email verification
- Two-factor authentication (2FA)
- Session management
- [Laravel Sanctum](https://laravel.com/docs/8.x/sanctum) API support
- Designed with Tailwind CSS
- Choice of two frontend stacks: [**Livewire + Blade**](https://laravel-livewire.com/) or [**Inertia.js + Vue.js**](https://inertiajs.com/)

![Laravel Jetstream Livewire installation](https://images.ctfassets.net/23aumh6u8s0i/5bC4p3YLjRj30EO0VlIRSs/aa91442260d3618589c60fcd808383f6/laravel-jetstream-livewire)

### How to use Laravel Jetstream

You can create a new application with Jetstream using the [Laravel installer](https://laravel.com/docs/8.x/installation#installing-laravel). Make sure the Laravel installer is updated to `v4.0`, and then run the following:

``` bash  
laravel new your-project --jet
```

Choose which stack you want to use: Livewire or Inertia. Next, run your database migrations with:

``` bash  
php artisan migrate
```

Finally, see your application at [`http://localhost:8000`](http://localhost:8000) by running:

``` bash  
php artisan serve
```

And now, you're ready to [explore your new Laravel Jetstream application](https://jetstream.laravel.com/1.x/installation.html)!

If you'd prefer to use Composer, you can find the [Composer installation instructions](https://jetstream.laravel.com/1.x/installation.html#composer-installation) in the Laravel Jetstream documentation.

## Models Updates

### Welcome back, `Models` directory!

The `app/Models` directory is back! Years ago, when Laravel 5 launched, a lot of developers noticed the `Models` directory was missing. Instead, new models were created directly in the `app` directory. Surprisingly, this caused quite the uproar in the community. You could still manually create the folder, and a lot of developers did, but it was considered an extra nuisance by some.

With Laravel 8, the beloved `app/Models` directory has been restored! If you prefer the old structure, you can always modify your codebase to remove the `Models` directory again.

### Model factory classes

[Taylor Otwell](https://github.com/taylorotwell) spent some time rewriting the Eloquent model factories as classes.

Let's compare the changes by looking at the default `User` factories from both Laravel 7 and 8. 

**User factory in Laravel 7.x:**

``` php  
// database/factories/UserFactory.php

use Faker\Generator as Faker;
use Illuminate\Support\Str;

$factory->define(App\User::class, function (Faker $faker) {
    return [
        'name' => $faker->name,
        'email' => $faker->unique()->safeEmail,
        'email_verified_at' => now(),
        'password' => '$2y$10$92IXUNpkjO0rOQ5byMi.Ye4oKoEa3Ro9llC/.og/at2.uheWG/igi', // password
        'remember_token' => Str::random(10),
    ];
});
```

**User factory in Laravel 8:**

``` php  
// database/factories/UserFactory.php

namespace Database\Factories;

use App\Models\User;
use Illuminate\Database\Eloquent\Factories\Factory;
use Illuminate\Support\Str;

class UserFactory extends Factory
{
    /**
     * The name of the factory's corresponding model.
     *
     * @var string
     */
    protected $model = User::class;

    /**
     * Define the model's default state.
     *
     * @return array
     */
    public function definition()
    {
        return [
            'name' => $this->faker->name,
            'email' => $this->faker->unique()->safeEmail,
            'email_verified_at' => now(),
            'password' => '$2y$10$92IXUNpkjO0rOQ5byMi.Ye4oKoEa3Ro9llC/.og/at2.uheWG/igi', // password
            'remember_token' => Str::random(10),
        ];
    }
}
```

In Laravel 8, factories are now classes that extend the base Laravel factory class. Glancing at the default file, you'll see the `model` property and `definition` method. The `definition` method then returns the model attributes.

Compare this to Laravel 7 and below, where the `UserFactory` is defined with a [Closure](https://www.php.net/manual/en/class.closure.php) and returns the specified model attributes.

Both of these still have access to Faker, as expected. Let's look at the difference between *using* factories in Laravel 7 versus Laravel 8.

**Using factories in Laravel 7:**

Before this update, you would use the `factory` helper function in your seeder files to generate model instances.

``` php  
// database/seeds/UserSeeder.php

class UserSeeder extends Seeder
{
  /**
  * Run the database seeds.
  *
  * @return void
  */
  public function run()
  {
    // Create three App\User instances
    $users = factory(App\User::class, 3)->create();
  }
}
```

**Using factories in Laravel 8:**

With Laravel 8, you can use the `factory` directly on the model instance. This is because the default models now include a `HasFactory` trait, as shown in the simplified code below. 

``` php  
// database/seeders/UserSeeder.php

class UserSeeder extends Seeder
{
  /**
    * Run the database seeds.
    *
    * @return void
    */
  public function run()
  {
    // Create three App\User instances
    User::factory(3)->create();
  }
}
```

``` php  
// app/Models/User.php
<?php
namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;
// ...

class User extends Authenticatable
{
    use HasFactory;
    // ...
}

```

> ❗ If you have existing factories on a Laravel 7.x project or older and you're planning on upgrading, you can use the [`laravel/legacy-factories`](https://github.com/laravel/legacy-factories) package that was created to simplify the upgrade process.

## Migration Squashing

😱 Laravel 8 introduces another exciting feature: migration squashing! No longer do you have to scroll for five minutes when you open up your `migrations` folder! With migration squashing, you can now condense your migration files into a single SQL file with the following commands:

``` bash  
php artisan schema:dump
php artisan schema:dump --prune
```

Laravel will write the new `schema` file to `database/schema`. Then when you run your migrations, Laravel will run the SQL from the schema file first before moving on to anything created later in the `migrations` folder.

> Note: Migration squashing is currently only supported for MySQL and Postgres.

## Job Batching

In Laravel, jobs are tasks that can be performed as part of a queue to accomplish something in the background. The new [job batching feature](https://laravel.com/docs/8.x/queues#job-batching) allows you to execute several [jobs](https://laravel.com/docs/8.x/queues#creating-jobs) together.

To use the new batching feature, first define your job as you normally would. The example below has been simplified to show the new `Batchable` trait.

``` php  
<?php
namespace App\Jobs;

use Illuminate\Bus\Batchable;
// ...

class SendEmail implements ShouldQueue
{
  use Batchable;

  /**
    * Execute the job.
    *
    * @return void
    */
  public function handle()
  {
    if ($this->batch()->cancelled()) {
      // Detected cancelled batch...

      return;
    }
    // Batched job executing...
  }
}
```

Once you have your job defined, you can dispatch a batch of jobs in your controller using the `batch` method of the `Bus` facade.

``` php  
  use App\Jobs\SendEmail;
  use App\User;
  use Illuminate\Bus\Batch;
  use Illuminate\Support\Facades\Batch;
  use Throwable;

  $batch = Bus::batch([
    new SendEmail(User::find(1)),
    new SendEmail(User::find(2)),
    new SendEmail(User::find(3)),
  ])->then(function (Batch $batch) {
    // All jobs completed successfully...
  })->catch(function (Batch $batch, Throwable $e) {
    // First batch job failure detected...
  })->finally(function (Batch $batch) {
    // The batch has finished executing...
  })->dispatch();

  return $batch->id;
```

You'll also notice the addition of the `then`, `catch`, and `finally` methods. You can use these to define completion callbacks for your batch of jobs.

## Better Rate Limiting


**Rate limiting in Laravel 7**

``` php  
Route::middleware('auth:api', 'throttle:10,1')->group(function () {
  Route::get('/login', function () {
    //
  });
});
```

**Rate limiting in Laravel 8**

In Laravel 8, you can define your rate limiters in `app/Providers/RouteServiceProvider.php` using the `for` method of the `RateLimiter` facade. The `for` method will accept a name and a Closure, which returns the rate limiting details that you set up. 

``` php  
use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Support\Facades\RateLimiter;

RateLimiter::for('login', function (Request $request) {
  return Limit::perMinute(10);
});
```

You can now apply this pre-configured rate limiter to routes with `throttle:` followed by the rate limiter name.

``` php  
Route::middleware(['throttle:login'])->group(function () {
  Route::post('/login', function () {
    //
  });
  Route::post('/register', function () {
    //
  });
});
```

> Note: The `throttle` middleware API from previous Laravel versions will still remain functional.

For more about rate limiting options, see the [Laravel routing docs](https://laravel.com/docs/8.x/routing#rate-limiting). 

## Maintenance Mode

Laravel 8 also brings some improvements to maintenance mode. Maintenance mode is a really helpful feature that allows you to "disable" your application while you're making updates to it.

In previous versions, you would have to specify the IPs that would still be allowed to access the application with the `allow` option:

``` bash  
php artisan down --allow=127.0.0.1 --allow=192.168.0.0/16
```

With Laravel 8, you no longer need to allow certain IPs explicitly. Instead, you can use the `secret` option to create a maintenance mode bypass token:

``` bash  
php artisan down --secret="1630542a-246b-4b66-afa1-dd72a4c43515"
```

You can then access your application while in maintenance mode by appending the token to your application's URL, e.g., `https://example.com/1630542a-246b-4b66-afa1-dd72a4c43515`. The bypass cookie will be saved to your browser, and you can continue navigating your application from its normal URL, e.g., `https://example.com`.

## Routing Namespacing

In Laravel 8, the `namespace` property in `app/Providers/RouteServiceProvider.php` is now `null` by default, as you can see below.

``` php  
// app/Providers/RouteServiceProvider.php
<?php

namespace App\Providers;

// ...
class RouteServiceProvider extends ServiceProvider
{
    // ...
    /**
     * If specified, this namespace is automatically applied to your controller routes.
     *
     * In addition, it is set as the URL generator's root namespace.
     *
     * @var string
     */
    protected $namespace = null; // <--- LARAVEL 8 CHANGE
    // ...
}
```

In previous versions, the `$namespace` property was set to `App\Http\Controllers`.

This change means that controller route definitions will no longer include automatic namespace prefixing. The example below demonstrates how routing namespacing differs between Laravel 7 and Laravel 8.

**Laravel 7:**

``` php  
// routes/web.php

Route::get('/posts', 'PostController@index'); 
```

**Laravel 8:**

``` php  
// routes/web.php
use App\Http\Controllers\PostController;

Route::get('/posts', [PostController::class, 'index']);
```

If you prefer the old way, you can change the `$namespace` value back to `App\Http\Controllers` in `app/Providers/RouteServiceProvider.php`.

For more about routing namespacing updates, see the [Laravel routing documentation](https://laravel.com/docs/8.x/routing#basic-routing).

## Wrap Up

As always, Taylor Otwell and the rest of the Laravel team have been hard at work to deliver us some awesome and welcome updates to Laravel! Now that you have some background about what's new and what changed with Laravel 8, feel free to go off and [explore on your own](https://laravel.com/docs/8.x)! Leave a comment below letting me know your favorite change in Laravel 8 and what you're planning on building. Cheers!

<include src="asides/AboutAuth0" />


What's New in Laravel 8?

Learn the new features introduced by ECMAScript 2020 in JavaScript.



New exciting features are coming for JavaScript!

Even if the final approval of the new [ECMAScript 2020 (ES2020) language specification](https://tc39.es/ecma262/2020/) will be in June, you can start to take a look and try them right now!

![ES2020 Language Specification](https://images.ctfassets.net/23aumh6u8s0i/5oyMaGaQ9iZXB4MTfD1qFO/c19e21f7f828fe12b3022454f9e39a12/es2020-language-specification)

Follow me in this article to explore what's new.

## Dealing with Modules

Some important innovations concern modules. Among these, a feature that developers have been requesting for a long time is the dynamic import. But let's go in order and see them in detail.

### Dynamic imports

The current mechanism for importing modules is based on static declarations like the following:

```javascript
import * as MyModule from "./my-module.js";
```

This statement has a couple of constraints:

- all the code of the imported module is evaluated at the load time of the current module
- the specifier of the module (`"./my-module.js"` in the example above) is a string constant, and you can not change it at runtime

These constraints prevent loading modules conditionally or on-demand. Also, evaluating each dependent module at load time affects the performance of the application.

The new `import()` statement solves these issues by allowing you to import modules dynamically. The statement accepts a module specifier as an argument and returns a promise. Also, the module specifier can be any expression returning a string. This is great news because we can now load JavaScript modules at runtime as in the following example:

```javascript
const baseModulePath = "./modules";
const btnBooks = document.getElementById("btnBooks");
let bookList = [];

btnBooks.addEventListener("click", async e => {
  const bookModule = await import(`${baseModulePath}/books.js`);
  
  bookList = bookModule.loadList();
});
```

This code shows how to load the `books.js` module right when the user clicks the `btnBooks` button. After loading the module, the click event handler will use the `loadList()` function exported by the module. Note how the module to import is specified through a string interpolation.

<include src="TweetQuote" quoteText="The long-awaited dynamic import is now available in JavaScript ES2020."/>

### Import meta data

The `import.meta` object provides metadata for the current module. The JavaScript engine creates it, and its current available property is `url`. This property's value is the URL from which the module was loaded, including any query parameter or hash.

As an example, you could use the `import.meta.url` property to build the URL of a `data.json` file stored in the same folder of the current module. The following code gets this result:

```javascript
const dataUrl = new URL("data.json", import.meta.url);
```

In this case, the `import.meta.url` provides the `URL` class with the base URL for the `data.json` file.

