matt-netkow

Head of Developer Relations

Matt Netkow

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

We released a new version of the .NET SDK for desktop and mobile applications. Learn what’s new.

We're thrilled to announce the newest release of the [Auth0 OIDC Client for .NET](https://github.com/auth0/auth0-oidc-client-net), bringing enhanced support and improvements to your desktop and mobile applications. This update focuses on future-proofing your applications by adding support for **.NET 9**, ensuring you're ready for the latest advancements in the .NET ecosystem.

## Key Highlights

Here are the main improvements provided by this release:

* **.NET 9 Support:** This release officially adds support for .NET 9 across WPF, WinForms, iOS, Android, and MAUI platforms.
* **MAUI issue fix**. With this release, we work around a [well-known issue with WebAuthenticator support in Windows](https://github.com/microsoft/WindowsAppSDK/issues/441).
* **Latest Dependencies:** Under the hood, this release includes the latest version of [Auth0.OidcClient.Core (version 4.1.0)](https://www.nuget.org/packages/Auth0.OidcClient.Core/4.1.0), which includes various underlying improvements and fixes.

What this means for you:

* **Future-Proofing:** By adopting this version, you're ensuring your authentication logic remains compatible as you migrate to .NET 9.
* **Continued Compatibility:** This release maintains compatibility with previous .NET versions, allowing for a smooth transition.
* **Enhanced Stability:** Leveraging the updated core library contributes to a more stable and reliable authentication process within your applications.

## Get Started Today!

Updating your Auth0 OIDC Client for .NET is straightforward. You can find the latest packages on NuGet, based on your UI framework:

* [Auth0.OidcClient.WPF - ver. 4.3.0](https://www.nuget.org/packages/Auth0.OidcClient.WPF/4.3.0)
* [Auth0.OidcClient.WinForms - ver. 4.3.0](https://www.nuget.org/packages/Auth0.OidcClient.WinForms/4.3.0)
* [Auth0.OidcClient.iOS - ver. 4.3.0](https://www.nuget.org/packages/Auth0.OidcClient.iOS/4.3.0)
* [Auth0.OidcClient.Android - ver. 4.1.0](https://www.nuget.org/packages/Auth0.OidcClient.Android/4.1.0)
* [Auth0.OidcClient.AndroidX - ver. 4.3.0](https://www.nuget.org/packages/Auth0.OidcClient.AndroidX/4.3.0)
* [Auth0.OidcClient.MAUI - ver. 1.3.0](https://www.nuget.org/packages/Auth0.OidcClient.MAUI/1.3.0)
* [Auth0.OidcClient.UWP - ver. 4.2.0](https://www.nuget.org/packages/Auth0.OidcClient.UWP/4.2.0)

Simply update your project dependencies to the latest version to take advantage of these improvements.

We're committed to providing you with the best possible authentication experience. This release is a step towards ensuring your .NET applications are ready for the future. Stay tuned for more updates and features!

Learn More:

* [Auth0 OIDC Client for .NET Documentation](https://auth0.github.io/auth0-oidc-client-net/)
* [GitHub Repository](https://github.com/auth0/auth0-oidc-client-net)

Thank you for being a part of the Auth0 community!

Announcing a New Release of the Auth0 OIDC Client for .NET

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Get started and ship fast with Auth0 and Netlify

**TL;DR:** [New Auth0 Extension](https://www.netlify.com/integrations/auth0/) for Netlify: Available Now. We’ll go over why we partnered with Netlify and share resources to help you build and deploy an app.

## Why Should I Choose Auth0?

A secure login experience and access management are at the core of any application with users. Auth0 is a comprehensive auth solution built for developers with evolving needs. With Auth0, you can get your app to market fast by quickly turning on core features, enabling a secure experience for your users, and customizing experiences when your app’s needs change. 

## What is Netlify, and Why Did We Choose to Partner Together? 

[Netlify’s](https://www.netlify.com/