### New export syntax

The `import` statement introduced by the ECMAScript 2015 specifications provides you with many forms of modules importing. The following are a few examples:

```javascript
import {value} from "./my-module.js";
import * from "./my-module.js";
```

In some cases, you may need to export objects imported from another module. A handy `export` syntax may help you, as shown in the following:

```javascript
export {value} from "./my-module.js";
export * from "./my-module.js";
```

This symmetry between import and export statements is convenient from a developer experience standpoint. However, a specific case wasn't supported before these new specifications:

```javascript
import * as MyModule from "./my-module.js";
```

To export the `MyModule` namespace, you should use two statements:

```javascript
import * as MyModule from "./my-module.js";
export {MyModule};
```

Now, you can get the same result with one statement, as shown below:

```javascript
export * as MyModule from "./my-module.js";
```

This addition simplifies your code and keeps the symmetry between `import` and `export` statements.

## Data Types and Objects

The new ES2020 specifications introduce a new data type, a standardized global object, and a few methods that simplify the developer's life. Let's take a look.

### BigInt and arbitrary precision integers

As you know, JavaScript has only one data type for numbers: the `Number` type. This primitive type allows you to represent 64-bit floating-point numbers. Of course, it also represents integers, but the maximum representable value is 2^53, corresponding to the `Number.MAX_SAFE_INTEGER` constant.

Without going into the internal details of integer representation, there are situations where you may need a higher precision. Consider the following cases:

- interaction with other systems that provide data as 64-bit integers, such as GUIDs, account numbers, or object IDs
- result of complex mathematical calculations requiring more than 64 bits

The workaround for the first case is representing data as strings. Of course, this workaround doesn't work for the second case.

The new `BigInt` data type aims to solve these issues. You represent a literal `BigInt` by simply appending the letter `n` to a number, as shown in this example:

```javascript
const aBigInteger = 98765432123456789n;
```

You can also use the `BigInt()` constructor the same way you use the `Number()` constructor:

```javascript
const aBigInteger = BigInt("98765432123456789");
```

The `typeof` operator now returns the `"bigint"` string when applied to a `BigInt` value:

```javascript
typeof aBigInteger		//output: "bigint"
```

Keep in mind that `Number` and `BigInt` are different types, so you cannot mix them. For example, the attempt to add a `Number` value to a `BigInt` value throws a `TypeError` exception, as shown by the following picture:

![Mixing BigInts and Numbers throws a TypeError exception](https://images.ctfassets.net/23aumh6u8s0i/1YxzmHqbHvpg1d7GC6lvV9/7949ca9ffddfa1549b4970f884f75e71/mixing-bigint-number)

You have to explicitly convert the `Number` value to a `BigInt` value by using the `BigInt()` constructor.

<include src="TweetQuote" quoteText="The BigInt data type is a new 'big' addition to JavaScript."/>

### The matchAll() method for regular expressions

You have several ways to get all matches for a given regular expression. The following is one of these ways, but [you can use other approaches](https://2ality.com/2018/02/string-prototype-matchall.html#getting-all-matches-for-a-regular-expression):

```javascript
const regExp = /page (\d+)/g;
const text = 'text page 1 text text page 2';
let matches;

while ((matches = regExp.exec(text)) !== null) {
  console.log(matches);
}
```

This code matches all the *page x* instances within the `text` variable through iteration. At each iteration, the `exec()` method runs over the input string, and you obtain a result like the following:

```shell
["page 1", "1", index: 5, input: "text page 1 text text page 2", groups: undefined]
["page 2", "2", index: 22, input: "text page 1 text text page 2", groups: undefined]
```

The `matchAll()` method of `String` objects allows you to get the same result but in a more compact way and with better performance. The following example rewrites the previous code by using this new method:

```javascript
const regExp = /page (\d+)/g;
const text = 'text page 1 text text page 2';
let matches = [...text.matchAll(regExp)];

for (const match of matches) {
  console.log(match);
}
```

The `matchAll()` method returns an iterator. The previous example uses the spread operator to collect the result of the iterator in an array.

### The globalThis object

Accessing the global object requires different syntaxes, depending on the JavaScript environment. For example, in a browser, the global object is `window`, but you cannot use it within a Web Worker. In this case, you need to use `self`. Also, in Node.js the global object is `global`.

This leads to issues when writing code intended to run in different environments. You might use the `this` keyword, but it is `undefined` in modules and in functions running in [strict mode](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Strict_mode).

The `globalThis` object provides a standard way of accessing the global object across different JavaScript environments. So, now you can write your code in a consistent way, without having to check the current running environment. Remember, however, to minimize the use of global items, since it is considered [a bad programming practice](https://wiki.c2.com/?GlobalVariablesAreBad).

### The Promise.allSettled() method

Currently, JavaScript has two ways to combine promises: `Promise.all()` and `Promise.race()`.

Both methods take an array of promises as an argument. The following is an example of using `Promise.all()`:

```javascript
const promises = [fetch("/users"), fetch("/roles")];
const allResults = await Promise.all(promises);
```

`Promise.all()` returns a promise that is fulfilled when all the promises fulfilled. If at least one promise is rejected, the returned promise is rejected. The rejection reason for the resulting promise is the same as the first rejected promise.

This behavior doesn't provide you with a direct way to get the result of all the promises when at least one of them is rejected. For example, in the code above, if `fetch("/users")` fails and the corresponding promise rejected, you don't have an easy way to know if the promise of `fetch("/roles")` is fulfilled or rejected. To have this information, you have to write some additional code.

The new `Promise.allSettled()` combinator waits for all promises to be settled, regardless of their result. So, the following code lets you know the result of every single promise:

```javascript
const promises = [fetch("/users"), fetch("/roles")];
const allResults = await Promise.allSettled(promises);
const errors = results
  .filter(p => p.status === 'rejected')
  .map(p => p.reason);
```

In particular, this code lets you know the reason for the failure of each rejected promise.

## New operators

A couple of new operators will make it easier to write and to read your code in very common operations. Guess which ones?

### The nullish coalescing operator

How many times you've seen and used expressions like the following?

```javascript
const size = settings.size || 42;
```

Using the `||` operator is very common to assign a default value when the one you are attempting to assign is `null` or `undefined`. However, this approach could lead to a few potentially unintended results.

For example, the `size` constant in the example above will be assigned the value `42` also when the value of `settings.size` is `0`. But the default value will also be assigned when the value of `settings.size` is `""` or `false`.

To overcome these potential issues, now you can use the *nullish coalescing operator* (`??`). The previous code becomes as follows:

```javascript
const size = settings.size ?? 42;
```

This grants that the default value `42` will be assigned to the `size` constant only if the value of `settings.size` is `null` or `undefined`.

### Optional chaining

Consider the following example:

```javascript
const txtName = document.getElementById("txtName");
const name = txtName ? txtName.value : undefined;
```

You get the textbox with `txtName` as its identifier from the current HTML document. However, if the HTML element doesn't exist in the document, the `txtName` constant will be `null`. So, before accessing its `value` property, you have to make sure that `txtName` is not `null` or `undefined`. 

The optional chaining operator (`?.`) allows you to have a more compact and readable code, as shown below:

```javascript
const txtName = document.getElementById("txtName");
const name = txtName?.value;
```

As in the previous example, the `name` constant will have the the value of `txtName.value` if `txtName` is not `null` or `undefined`; `undefined` otherwise.

The benefits of this operator are much more appreciated in complex expressions like the following:

```javascript
const customerCity = invoice?.customer?.address?.city;
```

You can apply the optional chaining operator also to dynamic properties, as in the following example:

```javascript
const userName = user?.["name"];
```

In addition, it applies to function or method calls as well:

```javascript
const fullName = user.getFullName?.();
```

In this case, if the `getFullName()` method exists, it is executed. Otherwise, the expression returns `undefined`.

<include src="TweetQuote" quoteText="The nullish coalescing operator and the optional chaining are now a reality in JavaScript."/>

## Using the New Features

Throughout this article, you got an overview of ES2020's new features, and you're probably wondering when you'll be able to use them.

According to [caniuse.com](https://caniuse.com/), all recent major browsers but Internet Explorer already support the new features brought by ECMAScript 2020. However, at the time of writing, Safari is not supporting the new `BigInt` data type and the `matchAll()` method.

The [latest version of Node.js](https://auth0.com/blog/nodejs-v-14-whats-new/) supports all the features as well, including [dynamic import](https://nodejs.org/api/esm.html#esm_import_expressions) for [enabled ECMAScript modules](https://nodejs.org/api/esm.html#esm_enabling).

Finally, also the latest versions of the most popular transpilers, like [Babel](https://babeljs.io/blog/2020/01/11/7.8.0) and [TypeScript](https://www.typescriptlang.org/docs/handbook/release-notes/typescript-3-8.html#-es2020-for-target-and-module), allow you to use the latest ES2020 features.

<include src="asides/JavascriptAtAuth0" />

## Summary

At the end of this quick journey, you learned the new amazing features you can use in JavaScript. Although the final specifications will be approved in June, you do not have to wait. Most popular JavaScript environments are ready. You can use them right now!


JavaScript: What's New in ECMAScript 2020

john-papa

John Papa is a dedicated father and husband, a professional Web Developer, and avid OSS and community advocate. He currently is a Developer Advocate for Microsoft and has formerly worked for Disney on several web and mobile applications that you may have used. His passions are coding and teaching modern web technologies and enjoying everything Disney with his family. John is a co-host of the Real Talk JavaScript podcast, author of the Angular Style Guide, and many popular Pluralsight courses. You can reach John on Twitter at @john_papa.

Principal Developer Advocate Lead

John Papa

kapehe-jorgenson

Kapehe is an R&D Content Engineer for Auth0 with a passion for learning and teaching. With her primary focus on ReactJS and JavaScript, she is impressed with what code can create for the web. Technology and web development are constantly evolving and naturally bring that need for continual learning. She enjoys writing tutorials, hosting local meetups, and learning with others to expand coding knowledge.

R&D Content Engineer

Kapehe Jorgenson

Learn about the top seven features and upgrades we get with Angular 9


[Angular](https://angular.io/) [v9](https://github.com/angular/angular/releases/tag/9.0.0) is here! Along with it, we now get [Ivy](https://angular.io/guide/ivy), the default compiler that can reduce bundle size, improve debugging, and much more. It’s been almost three years since Angular released an update this large (ironic, since this update makes the code smaller!), and we can see it’s been worth the wait. 

![GitHub view of Angular v9](https://images.ctfassets.net/23aumh6u8s0i/5Vh6v8fQvKbKVPFL3QLRDi/81c0312083b87fd1ea130064e310a2c8/github-v9)

In this article, we are going to go over how to update from v8 to v9 and the **most Magnificent Seven things that Angular v9 has given us**. There are many things we can look forward to in this update, let’s talk about some of our favorites!

<include src="TweetQuote" quoteText="Angular v9 is here! Along with it, we now get Ivy!"/>

## Angular 9 is Ready for its Closeup

This upgrade has been through extensive testing. With more developers and projects using it, the bugs have been reported, and [over 300 have been fixed](https://github.com/angular/angular/issues?q=is%3Aissue+is%3Aclosed+label%3A%22comp%3A+ivy%22). Angular is used internally at Google for projects like [Google Domains](https://domains.google/) and [Firebase](https://firebase.google.com/). These projects will use new versions of Angular to test and validate before it goes beyond beta and RC. This upgrade is ready!

<include src="ebook-ads/Oauth2OidcGuide" />

Version 9 is more about changes to the framework, not the code that we wrote. This makes it easy for developers. To upgrade to v9, we won’t have to dive into individual files or components and update any code ourselves. The new Ivy renderer works with all our current code!

<include src="TweetQuote" quoteText="Angular v9 is more about changes to the framework, not the code that we wrote."/>

## How to Update from v8 to v9

We can find step-by-step instructions for updating from v8 to v9 on the [official update.angular.io](https://update.angular.io/). Let’s go over exactly what needs to happen to upgrade from Angular v8 to Angular v9.

> **Note:** Before starting the upgrade process, be sure to commit all changes to git. This will also be helpful to see how the upgrade modified certain files.

First, ensure we are using [Node v10.13 or later](https://nodejs.org/en/download/). It’s recommended to use the [Node 12.15.0 LTS](https://nodejs.org/en/) version since it will be supported!

Once we confirm our Node version, we will want to run the following command in our project’s directory:

```bash
ng update @angular/core@8 @angular/cli@8
```

This command will update our `@angular/core` and `@angular/cli` in our `package.json` for our project.

Once we run that, we will want to run:

```bash
ng update @angular/core @angular/cli
```

![Terminal - Updating to Angular 9 confirmation](https://images.ctfassets.net/23aumh6u8s0i/4DgcPvzI1DaT34ZVabV08M/044521f10274b02c4427e9737eb46aa1/terminal-updated-v9)

During the update process, we should see numerous messages telling us exactly what the CLI is updating. It will also tell us which files were modified. At a minimum, we should see the following files modified:

![VS Code view of files that were modified. tsconfig.app.json, angular.json, package-lock.json, package.json](https://images.ctfassets.net/23aumh6u8s0i/1u6tVi0ssjjkDaCFsmy7AP/2a99131ba3b1c095940be54dfc735865/files-modified)

We may see other files that get modified depending on where the project sits. For example, if the project has the older lazy load syntax or if the project is missing the `@injectable()` in a service file, those would also get updated.

Once complete, head to our `package.json`, and we will see that we are up-to-date with the latest Angular v9!

![View of package.json showing v9 updates](https://images.ctfassets.net/23aumh6u8s0i/2ju5ykqhOv1jioBXin99TJ/f1e495969baad55ddb8927b6e404a264/package-json-v9)

We have now updated from Angular v8 to Angular v9! Let’s explore more of the features.

## The Magnificent Seven

In this article, we are going to list the most “Magnificent Seven” features in Angular v9, all to the theme of movie titles. You get bonus points for spotting all the movie and television show references and listing them in the comments! 

## 1 - Honey I Shrunk Our App

It wasn’t accidental that the Angular team focused on helping our apps become smaller and making our apps faster than they were in previous versions of Angular. Our users expect the app experience to be fast. The Ivy compiler focuses on targeting our code with laser-beam accuracy to find and remove unneeded code.  

The Ivy compiler looks for parts of Angular that are not being used. It uses tree-shaking (a way of detecting unused code, also known as dead code removal), and it generates less code for each Angular component.

As the chart below shows, apps of all sizes can benefit from the Ivy compiler.

![Graph showing how Ivy improves app size](https://images.ctfassets.net/23aumh6u8s0i/56YEnzsya5yfLIBchND4Kz/51391832e85cf1fbd3b5302ff18b2f9b/ivy-size-improvements-2)
([Image credit](https://blog.angular.io/))

Once we update to Angular 9, we can run `ng build --prod` and notice how our file sizes shrink. 

## 2 - Ivy Knows What You Did Last Summer, in that Template

That’s right. Last summer, we wrote some pretty tragic code that we mostly forgot about. But Angular 9 hasn’t forgotten. We made poor choices in our templates and those errors are now detected by Angular 9. Fortunately, Angular is friendly enough to share those template errors with us in a clear and helpful way.

When we reference a component in a template, Angular expects that the component exists in the app. Imagine that we have this template:

``` html  

<div>
  <app-fake></app-fake>
  Hello {{hero.name}}
</div>

```

If no component exists that matches the `app-fake` selector, this is a problem. However, in Angular 9, when we run `ng build`, we get a very detailed error explaining that it knows exactly what we did wrong. 

![ng build error](https://images.ctfassets.net/23aumh6u8s0i/2PxhjJkLrkr942rXS2qCpM/38768b3bef6d50c8d43fd3b6b5699012/ng-build-error-2)

The error message very clearly tells us that it cannot find the component, shows us which component it is referring to, and it shows us exactly where this reference appears in the code! 

## 3 - Winter is Coming, and so is Our Angular Build

Ivy is so fast that we’ll have fewer opportunities to step away while waiting for our builds to complete. Prior to Angular 9, some of our app build times have felt like it would be a race to see what would come first: Winter or the completion of our Angular build.

Well, Ivy knows things about our apps and it always pays its debts. Ivy speeds up our build times significantly. Faster build times mean less stepping away from the computer while we build our apps. 

## 4 - Back to the Future, with AOT!

Remember that time before Angular 9 when we found out we had an [AOT](https://angular.io/guide/aot-compiler) error that surfaced only in Continuous Integration (CI) or, heaven forbid, in production? Hello McFly! That’s about when we want to go back in time and correct our mistakes by running `ng build --prod`. 

Why did this happen? Because prior to Angular 9, the AOT compilation step only ran when we executed using the production flag `ng build --prod`. It seems that AOT compilation would have made the dev builds too slow to be a good experience, so the Angular team opted (thankfully) to only put AOT compilation in the production builds. While this was fine as long as we remembered to run it before pushing or merging (or whatever your CI process is), it certainly had its flaws.

What we wish is that in the future, we can see the AOT errors in all builds. Well, that future is here!

The good news is that Angular 9 brings AOT to the dev build, too! The Ivy compiler makes our builds much faster. So fast that it makes it reasonable to pull AOT into the dev builds (and of course, `ng serve`) without causing significant delays in build times. 

The bottom line is that AOT is now dev and prod. Who cares? We do! AOT errors that never appeared in a dev build used to surprise us when we ran with a prod build. Now that dev and prod use AOT, we’ll find these errors early and we’ll see good error messages explaining how to fix them.

## 5 - The Phantom Template Variable Menace 

There once was a time when we could create phantom variables in our templates - variables that had never been referenced in the template’s associated component. Creating these phantom variables can menace our applications. All of this changes in Angular 9 as we now get a compiler error when we create a template variable that has not been defined in a component.

Let’s take a look at what this means. Imagine we have a template and we set a `villain` variable when a user clicks on a `<div>`. Now, we may have intended for them to set the `hero` model, which exists in the templates’ component. But we might have made a copy and paste error. Or maybe we really wanted to create a `villain` model, in which case we should have defined the model in the component file.

``` html  

<div (click)="villain = { id: 1, name: 'john' }">

```

When we build with Angular 9, this error will be displayed. Notice it tells us that the villain doesn’t exist in the component. It even shows us exactly where to find this code. 

![Error handling in Components](https://images.ctfassets.net/23aumh6u8s0i/7mXFNSasHpo4UbSt5BOXox/9e3ee6d379e6a035e2d346793a3a84b6/component-errors-2)

So what can we do about this? Well, if the intention was to set a hero, now we know we have to change it. If we really need to set the `villain` model in the template, just create the `villain` model in the component. Before Angular 9, this may have gone unnoticed, but now Ivy detects and alerts us about all template-only variables.

## 6 - Brave: An ng update Story

At times running `ng update` with Angular 8 (or previous) is amazingly easy and helpful. And other times, it felt like we were poking a sleeping bear. It’s almost like the magical wisps inside of the Angular CLI were playing games with us. 

Angular 9 now has a vastly improved `ng update` experience. It is more accurate, more consistent, and more transparent. Here are three key reasons why the Angular CLI is now more reliable than ever:

1. It now uses the latest version of the CLI to perform all updates.
2. Now displays a detailed diary depicting exactly what it is doing during the update.
3. Refactors our code where it detects a need to be compatible with the latest version.

Since a detailed diary of the update progress is displayed, we always know what code is being refactored. Plus, we can also check our git changes for any refactored code. Here are three examples of the scenarios that the Angular CLI will refactor for us:

* Update lazy loading syntax to use dynamic imports.
* Removes the `static` flag from dynamic queries. As of Angular 9, the "static" flag defaults to false and is no longer required for our view and content queries.
* Update our services without @Injectable to use `@Injectable`.

This is really convenient, so we do not have to know every new change in Angular 9 (and beyond). The Angular CLI knows these changes, reports to use what changes it is looking for, and then refactors when it finds any places in our code that need those changes.

## 7 - The Legendary Journey of Entry Components

A long time ago, in a time of myth and legend, only one person knew when we needed to define `entryComponents` in our NgModules. Ok, that’s not entirely accurate as many of us have used `entryComponents`. But do we always remember what they do and when they are needed?  Or was that knowledge lost in our mind? With no more hope of resurfacing than that of a lost soul in the Minotaur’s maze.

Lest we forget, this was needed when we used a component (perhaps in code), but it never appeared in a template. Prior to Angular 9, specifying the component in the `entryComponents` array was the recommended way to tell Angular, “Hey, we have a component here!”.

```typescript
@NgModule({
  // ...
  entryComponents: [ModalComponent]
})
export class AppModule {}
```

Here is a scenario where we might have a component that is not referenced in a template. Imagine that we create a `ModalComponent` which shows a modal dialog to the user, letting them select “yes” or “no”. When using Angular Material, we could use the `MatDialog.open()` function and pass it the `ModalComponent` to display to the user. This could be the only place in the app that the component is referenced. Prior to Angular 9, this must be set in the `entryComponents` array in a NgModule. Otherwise, Angular would not know what `ModalComponent` is.

Wow, this is something we probably don’t do that often. However, when we do need this feature, we often spend some time searching Google for how to solve it. 

The good news here is that in Angular 9 there have been changes to the compiler and runtime that make it so we no longer need to specify this in the `entryComponents` array. Angular will find the component on its own. 

The bad news, if we can call it bad news, is that Angular will not remove the component from the `entryComponents` array for us. So we should search our code after updating and manually remove them. Then test … always test. Just in case.

## Upgraded Tooling

One of the best things about Angular is the amazing and helpful ecosystem. When we upgrade to version 9 we really want to make sure we’re using the latest tools that go with Angular. Here are two tools we recommend installing or upgrading:

1. [VS Code](https://code.visualstudio.com/?wt.mc_id=angular9-blog-jopapa) editor
2. [Angular Essentials Extension](https://marketplace.visualstudio.com/items?itemName=johnpapa.angular-essentials&wt.mc_id=angular9-blog-jopapa) for Visual VS Code

The Angular Essentials extension includes a set of useful extensions to enhance the development experience with Angular. The one that stands out most is the [Angular Language Service](https://marketplace.visualstudio.com/items?itemName=Angular.ng-template&wt.mc_id=angular9-blog-jopapa), which adds a lot of features to VS Code, so it knows how to help us write our Angular code. Others include useful Angular snippets, ESLint, and debugging extensions.

<include src="asides/Angular" />

## That’s All Folks!

It looks like we have a lot to look forward to with Angular v9. We have faster build times, a more accurate `ng update`, and Ivy is making smaller bundle sizes, just to name a few! The Angular team has been working countless hours on this version and we can now reap the benefits!

Which is your favorite of those **Magnificent Seven**? Which one will help your project the most? Let us know in the comments below!

---


Angular 9: What’s New?

Learn about the new features and products in the recent Laravel 6.0 release.

What's New in Laravel 6.0?

ec1c9350c3d2306e7c42b9307bea93de?s=480&r=pg&d=https%3A%2F%2Fcdn avatar

ec1c9350c3d2306e7c42b9307bea93de?s=480&r=pg&d=https%3A%2F%2Fcdn

I like working at Auth0 because I’m interested in how to scale a startup and training the next generation of identity experts.

Strategic Operations and Technical Field Enablement Director

Yvonne Wilson

Five critical identity features to help you rapidly innovate your business strategy


You can’t buy digital transformation off the shelf.

Digital transformations are driven by a fundamental rethinking of business strategy that creates new business models and innovative services that offer your customers more personalized experience and significant new value.

A few examples of innovative digital transformation:

- **Provide expertise**: A medical insurance company provides a smartphone app that helps people evaluate illnesses and obtain advice on whether they need to visit a doctor. The ability to get immediate advice provides assurance to customers without adding the cost of non-essential visits to doctors offices and emergency rooms.

* **Utilize simulations**: Manufacturers of expensive equipment that is costly to reconfigure such as wind turbines in a wind farm add sensors that feed into simulation apps. Simulation enables customers to experiment faster and with less cost to identify the best configuration to use with a product. This helps customers maximize the benefits they get from products faster, which increases customer satisfaction.

- **Change revenue model**: Vendors of physical products convert a product into a subscription service to create an ongoing revenue stream, with apps to manage the new service. For example, instead of selling lightbulbs, providing lighting as a service so building owners no longer worry about buying and replacing lightbulbs. This provides a helpful service to customers and an ongoing, service-based revenue stream to the lightbulb vendor.

* **Monitor systems**: Manufacturers can add monitoring capability into products to enable remote monitoring via apps to give customers status and early warning of likely failures in equipment or services they’ve purchased. This applies to everything from medical devices to heavy construction equipment to locomotives. Access to granular sensor data helps prevent downtime in critical equipment and increases customer visibility and satisfaction.

* **Multi and Omnichannel**: Almost any business can use digital transformation to integrate customer experience across multiple sales channels and platforms to deliver better customer experience. Orders placed on a website can send alerts with shipping updates or in-store pickup data to a customer’s phone. A customer in a retail store can take a picture of a product in an app that pulls up all the relevant product information from the website. This provides better information to a customer and enables staff to spend time helping customers in other ways.

Digital transformation drives how an organization combines technology, people, and processes to deliver new or creatively updated services that help customers solve problems, gain new insights and save time.

For innovation to provide a competitive advantage, it has to be unique to your business, which often requires some custom applications. The applications created as part of digital transformation require several different Identity Management features.

## **Critical Identity Features for Digital Transformation Apps**

Auth0 has worked with customers in many industries on creating the identity management foundation for their digital transformations. We’ve identified five common identity requirements for successful digital transformation projects.

### Feature #1: Readying Authentication

Almost every digital transformation project involves applications that need to authenticate users, but most teams can’t afford the time to research obscure authentication protocols and it’s highly likely that the project could require consolidating or connecting to legacy systems. Ultimately, teams need a secure authentication platform that’s easy to integrate with applications and that solves the problem of legacy user stores, so the team can focus on delivering innovation and business value.

If a project involves sensitive data, you’ll want to offer your customers the added protection of multi-factor authentication that’s convenient to use.

### Feature #2: Extensible User Profiles for Customized User Experience

Delivering a personalized experience to users requires that applications have access to user profile data. This requires the ability to consolidate or integrate disparate sources of user profile data if they are spread across legacy repositories. It also frequently calls for the ability to customize the user profile information available to your applications.

### Feature #3: Swiss Army Knife of Identity &mdash; Authentication Hub

Many digital transformation projects involve collaboration and the need to authenticate users from partners, business customers, and consumers. Some organizations will demand that you support their chosen identity service (bring-your-own-identity) so they retain centralized control over their users’ accounts. This requires supporting many different authentication protocols such as SAML, OIDC, and myriad custom implementations by different social providers.

### Feature #4: Omnichannel &mdash; Be Mobile Ready

As digital transformation initiatives progress, they need to integrate services across different device channels, known as providing multi-channel and omnichannel service. This demands a similar authentication experience across different device types for an integrated customer experience.

### Feature #5: Authorization

Digital transformation projects require the agility of application architectures based on APIs which can be evolved rapidly. Security demands proper authorization to access those APIs for both applications and users. This requires an extensible authorization platform to govern access for users, applications, and APIs.

<include src="TweetQuote" quoteText="Find out what are the critical identity features often required for #digitaltransformation wins."/>

## **Auth0 Has You Covered**

Auth0’s authentication and authorization platform can be easily integrated into your applications and provides each of the critical features described above, so your project is successful.

### Authentication

Auth0 provides an authentication service, complete with user login and signup features, that can be customized and branded, as needed, with minimal effort. Auth0 can support authentication against legacy databases or help you migrate users out of legacy repositories if needed. With Auth0 you can also turn on multi-factor authentication with a toggle, immediately offering stronger authentication to protect your customers’ data.

[_Auth0's Lightweight Universal Login_](https://auth0.com/universal-login)

![Auth0's Lightweight Universal Login Auth0](https://images.ctfassets.net/23aumh6u8s0i/54lZ5srDBAM0dqWSRkdxXk/f4260dcf2af6e7b5b4a52c62769e0745/lightweight-login)

### User Profiles

Auth0 provides options for migrating and consolidating user profiles from legacy databases, and the ability to deliver customized user profile data to applications. Auth0 features can optionally be used to migrate users from legacy data stores into one consolidated repository. You can also customize the user profile data within Auth0 and deliver selected custom attributes to applications in signed security tokens. This enables your applications to deliver a more customized experience for each user.

[_Customized User Profile_](https://auth0.com/docs/users/concepts/overview-user-metadata?origin_team=T025590N6#metadata-usage)

```json
{
  "emails": "jane.doe@example.com",
  "user_metadata": {
    "hobby": "surfing",
    "room_preferences": ["king", "finance_news", "quiet"],
    "preferred_language": ["french"]
  },
  "app_metadata": {
    "plan": "full",
    "hotel_addons": ["tour", "laundry", "biz-center", "spa"],
    "last_visit": "2019_05_09"
  }
}
```

[_User Profiles_](https://auth0.com/docs/users/concepts/overview-user-profile)

![Image of Auth0 Dashboard showing the User Details view](https://images.ctfassets.net/23aumh6u8s0i/2g54DuahgxCZudEUI1NY6o/dd7f81ff935b5be0ca273119b19aec82/user1)

> You can use the [Auth0 Dashboard](https://auth0.com/docs/dashboard) to manage your users.

### Authentication Hub

Auth0 supports connections to a wide array of identity providers so your application doesn’t have to directly support different protocols and the implementation specifics of each one. This allows you to easily say, "yes!" to customers and partners who demand a bring-your-own-identity model.

[_Auth0 Social Identity Providers_](https://auth0.com/docs/identityproviders#social)

![An image of Auth0 social identity providers](https://images.ctfassets.net/23aumh6u8s0i/37EouP087RNF0DWID3IlnJ/5348b16e147d1a43e56f4113ed188967/auth0-social-connections)

[_Auth0 Enterprise Identity Providers_](https://auth0.com/docs/identityproviders#social)

![An image of Auth0 enterprise identity providers](https://images.ctfassets.net/23aumh6u8s0i/5rYXcu5W2mlJja6MoI54wl/e19e75742220340589a7bef2a337fa18/enterprise-social-connections)

### Cross-Platform Support

Auth0 provides SDKs for popular languages and platforms, enabling you to deliver a unified authentication experience across both desktop and mobile platforms to support your multi-channel and omnichannel initiatives.

[_Auth0 SDKs_](https://auth0.com/docs/libraries#auth0-sdks)

![An image of Auth0 supported frameworks and languages](https://images.ctfassets.net/23aumh6u8s0i/6JeMxaoncqQuRu0BaW9UPQ/708fa3cadce011d0970c3173dca33124/auth0-sdks)

[_Authentication Platform_](https://auth0.com/)

![Authentication Platform](https://images.ctfassets.net/23aumh6u8s0i/1anAYpgtGaLXDdenMcZRZx/72a706ca6ef5c18d2ae004b5ba7cd385/authentication-platform)

### Authorization

Auth0’s authorization features make it convenient for you to protect the data you manage by controlling exactly what each application and user can do. We provide a convenient configuration interface and deliver carefully scoped security tokens to your applications.

[_Authorization_](https://auth0.com/docs/authorization)

![Image of the Permissions view of the API section from the Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/6NZD2ZUvbHF2ipeBuENgql/a6e412e9acd339a0d50de089d56df44b/api-def-permissions)

[_API Authorization_](https://auth0.com/docs/api-auth)

```bash
https://YOUR_DOMAIN/authorize?
    response_type=code&
    client_id=YOUR_CLIENT_ID&
    redirect_uri=https://YOUR_APP/callback&
    scope=SCOPE&
    audience=API_AUDIENCE&
    state=STATE
```

> Example of making a [request to the authorization URL](https://auth0.com/docs/flows/guides/auth-code-pkce/call-api-auth-code-pkce#example-post-to-token-url) to get an authorization code.

<include src="TweetQuote" quoteText="You can't afford to be slowed down by identity management challenges while your team learns obscure authentication protocols. Speed up your #digitaltransformation with Auth0."/>

## Hitting Delivery Dates with Identity

You can’t buy digital transformation off the shelf, but you can buy an identity platform that starts delivering value out-of-the-box. With Auth0, you can easily consolidate legacy repositories of customers without password reset with [_trickle migration_](https://auth0.com/docs/users/guides/configure-automatic-migration), implement [_Single Sign On_](https://auth0.com/docs/sso/current) (SSO) for customer convenience, and take advantage of the latest standards and best practices for authentication and authorization, like OIDC and OAuth 2.0.

Competitive pressures and emerging privacy regulations demand that you innovate or renovate applications and deliver digital transformation at pace. You can’t afford to be slowed down by identity management challenges while your team struggles with complex authentication protocols. Your project team can focus on innovation and hitting delivery dates if you have an identity management solution that is fast to adopt — and easily extended as your project evolves.

In this post we’ve focused on the 5 common identity needs experienced across many different digital transformation projects, and how Auth0 supports those requirements. 

If you’d like to learn more about how Auth0 can help you score an early digital transformation win with identity, please reach out to an [_Auth0 resource_](mailto:sales@auth0.com).

<include src="asides/AboutAuth0" />


Why Identity is an Easy Win for Digital Transformation

Use public support to your advantage. Roll out privacy features that build your brand's integrity.


In the wake of the EU-centric [_General Data Protection Regulation (GDPR)_](https://auth0.com/blog/get-ready-for-gdpr/), several other nations, as well as states in the U.S., followed suit with similar privacy regulations. One of the landmark follow-on initiatives, the [_California Consumer Privacy Act (CCPA_)](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375), was approved in June 2018. CCPA will take effect on January 1, 2020.

The Act [builds on existing California law](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=BPC&division=8.&title=&part=&chapter=22.&article), which requires businesses to disclose basic information on data collection practices and data breaches.

In January 2020, California residents, who share their state with many of the world’s tech giants, may ask companies handling their data to disclose what personal information has been collected, and how and why they’ve collected it. Residents will also be able to “opt out of” having their data shared with or sold to third parties.

If companies do not or cannot comply — residents have the right to sue. Many companies are already feeling the pressure.

According to Robert L. Wallan, a partner with Los Angeles-based firm Pillsbury Winthrop Shaw Pittman LLP, [as cited in *Insurance Journal*](https://www.insurancejournal.com/news/west/2019/07/01/530904.htm):

> “You’re going to see some class-action litigation, my prediction is, pretty early.”

Despite the threat of hefty fines ([$7,500 per violated record](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375)) — as well as reputational damages — for noncompliance, many teams are still not prepared. If you’re a chief security officer (CSO) or team lead responsible for safeguarding the data of your users, this article provides an update on major points in the current version of the CCPA — and ways to quickly meet these requirements.

In doing so, you could set yourself apart from [86%](https://fortune.com/2019/03/19/companies-california-privacy-law/) of organizations who are not yet compliant (according to a TrustArc survey reported on in *Fortune*), build greater credibility with your users, and set yourself up for more sustainable growth.

## CCPA: Major Points (the Good and the Bad) to Know

As of the [_July 1, 2020 enforcement date_](https://www.huntonprivacyblog.com/2018/09/01/ccpa-amended-enforcement-delayed-substantive-changes-made/), the Attorney General will support California residents who request the following from companies that collect and use their personal information (PI):

* the particular pieces of personal information they collect,
* the categories of sources that provided their data,
* the categories of third parties with whom they share the data, and
* their commercial reasons for collecting or selling the data.

The CCPA broadly [defines PI](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375) as information about a California resident that “identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” This covers standard items, such as:

* SSN
* driver’s license and passport numbers, purchasing histories,
* internet activities,
* geolocation data, and
* professional or employment-related information.

It also includes “inferences drawn about a California resident” — personal details such as interests, aptitudes, or predispositions that a company uses to [create a customer profile](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/). For a full list of PI as defined by the CCPA, see [here](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375).

Under the CCPA, residents may also request that companies delete any personal information (subject to certain exceptions). As mentioned above, they may also opt out having their data sold.

While the Act isn’t set to be enforced until July 1, 2020, it covers personal data twelve months prior to the January 1, 2020 effective date. This means that the CCPA *already* applies to companies’ data collection, storage, and usage practices today—and throughout 2019. If you don’t have a process in place to handle these specific requests, it’s time to create one.

There are more important criteria to note. If an individual does not want their information sold, the CCPA gives them the right to maintain a consistent level of service and steady costs (i.e., not be discriminated against for not consenting). Under the Act, companies are required to clearly display a link that says "do not sell my data" at the bottom of any page that collects personal information. The CCPA also increases fines and penalties for companies that do not take reasonable measures to secure consumer data—again, a civil penalty of up to $7,500 for each violation.

The Act exclusively applies to businesses that:

* have annual gross revenues greater than $25,000,000;
* buy, sell, or otherwise use personal information of 50,000 consumers, households, or devices each year; or
* derive 50% of their annual revenue by selling personal information.

Since being approved in June 2018, the CCPA has already [_been amended_](https://www.dataprivacymonitor.com/ccpa/california-amends-landmark-privacy-law-delaying-enforcement-and-making-revisions/) — and it’s likely to be revised further. Numerous bills could make the CCPA even more stringent. If the CCPA applies to your company, it’s critical that you’re up to speed to avoid penalties. At the same time, this might feel like an overwhelming task when the regulations continue to grow more numerous and complex.

### The Bad News

The practice of collecting consumer data has expanded without regulation for years. Many companies rapidly and successfully built themselves on this information, which underpins their marketing, product development, industry research, and corporate strategy. Now, they must make major operational changes, including the following:

* Tighten and clearly communicate the process whereby customers can request access to their data, have it erased, or transfer it to another data controller.
* Create new systems with better [user management](https://auth0.com/user-management) and/or potentially hire more IT staff.
* Consider outsourcing core services to an [expert managed services provider](https://auth0.com/blog/managed-service-providers-myths/) if the company can’t cover expanded data-privacy needs in-house
* Work with pared-down data sets in the event that consumers withdraw their information.

Figuring out what to do to bring your company into compliance has never been more important — but you don’t have to work through it alone.

### The Good News

Since California is a hotbed of startups, many young and medium-sized teams are flexible by nature. In contrast to industries like insurance, where many teams have processes set in stone over decades, most tech companies and [tech unicorns](https://auth0.com/blog/so-you-want-to-be-a-unicorn/) are more nimble and willing to adapt to changing circumstances. Already, most of these have sent out updated privacy-policy emails to their customers:

![Everlane changes its privacy policy making it easier to understand](https://images.ctfassets.net/23aumh6u8s0i/1E4wAnIObdgK5o5DS08bUP/063ec75b42428fec586862450e9da822/everlane-changes-privacy-policy-making-it-easier-to-understand)

![Houzz updates its policies to make them more transparent](https://images.ctfassets.net/23aumh6u8s0i/iH4yYW88yxsjFttg4ldXO/bdc27ad70562353ce495b040e03698cd/houzz-updates-policies-to-make-them-more-transparent)

In anticipation of CCPA enforcement — as well as the implementation of data privacy policies across [107 nations](https://unctad.org/en/Pages/DTL/STI_and_ICTs/ICT4D-Legislation/eCom-Data-Protection-Laws.aspx) and [nearly 15 other U.S. states](https://www.dataprivacymonitor.com/ccpa/the-california-consumer-privacy-act-frequently-asked-questions/) — other industries are quickly following suit. In addition to email, some best practices are arising across sectors on the back end, including [_identity and access tools_](https://auth0.com/b2e-identity-management-for-employees), specialized managed service providers, [more efficient deletion of user data](https://segment.com/blog/preparing-for-the-ccpa-and-the-future-of-privacy-regulation/), and enhanced anomaly protections for suspicious user behavior.

## Anomaly Detection

[Many companies are taking advantage of](https://twitter.com/intent/tweet?text=%22Auth0+has+anomaly+detection+to+protect+consumer+information.%22%20via%20@auth0%20http://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/) [anomaly-detection tools](https://auth0.com/docs/anomaly-detection) to ensure that the users accessing consumer information are (1) who they say they are and (2) behaving appropriately. With large organizations giving access to a wide swath of users both internally (IT staff, marketers, managers) and externally (third-party contractors or consultants), it can be difficult to figure out who is logging in when and from where, and who is using what device(s). Implementing identity access and management tools that incorporate anomaly detection can be essential for avoiding fraudulent practices.

![Auth0 has anomaly detection to protect consumer information](https://images.ctfassets.net/23aumh6u8s0i/4bGZ8v04Sr8DuJR9hXNeYg/583bb6a4ad7a7f7c7e4b02e8a7df8c69/auth0-has-anomaly-detection-to-protect-consumer-information)

With Auth0, anomaly detection is customizable. Once enabled, you can set rules that alert administrators to any suspicious activity and block login attempts by specific users if, say, they are working with data they do not have authorization to use or they fail to enter the system with the correct password.

<include src="TweetQuote" quoteText="Auth0 has anomaly detection to protect consumer information."/>

Teams have been testing and finding early success with these and other new features, like [user dashboard views](https://auth0.com/docs/getting-started/dashboard-overview). Even if you're not a hot tech startup, you still have the advantage of proximity to some of the most cutting-edge technologies and resources in the world.

## Seize the opportunity

The CCPA has strong momentum to become even more robust. As consumers continue to feel the damages from the massive Target and Equifax breaches, Cambridge Analytica’s [_data leaks_](https://auth0.com/blog/cambridge-analytica-and-facebook/), the recent [Marriott breach](https://auth0.com/blog/marriot-starwood-data-breach-5-steps-to-protect-your-data/) and [British Airways incident](https://www.nytimes.com/2019/07/08/business/british-airways-data-breach-fine.html) — they’re pushing their representatives for change. The original ballot initiative that gave rise to the CCPA had [>600,000 signatures](https://www.wired.com/story/california-unanimously-passes-historic-privacy-bill/) when it passed, nearly 2x the 366,000 minimum requirement. Private and public sector coalition backers included the Consumer Federation of California, DuckDuckGo, Consumer Reports, BLUR, DeleteMe, Catalina's List, the Center for Public Interest Law, the Parent Coalition for Student Privacy, and the Academy of Integrative Health & Medicine.

Instead of facing CCPA enforcement with anxiety or opposition, use this swelling public support for the measure to your advantage. Get ahead of the curve in rolling out privacy features to your users on the front end, improve your back-end policies with better identity and access management software to protect your customers, and build a reputable brand in difficult times.

<include src="asides/AboutAuth0" />


Brace Yourself for CCPA Aftershocks (2019 Update)

sambiopic

I'm Director of Developer Relations and a Google Developer Expert for Angular and Web Technologies. I believe anyone who wants to learn to code should be able to learn code and I love teaching. When I'm not coding or writing, you'll find me outside hiking or camping in the beautiful Pacific Northwest.

Director of Developer Relations

Sam Julien

NgRx 8 features improved developer ergonomics, less boilerplate, runtime checks, and easier error handling.


**TL;DR:** NgRx 8 introduces a host of improvements, including `createAction`, `createReducer`, and `createEffect`. These helper functions drastically reduce (no pun intended) boilerplate, which boosts developer productivity.

## NgRx 8: A Massive Win
Shortly after the [release of Angular 8](https://auth0.com/blog/angular-8-differential-loading/), the NgRx team released their own version 8. It was a big release full of fantastic improvements to the library. While I'll let you read the [official release announcement](https://medium.com/ngrx/announcing-ngrx-version-8-ngrx-data-create-functions-runtime-checks-and-mock-selectors-a44fac112627) by [Tim Deschryver](https://twitter.com/tim_deschryver), here are the highlights:

- [`angular-ngrx-data`](https://github.com/johnpapa/angular-ngrx-data) by [John Papa](https://twitter.com/John_Papa) and [Ward Bell](https://twitter.com/wardbell) is now officially part of NgRx as [`@ngrx/data`](https://github.com/ngrx/platform/tree/master/modules/data)
- [Runtime checks](https://ngrx.io/guide/store/configuration/runtime-checks) are now available to check that state and actions aren't mutated and are serializable (these replace the `ngrx-store-freeze` package)
- Fully isolated unit tests are now available thanks to [mock selectors](https://ngrx.io/guide/store/testing#using-mock-selectors)
- There have been a couple of improvements to `@ngrx/router`, including a new [minimal `routerState` option](https://next.ngrx.io/guide/router-store/configuration)
- There are now NgRx snippets in John Papa's [Angular Snippets](https://marketplace.visualstudio.com/items?itemName=johnpapa.Angular2) VS Code extension
-  [Alex Okrushko](https://twitter.com/AlexOkrushko) and [Wes Grimes](https://twitter.com/wesgrimes) have joined the NgRx team (well deserved!)
  
I've saved the best for last, though, and it's the subject of this article:

- `createAction`, `createReducer`, and `createEffect` helper methods *drastically* reduce boilerplate and improve development time

We're going to dig into what that means and how these functions will make your life better, but before we do that, we should make sure you know how to update to version 8 to take advantage of these new features.

<include src="TweetQuote" quoteText="NgRx 8 features improved developer ergonomics, less boilerplate, runtime checks, and easier error handling!"/>

## How to Update to NgRx 8
In order to update to NgRx 8, you'll need to be sure your project is updated to Angular 8. You can update your Angular CLI globally by running this command:

```bash
npm install -g @angular/cli
```

In a project that needs to be updated to Angular 8, you can run the following:

```bash
ng update @angular/cli @angular/core
```

You can then run the following to update to NgRx 8:

```bash
ng update @ngrx/store
```

When working on this article, I ran into a bit of a problem with the TypeScript version. It seems like there was a conflict between the required versions, so I had to manually lock in version `3.4.3`.

If you're using `ngrx-data`, you can easily migrate to `@ngrx/data` with this command:

```bash
ng add @ngrx/data --migrate
```

For a more thorough explanation of this process, Wes Grimes has written a great article on how to [upgrade to Angular 8 and NgRx 8](https://dev.to/angular/how-to-upgrade-your-angular-and-ngrx-apps-to-v8-4iip). For more specific details on migration to NgRx 8, check out the official [migration guide](https://ngrx.io/guide/migration/v8). Finally, don't forget that Angular has an [official update tool](https://update.angular.io) to help with moving to new versions of Angular.

With that out of the way, let's get to the fun stuff!

## createExcitement: The New NgRx 8 Helper Functions
One of the most common complaints about NgRx (and the Redux pattern in general) is that there is too much boilerplate. Once you dig into the library and the pattern, though, you start to understand that the initial setup is a completely worthwhile investment when you're managing state in large, complex applications (which is what NgRx is designed for!).

That being said, the NgRx team has listened to the developer community and made some huge improvements in "developer ergonomics" (a fancy way to say making it easier to write code) with version 8. Most of these improvements are due to a refactor of how actions, reducers, and effects are set up. There are now helper methods that are easy to understand and take less code to write. Let's take each of them in turn.

### createAction
As my friend [Mike Ryan](https://twitter.com/MikeRyanDev) says, "Actions are the gluten of the NgRx loaf." Indeed, they are the core of any NgRx application. Great care and attention are required in deciding what actions your app needs. Unfortunately, actions take a lot of code to set up. Just look at this excerpt from the application we built in my original [NgRx Authentication](https://auth0.com/blog/ngrx-authentication-tutorial/) tutorial:

```typescript
// src/auth/actions/auth.actions.ts (excerpt)
export enum AuthActionTypes {
  Login = '[Login Page] Login',
  LoginComplete = '[Login Page] Login Complete',
  LoginFailure = '[Auth API] Login Failure'
}

export class Login implements Action {
  readonly type = AuthActionTypes.Login;
}

export class LoginComplete implements Action {
  readonly type = AuthActionTypes.LoginComplete;
}

export class LoginFailure implements Action {
  readonly type = AuthActionTypes.LoginFailure;

  constructor(public payload: any) {}
}

export type AuthActions =
  | Login
  | LoginComplete
  | LoginFailure;
```

This excerpt only contains three of the eight actions in that application and it's a very small app! As Alex Okrushko points out in his excellent article on [the new action creators](https://blog.angularindepth.com/ngrx-action-creators-redesigned-d396960e46da), enums and strings also make it very difficult to see where actions are used. And don't get me started on those union types! You can see why a change was needed.

Enter the new `createAction` method. With `createAction`, you pass in the action name along with an optional `props` function with a specified argument type as a destructured object. 

Yikes, that's a lot of jargon. Let me explain that with an example. 

Let's say I have an action called `booksLoaded` that needs to receive an array of books (`books`) of type `Book[]` when created. My `props` function for `createAction` would be `props<{ books: Book[] }>()`. (With [destructuring](https://auth0.com/blog/a-rundown-of-es6-features/#ECMAScript-2015-Features), `{ books }` is the equivalent of `{ books: books }`.)  

```typescript
export const booksLoaded = createAction(
  '[Books API] Books Loaded', 
  props<{ books: Book[] }>()
  );
```

That way, when I create a new action of this type, I can directly pass the array of books into the constructor: `new booksLoaded({ booksFromServer })`.

So, the above authentication actions would be refactored like so:

```typescript
export const login = createAction('[Login Page] Login');

export const loginComplete = createAction('[Login Page] Login Complete');

export const loginFailure = createAction(
  '[Auth API] Login Failure', 
  props<{ error: any }>()
);
```

Mind-blowing, right?

There are two things to notice here. First, notice that the action constant names have gone from Pascal case (`LoginFailure`) to camel case (`loginFailure`). This is due to actions changing from classes to functions and is a standard JavaScript style convention. Don't let that trip you up, but be mindful of that in refactoring.

Second, notice that I renamed `payload` to `error` because it is more descriptive. (I could have also given it a new type like `Error`, but it doesn't matter much in this example). While this is a great new feature with the redesigned action creator function, be careful of doing this. Do a search through your code to avoid breaking other parts of the app relying on a `payload` property (a great reminder from [Gregor Woiwode](https://medium.com/@gregor.woiwode/ngrx-8-meet-the-new-upcoming-factory-methods-of-the-next-major-release-a97a079cc089)). If you rename `payload` in the action creator, be sure to change it everywhere.

There's one last great feature of the new action creators. You can now specify a default value of a `prop` argument. For example, in the above `loginFailure` action, I could provide a default error message:

```typescript
export const loginFailure = createAction(
  '[Auth API] Login Failure',
  (errorMessage = 'Error logging in') => ({ payload: { errorMessage }})
);
```

This would be a great backup in case the server fails to provide an error message for some reason.

To add one of these new action creators to your application, you can use the [updated action schematic](https://ngrx.io/guide/schematics/action):

```bash
ng generate @ngrx/schematics:action myNewAction --creators
```

This command will generate a new file called `my-new-action.actions.ts` containing a constant named `loadMyNewAction` using the `createAction` function.

<include src="TweetQuote" quoteText="The new action creators of NgRx 8 drastically reduce (no pun intended) development time when adding new features!"/>

### createReducer
The new way to create actions is incredible, but it doesn't stop there. Reducers are also now easier to write thanks to the `createReducer` method.

Here's a typical example of a reducer you might find in a burger restaurant app:

```typescript
export function reducer(
  state = initialState,
  action: BurgerApiActionsUnion
): State {
  switch (action.type) {
    case BurgerApiActionTypes.LoadBurgerCollection: {
      return { 
        ...state
        loading: true
      };
    }

    case BurgerApiActionTypes.LoadBurgersSuccess: {
      return { 
        loaded: true,
        loading: false,
        ids: action.payload.map(burger => burger.id)
      };
    }

    default: {
      return state;
    }
  }
}
```

This is a simple example, but as it scales up, you'll have a ton of case statements that will make understanding this code difficult. It gets messy fast (just like eating burgers, really).

With NgRx 8, you can use `createReducer` instead:

```typescript
const burgerReducer = createReducer(
  initialState,
  on(BurgerApiActionTypes.loadBurgerCollection, state => ({
    ...state,
    loading: true
  })),
  on(BurgerApiActionTypes.loadBurgersSuccess, (state, { burgers }) => ({
    loaded: true,
    loading: false,
    ids: burgers.map(burger => burger.id)
  }))
);
```

Much cleaner, isn't it? Each case uses the `on` function that receives the action and a function to modify state. 

The `on` function can also take multiple actions, making it easy to grow the reducer function. For example, it's common for the success of a record addition and the failure of a record deletion to result in the same state. An example of this is when an app state includes both a collection of data (which should match what's on the server) and an array of IDs for faster lookup (which is maintained in memory). In order to make sure the array of IDs always matches what's on the server, it's necessary to account for failures of adding or deleting records.

Here's an example of that with the burger application:

```typescript
const burgerReducer = createReducer(
  // ...other cases,
  on(
    CollectionApiActions.addBurgerSuccess,
    CollectionApiActions.removeBurgerFailure,
    (state, { burger }) => {
      if (state.ids.indexOf(burger.id) > -1) {
        return state;
      }
      return {
        ...state,
        ids: [...state.ids, burger.id],
      };
    }
  ),
  on(
    CollectionApiActions.removeBurgerSuccess,
    CollectionApiActions.addBurgerFailure,
    (state, { burger }) => ({
      ...state,
      ids: state.ids.filter(id => id !== burger.id),
    })
  )
);
```

Using the same reducer cases for multiple actions makes it easier to understand what's happening in this application in addition to ensuring the `ids` array doesn't get out of sync with the server.

One other important note on using `createReducer`. As of this writing, the Angular ahead-of-time (AOT) compiler (the compiler used for producing production builds) [does not support function expressions](https://angular.io/guide/aot-compiler#function-calls-are-not-supported). It's therefore necessary to wrap the `createReducer` function in an exported function like so:

```typescript
export function reducer(state: State | undefined, action: Action) {
  return burgerReducer(state, action);
}
```

Finally, as with `createAction`, there's a [schematic for the new reducer style](https://ngrx.io/guide/schematics/reducer):

```bash
ng generate @ngrx/schematics:reducer myNewReducer --creators
```

This schematic will generate a new file called `my-new-reducer.reducer.ts`. It will include both the `createReducer` constant and the exported `reducer` function for AOT.

### createEffect
Finally, `createEffect` is here to improve writing effects. Previously, effects used an `@Effect()` decorator. While this was fine, it was sort of the odd bird compared to all of the other more functional approaches NgRx takes.

Going back to the burger application, here's an example of the old style of effect: 

```ts
@Effect()
loadBurgerCollection$ = this.actions$.pipe(
  ofType(BurgerApiActionTypes.LoadBurgerCollection),
  switchMap(() =>
    this.burgerService.getAllBurgers().pipe(
      map((burgers: Burger[]) =>
        BurgerApiActions.LoadBurgersSuccess({ burgers })
      ),
      catchError(error =>
        of(BurgerApiActions.LoadBurgersFailure({ error }))
      )
    )
  )
);
```

The new `createEffect` helper simplifies this a bit and standardizes it to look more like creating actions, reducers, and selectors:

```typescript
loadBurgerCollection$ = createEffect(() =>
  this.actions$.pipe(
    ofType(BurgerApiActionTypes.loadBurgerCollection),
    switchMap(() =>
      this.burgerService.getCollection().pipe(
        map((burgers: Burger[]) =>
          BurgerApiActions.loadBooksSuccess({ burgers })
        ),
        catchError(error =>
          of(BurgerApiActions.loadBooksFailure({ error }))
        )
      )
    )
  )
);
```

> Remember, the actions have changed from Pascal case to camel case since they've changed from classes to functions.

There's also a small modification in effects that don't dispatch new actions. Here's an effect that fires after a burger is successfully ordered, which redirects back to the home page and doesn't dispatch a new action:

```typescript
@Effect({ dispatch: false })
orderBurgerSuccess$ = this.actions$.pipe(
  ofType(BurgerApiActions.OrderBurgerSuccess),
  tap(() => {
    this.router.navigate(['/']);
  })
);
```

Using the new `createEffect` function, you can refactor this code to the following:

```typescript
orderBurgerSuccess$ = createEffect(() => 
  this.actions$.pipe(
    ofType(BurgerApiActions.LoginSuccess),
    tap(() => this.router.navigate(['/']))
  ),
  { dispatch: false }
);
```

That second argument of the `createEffect` function is for passing in metadata to control how the effect operates.

One final word on effects in NgRx 8. Previously, the team found that developers were either forgetting to handle errors in their effects or handling them incorrectly. To help with this, effects now automatically resubscribe on errors (instead of completing) so they continue to listen to dispatched actions. This is extremely helpful but it can also be disabled if you start noticing weird behaviors. Simply pass `{ resubscribeOnError: false }` as the second argument of the `createEffect` function. 

As with the other two examples, there's a [schematic to add the new style of effect](https://ngrx.io/guide/schematics/effect) to your application:

```bash
ng generate @ngrx/schematics:effect myNewEffect --creators
```

This command will generate a new file called `my-new-effect.effects.ts` that imports `createEffect` and creates a class marked with the `Injectable` decorator.

## Aside: You Might Need Authentication (Even Though "You Might Not Need NgRx")
Most applications these days are going to need some sort of identity management to persist user profile information and handle authentication and authorization. To implement an identity management strategy in your NgRx application, some of the syntax has changed with version 8, but the core principles remain the same. You'll use actions for logging in and logging out and effects for calling your authentication service, while your reducer handles modifications to state like logged in status and profile attributes.

I cover this at length in my [NgRx authentication tutorial](https://auth0.com/blog/ngrx-authentication-tutorial/). Go ahead and <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a> and dig in to the tutorial to get started.

![Auth0's Lightweight Universal Login modal window](https://images.ctfassets.net/23aumh6u8s0i/54lZ5srDBAM0dqWSRkdxXk/f4260dcf2af6e7b5b4a52c62769e0745/lightweight-login)

By the way, I'd love to hear how it goes while using the new helper functions in version 8 of NgRx, so reach out on our [Community Forum](https://community.auth0.com/) any time.

## Conclusion
I don't know about you, but I couldn't be happier with NgRx 8. This is a team of volunteers who are making great software and even writing [phenomenal docs](https://ngrx.io/docs). With all of the improvements in this version, the future is looking bright. Give it a test drive and let me know how it goes!


Faster App Development with NgRx 8

jorge-fatta

Jorge is a Software Engineer that enjoys building tools for colleagues. He manages the Developer Tools team at Auth0. This team works on improving development workflow through tools and automation. He likes to spend time with family, playing football, or preparing and drinking all possible forms of coffee.

Engineering Manager

Jorge Fatta

Helping engineers stay focused on building features that solve the hard problems of identity for customers.



Auth0 is continuously growing. To share a couple of examples, we just hit a new milestone: [_2.5B+ monthly logins securely authenticated_](https://twitter.com/auth0/status/1101216297206059009) and we [_ended 2018 with a nearly 80 percent increase in both sales and new customers_](https://auth0.com/blog/auth0-closes-year-of-impressive-growth-in-2018/).


We are growing and scaling the organization at a really fast pace, and engineering is no exception. This presents some interesting and fun challenges:

1. Promoting and developing the **culture** that fuels this endeavor.
2. **Hiring** and retaining great engineers.
3. Minimizing duplicate work and time to be **productive** as new people come in.

This blog post is focused on how Auth0 is addressing part of that last challenge; by building a dedicated team to unleash the potential in Auth0 developers to deliver business value with confidence.

## Developer Tools Team at Auth0

In the same way that Auth0's goal is to make identity simple for developers, the Developer Tools team goal is to let our engineers fully focus on development and providing value for our customers. We want to provide the best tools to keep our developers happy and engaged shipping new features instead of struggling every day with exhausting and repetitive tasks that could be automated.

We defined the mindset we want to adopt to develop our tools and outlined a roadmap with the following vision:

> Provide toolchains that Auth0 engineering teams can use to improve their workflow, automate manual tasks, simplify complex processes, and implement a set of company-wide standards.

### What we do

1. Work closely with the engineering teams to understand their pain points, provide tools and guidance.
2. Investigate existing tools and develop new ones to solve their needs:

    * Development Environment tools.
    * Change Management tools.
    * Debugging and Performance tools.
    * Incident Response tools.
    * Work with the [_SRE team_](https://auth0.com/blog/progressive-service-architecture-at-auth0/) to integrate site reliability tools into the platform.

1. Recommended patterns & practices:

    * Identify patterns currently in use across our organization.
    * Provide developer tools for Scaffolding and Code Snippets.
    * Promote the adoption and tooling for the best engineering practices, e.g.: [_contract testing_](https://martinfowler.com/bliki/ContractTest.html).

### What we don’t do

1. While we provide general guidance, we don’t do consultancy, i.e.: we neither do work at a particular team's requests to tackle specific issues, provide advice on demand, or do an investigation by request nor develop customized solutions to solve a specific team's needs.
2. We don’t provide advice or work on particular issues on demand: our tools are developed following a *product* approach.
3. We don’t embed team members on another team to build tooling. We might do it for discovery, but development happens within the Development Tools team.
4. We don’t debug and profile internal services, we provide the toolchain for that.
5. We don’t do [_SRE (Site Reliability Engineering)_](https://auth0.com/blog/progressive-service-architecture-at-auth0/), we might provide tooling that could improve the experience during their analysis.
6. We don’t investigate a random tool or technology on demand. We do it if it is related to reducing developer pain.

<include src="TweetQuote" quoteText="Learn how our engineers stay focused on solving the hard problems of identity for our customers."/>

## Tools Development Mindset

We are approaching the development of the tools as internal **products**, guided by these principles:

1. **Ownership**: We own the tools that we ship, following a “*You Build It, You Run It*” principle.

    * We operate what we build: taking care of the CI/CD, incident response, etc.
    * We take care of not just the coding but also keeping the *product* running in good shape.

1. **Extensibility**: We develop these tools taking extensibility into account from scratch.

    * For example, any engineer should be able to easily extend* *the* CLI *that we provide to interact with Auth0’s local development environment.

1. **Internal Collaboration**: We engage our users to **contribute** with the tool evolution, collecting their feedback and welcoming their contributions to the code and documentation (via pull requests on git repositories).

We aim to follow an **iterative** process to develop our tools (just like our Product Engineering teams), working closely with our internal customers.


> The process adopted by our team suits the lean startup cycle model.

->![Jeff Patton & Associates: lean startup cycle model](https://images.ctfassets.net/23aumh6u8s0i/4TRZnZXwjpgNp5gtf4u168/b8ab189eea4a634cdbadfcf67b5c12be/lean-startup-model)<-

*[*_Lean Startup Model_*](https://www.jpattonassociates.com/common-agile-int-for-startups/lean-startup-model/)* by *[*_Jeff Patton_*](https://www.jpattonassociates.com/) is licensed under [CC BY 2.0](https://creativecommons.org/licenses/by/2.0/).*

<include src="TweetQuote" quoteText="The Auth0 Developer Tools team shares three key principles to develop a tools-development mindset that helped them create successful internal products for developers."/>

## Our Tools

Some of the tools that we currently maintain and regularly work on had a great impact and adoption rates within the organization but were built prior to adopting the _internal dev tools as product_ mindset mentioned above. It was originally hard for us to *learn *from the tools once released without any kind of usage metrics. For that reason, we focused on existing solutions by:

* Improving **documentation**, both user guides and internal playbooks concisely describing deployment, troubleshooting, and **contribution** guidelines.
* Instrumenting **usage and performance** metrics to **measure** the impact of our iterative improvements.

### Vivaldi

->![Containers on a dock](https://images.ctfassets.net/23aumh6u8s0i/5d1b2HI9Jjwld4HEksBQff/ec3bdb6bf8883d78cf39f907bb6f65bf/containers-on-a-dock)<-

*Photo by *[*_Guillaume Bolduc_*](https://unsplash.com/photos/uBe2mknURG4)* on *[*_Unsplash_*](https://unsplash.com/)*.*


**Vivaldi** is the tool on which we have invested most of our efforts so far. Named after the Italian musical composer, it is a [_Docker_](https://www.docker.com/) container-based development environment that allows engineers to run a local Auth0 on their machine.
Through a command line interface (CLI), Vivaldi provides commands to quickly interact with our service instances running locally in order to:

* Update dependencies.
* Run tests.
* Attach a debugger.
* Run diagnosis tools.
* Execute performance profilers.

->![Vivaldi: Docker container-based development environment](https://images.ctfassets.net/23aumh6u8s0i/1NlLXfq8I0vpBm5KL3cI5l/30cd621072a76bcd0406151786f49246/vivaldi)<-

The initial version of the tool had a **great impact on the development cycle** and was **widely adopted**. Before *Vivaldi*, developers needed to manually spin up the services they were working on, fighting with dependencies with their local environment. Now they can rely on an isolated and replicable environment, being able to spin up the entire services cluster relatively quickly.

As our teams and number of services grow, we are now actively working with teams to better implement a fast development loop without relying too much on running all Auth0 services locally. We are already planning the next generation of Vivaldi, which will support future growth in a scalable way.

### Slack Bots

->![Droid giving you a helping hand](https://images.ctfassets.net/23aumh6u8s0i/H5W70I4X8Ot6NSsj0VHyv/fadc300cf5495e31413a4ef43f2128d7/droid-giving-you-a-helping-hand)<-

*Photo by *[*_Franck V._*](https://unsplash.com/photos/jIBMSMs4_kA)* on *[*_Unsplash_*](https://unsplash.com/)*.*

We developed an internal Slack bot platform called _Gynoid_ during a hackathon and it was quickly adopted by our engineering organization. The platform is customized to satisfy the needs of our developers:

* To build Slack bots easily: just create a JavaScript file, add metadata, and you are done!.
* To install Slack bots straight from a GitHub repository.
* To extend existing bots from different sources: one bot, multiple functions, different repositories.
    * We call these extensions Droids. To install new extensions, we have a Gynoid that serves as a wrapper for this library. Our _Gynoid Droid_ is responsible for registering and extending our bots directly from Slack.

A notable Droid is one that serves as a _concierge_ for any Slack channel, properly named @concierge. It works like this:

* A channel that needs a person on duty to address direct questions invites `@concierge` to the channel.

->![Inviting the concierge Slack bot to a channel](https://images.ctfassets.net/23aumh6u8s0i/762YoyCbXhOlyM9zQAr24/469fe557035293e641012aa2bc03c672/invite-concierge-slack-bot)<-

* A teammate is assigned the role of `@concierge`.

->![Assigning the concierge role to a teammate](https://images.ctfassets.net/23aumh6u8s0i/2u1bJjRFdCbJWf48k9t1Ot/3fb1c5c67e6d6819df21f09564896e18/assign-concierge-slack-bot)<-


* When someone needs to ask anything to a team, for example, they visit the team's channel and ask the question directly to `@concierge`.

->![Asking a question to Slack bot concierge](https://images.ctfassets.net/23aumh6u8s0i/3Gtm4wdoomqbMJas4rzjGf/a1249a2842972eae97cc08b29328a28d/asking-question-concierge)<-

* The teammate with the role of `@concierge` is sent a direct message through Slackbot with the concierge request.

->![Slack bot concierge sending a direct message to teammate](https://images.ctfassets.net/23aumh6u8s0i/4nPgWa3KasUha1YjLcAmos/641263ac54adb338d5906ee7d410673b/concierge-slack-bot-direct-message)<-

* The concierge has now the responsibility to research and to address the request directly. If the request is outside of the scope of the team, the request is redirected to the appropriate channel

The concierge droid helps us avoid unnecessary noise in Slack &mdash; especially since it is widely used within our company as a good substitute for `@here` and `@channel` when asking questions. It's very useful when you have an "on-call" rotation in your team and people need to reach the teammate on call through a Slack channel.

## Roadmap

We are currently working on the next major version of our main tools, focusing on:

* **Scalability improvements**: Vivaldi, our Docker-based development environment, will run an increasing number of services without compromising the developer machine resources.
* **Robustness**: Gynoid, our slack bots platform, will have end-to-end tests and its dependencies will be upgraded to the latest stable versions, allowing our team and contributors from other teams to introduce changes or develop new *droids* with confidence.

Additionally, we’re in the early stages (discovery, viability analysis, and ideation) for a **unified internal CLI** (command-line interface): we already have multiple CLIs that provide different types of functionality. As the number of CLIs keeps growing, it will become hard to keep track of them.

Some teams will decide to use a different tech stack, which may require different runtime dependencies and a distinct CLI to better manage it. However, we could create a unified CLI, customizable and extensible to meet the needs of different tech stacks. Having a unified CLI will help internal toolchains scale while staying maintainable.

## Conclusion

We aim to provide an optimal developer experience, unified across the engineering organization. To do this we take ownership of the toolchains, iterate to improve them and encourage teams to use these tools that have already proven their value on making developers more productive.

We dedicate our Developer Tools team efforts to the discovery, building, maintenance, and promotion of reusable solutions so that the rest of the engineers don’t have to struggle with repetitive tasks, walk through slow development cycles, or constantly switch contexts to take care of maintenance tasks that can be automated.

We want Auth0 engineers to be focused on building new features that solve the hard problems of identity for our customers.

<include src="asides/AboutAuth0" />


Auth0 Internal Dev Tools: Unleashing Engineering Potential

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Project Amber incubates smaller, productivity-oriented Java language features that have been accepted as candidate JEPs. Take a quick glimpse of the features that will arrive on the platform soon.



Recently, [Java changed its release cycle to a more rapidly cadence](https://www.forbes.com/sites/oracle/2018/03/20/what-java-10-and-javas-new-6-month-release-cadence-mean-for-developers/#7ed00d4a271a), affecting the way the language evolves overtime. With this new cadence, features can now reach the market faster. Besides that, this cadence enables the community to work on (and deliver) smaller features instead of expending all their energy on the big changes (e.g., lambda, generics, and modules).

Throughout the next sections, you will learn about Amber, the project that incubates small, productivity-oriented Java language features.

<include src="TweetQuote" quoteText="Stay on top of Project Amber and learn what productivity-oriented @java language features will arrive soon."/>

## Project Amber

Project Amber, [as explained on its homepage](https://openjdk.java.net/projects/amber/), is an effort focused on "exploring and incubating smaller, productivity-oriented Java language features that have been accepted as candidate JEPs under [the OpenJDK JEP process](https://openjdk.java.net/jeps/1)." At the time of writing, this project has already delivered two enhancements and is planning on delivering five more. Let's learn about these enhancements.

> Not sure what JEP (JDK Enhancement Proposal) means? Check out this article and [learn more about the Java platform and the community process that is responsible for evolving it](https://auth0.com/blog/java-platform-and-java-community-process-overview/).

### Enhancements delivered

The first enhancement already released, called [_Local-Variable Type Inference_](https://openjdk.java.net/jeps/286), was introduced in Java 10 and allows developers to reduce the ceremony associated with writing Java code while maintaining Java's commitment to static type safety. With this enhancement, developers can now declare variables like this:

```java
var list = new ArrayList<String>(); // infers ArrayList<String>
var stream = list.stream(); // infers Stream<String>
```

```java
List<String> list = new ArrayList<String>();
Stream<String> stream = list.stream();
```

The second enhancement, called [_Local-Variable Syntax for Lambda Parameters_](https://openjdk.java.net/jeps/323), was introduced in Java 11 and extends the _Local-Variable Type Inference_ feature by allowing `var` to be used when declaring the formal parameters of implicitly typed lambda expressions. For example, with this enhancement, if you write the following code:

```java
IntStream.of(1, 2, 3, 5, 6, 7)
          .filter((var i) -> i % 3 == 0)
          .forEach(System.out::println);
```

Java will have no problem identifying that the `i` variable is an integer.

### Enhancements being developed

Besides the enhancements already released, Project Amber is planning on delivering _Lambda Leftovers_, _Pattern Matching_, _Switch Expressions_, _Raw String Literals_, and _Concise Method Bodies_.

#### **Lambda Leftovers**

The [_Lambda Leftovers_ enhancement](http://openjdk.java.net/jeps/302) aims at bringing two new features to the Java language. First, this enhancement will allow developers to use an underscore (_) to denote an unnamed lambda parameter. Second, the enhancement will allow lambda parameters to shadow variables already defined in the enclosing context. For example, this last feature will enable developers to write code as follows:

```java
Map<String, Integer> msi = ...

String key = computeSomeKey();
msi.computeIfAbsent(key, key -> key.length());
```

In this case, the inner `key` variable will cause no conflict with the external one (derived from the `computeSomeKey()` call).

#### **Pattern Matching**

The [_Pattern Matching_ enhancement](https://openjdk.java.net/jeps/305) will allow developers to be more concise when dealing with the `instanceof` operator. For example, with this feature, whenever developers want to check if an object is a `String` and use it as such, instead of doing this:

```java
if (obj instanceof String) {
    String s = (String) obj;
    // use s
}
```

They will be able to do this:

```java
if (obj instanceof String s) {
    // can use s here
}
```

By using the new pattern matching feature, developers will reduce the overall number of explicit casts in Java programs considerably. For example, as type test patterns are particularly useful when writing equality methods, instead of having a method like this:

```java
@Override public boolean equals(Object o) { 
    return (o instanceof CaseInsensitiveString) && 
        ((CaseInsensitiveString) o).s.equalsIgnoreCase(s); 
}
```

Developers will be able to simplify the code (and avoid the explicit cast), as shown here:

```java
@Override public boolean equals(Object o) { 
    return (o instanceof CaseInsensitiveString cis) && 
        cis.s.equalsIgnoreCase(s); 
}
```

#### **Switch Expressions**

The [_Switch Expressions_ enhancement](https://openjdk.java.net/jeps/325) will enable developers to use the `switch` feature as either a statement (the _traditional_ way) or as an expression (the _simplified_ version). This change will simplify some code, as you can see on the following code snippets. The first one shows how you would use the traditional `switch` keyword to make a decision:

```java
switch (day) {
    case MONDAY:
    case FRIDAY:
    case SUNDAY:
        System.out.println(6);
        break;
    case TUESDAY:
        System.out.println(7);
        break;
    case THURSDAY:
    case SATURDAY:
        System.out.println(8);
        break;
    case WEDNESDAY:
        System.out.println(9);
        break;
}
```

The second one shows how you would use the simplified version to achieve the same result:

```java
switch (day) {
    case MONDAY, FRIDAY, SUNDAY -> System.out.println(6);
    case TUESDAY                -> System.out.println(7);
    case THURSDAY, SATURDAY     -> System.out.println(8);
    case WEDNESDAY              -> System.out.println(9);
}
```

Pretty nice, huh?

<include src="TweetQuote" quoteText="The new Switch Expressions proposal will allow @java developers to use switch as expressions to write more concise code."/>

#### **Raw String Literals**

The [_Raw String Literals_](https://openjdk.java.net/jeps/326) enhancement will add, as the name states, raw string literals to the Java programming language. This type of string can span multiple lines of source code and does not interpret escape sequences, such as `\n`, or Unicode escapes, of the form `\uXXXX`. Among its goals, the enhancement plans on:

- make it easier for developers to express sequences of characters in a readable form, free of Java indicators;
- supply strings targeted for grammars other than Java;
- and supply strings that span several lines of source without supplying special indicators for new lines.

One good way to see the benefits of this enhancement is to consider what you would need to do to write a long SQL query:

```text
String query = "SELECT `EMP_ID`, `LAST_NAME` FROM `EMPLOYEE_TB` " +
               "WHERE `CITY` = ‘INDIANAPOLIS' " +
               "ORDER BY `EMP_ID`, `LAST_NAME`;";
```

By using _Raw String Literals_ you will be able to rewrite the previous code snippet as follows:

```text
String query = ``SELECT `EMP_ID`, `LAST_NAME` FROM `EMPLOYEE_TB`
                 WHERE `CITY` = ‘INDIANAPOLIS'
                 ORDER BY `EMP_ID`, `LAST_NAME`;
               ``;
```

#### **Concise Method Bodies**

The [_Concise Method Bodies_](https://openjdk.java.net/jeps/8209434) enhancement is all about supporting _more_ concise methods in the Java programming language. The Java 8 version, released back in 2014, introduced what is known as the [_Lambda Expressions_](https://jcp.org/en/jsr/detail?id=335) enhancement. This enhancement, known as Java's first step into functional programming, allowed developers to define methods that do not belong to any class. As such, these methods (which have a very concise syntax) can be passed around as if they were objects and can be executed on demand.

For example, prior to the Lambda Expressions introduction, if you needed to do some calculation and return an integer, you would have to find a class where to define a new method:

```java
public static class Utils {
  public static int calculate(Object someParameter) {
    // ... calculate
    return result;
  }
}
```

After that, you would be able to call this method whenever you wanted, after importing the `Util` class. With the introduction of this new feature, you can now replace all this boilerplate with something much simpler:

```java
ToIntFunction<Object> calculate = (Object o) -> {
  // ... calculate
    return result;
};
```

The code above, instead of belonging to some random class (like `Utils`, on the example), can be written and called right where you need it. This can be considered the first _concise methods_ introduced in the programming language.

Now, back to the _Concise Method Bodies_ enhancement that Project Amber will introduce, when this feature is released, developers will be able to apply this kind of syntax in more places. For example, if you ever did something like creating a method like this:

```java
int length(String s) {
  return s.length();
}
```

In the near future, you will be able to rewrite it like this:

```java
int length(String s) -> s.length();
```

## Conclusion

As you learned in this short blog post, Project Amber is the project that you have to keep an eye on to learn about the productivity-oriented features that will arrive at the Java programming language soon. If you want to stay on top of this, [follow us on Twitter](https://twitter.com/auth0), or subscribe to our newsletter.

<include src="asides/AboutAuth0" />


The Future of Java - Project Amber

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Dan Arias

Help your customers fall in love with your application by providing a secure and easy authentication experience they don't have to remember.



Ah, Valentine's Day! Love is in the cloud. Billions of people are either signing up for or logging in to web services to wish their loved ones a happy day. They are ordering flowers, buying chocolates, or sharing the most intimate of thoughts through messages. Building scalable authentication the right way to sustain spikes in demand can leave developers with a heavy heart. 

However, Auth0 can help you prepare for the best and the worst today and every day. Let me show you why using Auth0 can make you fall in love with authentication through these solid Auth0 features that make modern authentication a walk in the park.

## <a class="toc-target" id="single-sign-on-will-keep-us-together"></a>Single Sign-On Will Keep Us Together

According to the [2018 World Password Survey run by MacAfee](https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/security-world-password-day/), consumers who responded to the survey have an average of **23 online accounts** that require a password but **on average only use 13 unique passwords** for those accounts. With so many passwords to track, forgetting a password is common.

Going through the motions of resetting a password can bring some heartache... Imagine if one of the "Challenge Questions" is asking you about the favorite vegetable of your ex. However, not being able to recover the account or getting it compromised can truly unleash the worst of heartbreaks. 

This all could be alleviated if we only needed to remember one username and one password, right? Find _the_ one and be forever happy with easy access to all of our accounts. This sounds like a fairy tale but it's not. Fortunately for us, Password Charming exists in the form of **Single Sign-On**. 

Single sign-on (SSO) allows users to simply log in once and use all applications they have been granted access to. You could use your Google account to authenticate yourself with a dating site or any other application that decided to delegate the responsibility to create, maintain, and protect your username and password to Google.

![Single sign-on example login authentication in action](https://images.ctfassets.net/23aumh6u8s0i/7cMIHIB6DD65M59E8b60JU/3e95a93f4bd9fd5d532a890de2b5b49f/auth0-single-sign-on-flow)

Building and maintaining an identity platform with Single Sign-On can become expensive, time-consuming, and difficult to get right &mdash; just like love. In a [recent survey](https://auth0.com/forrester-total-economic-impact/), 94% of organizations said they were able to implement Auth0 in less than a month. That is possible because with Auth0’s SSO solution you get:

* [Over 40 supported Identity Providers](https://auth0.com/docs/identityproviders) including mainstream social providers such as MySpace. Kidding!

![Auth0 has built-in identity providers such as Facebook, Twitter, Google, GitHub, LinkedIn, Dropbox, and many more.](https://images.ctfassets.net/23aumh6u8s0i/6oH8TXss4ErZM3RzJ9n7Rp/d31d514b9368daa63782d5a4da15fafb/new-grid-02b)

* The ability to authenticate the social butterfly by consolidating duplicate accounts across various providers with account linking &mdash; while [increasing conversion rates](https://auth0.com/retail/).

* Ease of use by having the freedom to write your code once and integrate any configured connection. One login screen to rule them all.

* Like meeting the expectations of even the strictest of parents, [compliance with leading organizations including SOC2, GDPR, HIPAA, and others](https://auth0.com/docs/compliance). 

[Let Auth0 help you get SSO right today](https://auth0.com/single-sign-on) to help your customers fall in love with an amazing authentication user experience. Don't let any customer be the one that got away because he or she forgot to remember you.

## <a class="toc-target" id="rules-to-love"></a>Rules to Love

Relationship needs are not static. They change as the relationship grows... or dwindles. Authentication is one of the most critical relationships you'll ever form with your customers. This process helps you understand who they are and how you can help them based on an established and ongoing relationship around identity. Therefore, authentication needs to be extensible, flexible, and customizable.

With Auth0 Rules, you can customize your authentication workflow. Auth0 Rules are JavaScript functions that execute when a user authenticates to your application. They run once the authentication process is complete. You can use them to customize and extend Auth0's capabilities.

### Use Auth0 Rules to:

* Enrich user profiles: query for information on the user from a database/API, and add it to the user profile object.

* Create authorization rules based on complex logic (anything that can be written in JavaScript).

* Reuse information from existing databases or APIs for migration scenarios.

* Keep a white-list of users and deny access based on email.

* Notify other systems through an API when a login happens in real-time.

* Modify tokens: Change the returned scopes of the Access Token and/or add claims to it, and to the ID Token.

[Let Auth0 help you rule the authentication game today](https://auth0.com/docs/rules). 

## <a class="toc-target" id="universal-login-one-form-one-heart"></a>Universal Login: One Form, One Heart

One of the easiest ways to improve your customers’ experience while boosting security is through consistency. Imagine that each login form in your application is a physical door. If the look and feel of this door are not consistent throughout the application, your customers' user experience when logging in may look like this:

![Doors metaphorically representing the UX and UI of an app's login form flow.](https://images.ctfassets.net/23aumh6u8s0i/4qZC52zb2rkifVRgofbtvh/1f1e5140952a12c0126b8b456ef6c6f6/valid-doors-valid-login-forms)

Each door that represents a login form looks different. They are all valid entryways for the customer's credentials, but your customer can't anticipate what the login form should look like. This inconsistency can let a malicious actor to phish your customers. Here’s how:

![Invalid door metaphorically representing introduction of a phishing login form.](https://images.ctfassets.net/23aumh6u8s0i/7govsBdLttTOlrwwqEEKTN/668dacccd29c76629deb2b79727aa68c/invalid-door-invalid-login-form)

The attacker creates a site and requests your customers' login. If your login forms are inconsistently designed, for your customers, the brown door may just signal a new form design. They could easily enter their credentials there expecting access to your application &mdash; and just like that, they become phishing victims.

To help protect your customers, a consistent authentication UX and UI helps them better identify when a phishing attempt may be happening. Say that you opt for all of your login forms to look like the yellow door. Now it's much harder to trick one of your customers:

![Consistent app UX and UI of login flow/forms helps to recognize a phishing form.](https://images.ctfassets.net/23aumh6u8s0i/5nckAsKhcjZUvSGITOUnGX/1c7ebfca7a4618e415084e5492071596/consistent-valid-door-design-consistent-valid-login-form-design)

The universal design and implementation of the login makes your customers expect one, and only one, form for their credentials. Anything different must be rejected.

Auth0 offers you an easy way to build this unique door for your customers through **Universal Login**. Anytime your customers need to log in, they are redirected to a central authorization server that presents them with a login form that embraces your brand. Since authentication takes place on the same domain as the login, credentials are not sent across origins, increasing security and protecting against phishing and bucket brigade attacks, also known as man-in-the-middle (MITM) attacks.

Universal Login and SSO also happen to be a match made in heaven. You can orchestrate single sign-on (SSO) between multiple apps. If the user has already signed on to one app, the login page will not be shown again and the user will be logged in via SSO.

Play this video to see it in practice!

<AmpContent>
<amp-video controls
  layout="responsive"
  width="480" height="270">
  <source src="https://videos.ctfassets.net/2ntc334xpx65/67t8nyR02cUssAmCmsaiE6/4abf027ac21be3f56b0c16854b5bcd5e/sso_new_diagram_video.mp4"
    type="video/webm" />
</amp-video>

</AmpContent>

<NonAmpContent>

<video controls="controls">
  <source src="https://videos.ctfassets.net/2ntc334xpx65/67t8nyR02cUssAmCmsaiE6/4abf027ac21be3f56b0c16854b5bcd5e/sso_new_diagram_video.mp4">
   Your browser doesn't support HTML5 video. Here is a <a href="https://videos.ctfassets.net/2ntc334xpx65/67t8nyR02cUssAmCmsaiE6/4abf027ac21be3f56b0c16854b5bcd5e/sso_new_diagram_video.mp4"> link to Universal login and SSO</a> instead.
</video>

</NonAmpContent>

Love and security are based on trust. Don't let phishing steal your customers' trust in your design or implementation.  You can [get started with Universal Login from Auth0 today](https://auth0.com/universal-login).

## <a class="toc-target" id="multi-factor-authentication-are-you-the-one-for-me"></a>Multi-Factor Authentication: Are You the One for Me??

![Are these images of actress Jaime Pressly or Margot Robbie?](https://images.ctfassets.net/23aumh6u8s0i/2PqNgYrJVTbFlgEJprLfkb/810a1cf582f03290460a72b1145405ef/margot-jaime)

[Left image source: Gage Skidmore](https://en.wikipedia.org/wiki/Margot_Robbie#/media/File:Margot_Robbie_by_Gage_Skidmore.jpg)

Pictured above are _two_ different and unique women. One of them is [Jaime Pressly](https://www.imdb.com/name/nm0005326/) and the other one is [Margot Robbie](https://www.imdb.com/name/nm3053338/). If someone gives you the picture of one of them and tells you to hand her a super secret script for an upcoming Spider-Woman movie, would you be able to tell them apart?

It would be very difficult. Even if you were to ask one of them for their name... What if Margot, jokingly, says her name is Jaime. You need to ask more questions to establish their identity and not make the mistake of giving the prized script to the unintended person. 

Authenticating users is just like that. If you want to have greater confidence that you are granting data access to the right person, multi-factor authentication is for you.

Multi-factor authentication (MFA) is a method of verifying a user's identity by requiring them to present more than one piece of identifying information. This effectively provides an additional layer of security, decreasing the likelihood of unauthorized access. The type of information required from the user is typically two or more of the following:

* Knowledge: Something the user knows (such as a password)
* Possession: Something the user has (such as a mobile device)
* Inheritance: Something the user is (such as a fingerprint or retina scan)

The complexity of getting MFA right keeps developers from implementing it in their applications. However, with Auth0, enabling MFA for your application is a fairly straightforward process:
 
* Choose what factors to enable on your application, such as push notification.

* Perform any further setup required to configure that factor.
 
* Choose whether or not you wish to enforce MFA for all users.

![Auth0 Multi-Factor Authentication dashboard with different factors to enable](https://images.ctfassets.net/23aumh6u8s0i/76dOMSouGVa1RG4sZHWMIl/fb3c361a75713719bef1665bc9ba185d/mfa-dashboard-1)

With Auth0 Rules, as you learned earlier, your application's MFA experience can be customized. You can only require MFA in specific circumstances or force a particular factor to be used. When in doubt, always ask: is he or she the one to log in?

Catfishing? Ain't nobody got time for that! Don't let doubt erode your confidence and increase your risk of leaking data. Love, trust but verify. [Give Auth0 Multi-factor Authentication a try today](https://auth0.com/docs/multifactor-authentication).

## <a class="toc-target" id="anomaly-detection-trouble-in-paradise"></a>Anomaly Detection: Trouble in Paradise

> You know that I trust you, baby
>
> But your data's so good lookin'
>
> I'm afraid somebody's gonna steal it away from me.

We know that most of the time it's your customers who are authenticating into your application, but we also know that their data is beautiful and attractive to many malicious users out there. They will try to pretend to be your customer by deception or by force.

Legitimate users may try to log in three or five times if they have forgotten their password but are trying to remember it:

> Was it `correcthorsebatterystaple` or `confectcoarsewaterymaple`?

Ten failed consecutive attempts to log in are definitely a red flag. If the legitimate user is so pressed to log in, they will resort to resetting their password as soon as possible.

With Auth0, you can detect anomalies and stop malicious attempts to access your application. Auth0 offers two types of shields:

* Brute-force protection
* Breached password detection

![Auth0's Anomaly Detection dashboard](https://images.ctfassets.net/23aumh6u8s0i/17r5rvTrkVXqzAgA1v6WM1/724776f473b2c765614f0efaf0ac4ea6/anomaly-detection-overview)

A shield specifies the action you wish to take given a specific trigger. A trigger is a suspicious event that is detected when someone is trying to log in to your system, or they are using a breached password that has been reported by another third-party service.

**Brute-force protection is enabled by default for all connections**. There are two different triggers for the brute-force protection shield, for two slightly different attack scenarios:

* 10 consecutive failed login attempts for the same user and from the same IP address
* 100 failed login attempts from the same IP address in 24 hours or 50 sign up attempts per minute from the same IP address

Auth0 tracks large security breaches that are happening on major third-party sites to help keep your users and systems secure. By enabling breached password detection, when a trigger occurs, your users can be notified and/or blocked from logging in if we suspect their credentials were part of a published security breach. **Auth0 never blocks the user itself, just the attempts from the suspicious origin**.

Is love knocking at your door or is it a brute force attack? [Integrate Auth0's anomaly detection in your application today](https://auth0.com/docs/anomaly-detection) to mitigate bad actors from forcing themselves into the heart of your data.

## <a class="toc-target" id="happy-valentines-day"></a>Happy Valentine's Day

Let Auth0 be the final piece that helps you build a secure and seamless user authentication experience that your customers will love to use. <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Get started with SSO, MFA, Universal Login, Anomaly Detection, and Rules for free today</a>!

![Auth0 Features to Fall in Love With - SSO, Rules, and More](https://images.ctfassets.net/23aumh6u8s0i/7fRVnuSnZAQva1b4YwQP0P/6f3f16fb671fecefb1cfd08e28dd40af/auth0-the-final-piece-in-authentication-to-fall-in-love-with)

<include src="asides/AboutAuth0" />


Auth0 Features to Fall in Love With

andrew-akers

I'm a product marketing manager who loves learning about technology, information security, and identity. My goal is to turn that knowledge into positive outcomes for our customers. Before Auth0, I was a product marketing manager at Cisco in the network security division. In my spare time, you can find me spending time with my family, reading, writing, and working on endless home improvement projects.

Product Marketing Manager

Andrew Akers

Help is just a click (or phone call) away. Any day. Any time.



When you work with Auth0, you gain a partner that is committed to your success. “The Customer Success team was always accommodating and made time for us when we had an issue,” said Cris Concepcion, ‎[_former Platform Engineering Manager at O’Reilly Media_](https://auth0.com/learn/safari-case-study/). “Having Auth0 around to provide immediate answers to our questions saved our developers a great deal of time.”
We are always thinking of ways we can build better partnerships with our customers. To that end, Auth0 is enhancing its support offerings. With the release of the [_Premier Support_](https://auth0.com/docs/support) offering, Auth0 is now including a number of new support features, including:

### **Phone Support**

Enterprise customers with a Premier Support agreement have access to 24x7 phone support with Auth0 experts. This ensures customers can quickly receive answers to their questions and problems from a team of designated support engineers.

### **Coverage 24x7x365**

The Premier Support package includes coverage 24 hours a day, seven days a week, 365 days a year. The target response times varies based on your requirements. See the table below for a description of response times:


* **Severity 1**: Urgent requests with a target response time of **30 minutes**.
* **Severity 2**: Requests with a significant business impact, target response time of **1 hour**.
* **Severity 3**: For minor feature or function issues and general questions, target response time of **8 hours**. 	
* **Severity 4**: For minor problems and enhancement requests, target response time of **12 hours**.

### **Designated Support Teams**

Customers with Premier Support agreements will be assigned a designated team of support engineers. This ensures that when the customer raises a ticket or calls support, they are dealing with the same group of support engineers who are familiar with the customers deployments and past support tickets. Ultimately, this will improve the time needed to resolve a problem and reduce future challenges.

### **Ticket Review and Analysis**

Once a month, once a quarter, or per customer request, you can review your support tickets with your Auth0 team. Not only will we help you identify trends and practices that lead to your technical queries, but we can also help you better adhere to best practices and avoid problems in the future.

### **Additional Features**

The Premier Support offering also includes features common to other Auth0 support plans, such as:

* Answering questions concerning usage issues related to Auth0-Platform-specific features, options, and configurations
* Providing initial and high-level suggestions regarding the appropriate usage, features, or solution configurations for the particular type of reporting, analysis, or functionality
* Isolating, documenting, and finding alternative solutions for reported defects
* Working with Auth0 Operations, Product, Software Development, and QA staff to submit Change Requests, Enhancement Requests, and provide fixes for the Auth0 Platform as necessary
* Addressing your concerns with online or printed documentation, providing additional examples or explanation for concepts requiring clarification
* Access to online release notes for updates
* Access to Auth0’s online library of support webinars and knowledgebase
* Access to Auth0’s Customer Community forums to collaborate with fellow Auth0 customers

<include src="TweetQuote" quoteText="When you work with Auth0, you gain a partner that is committed to your success. Learn how Premier Support can help you overcome identity challenges."/>

**Learn more** about the [_Auth0 Premier Support offering here_](https://auth0.com/docs/support) or [_talk to a sales representative._](https://auth0.com/contact-us?place=blog%20post&type=link&text=talk%20to%20a%20sales%20representative)

<include src="asides/AboutAuth0" />


Auth0 launches Premier Support

Let's take our Kanban Board from part 1 and add data persistence, and offline support using service workers

"features"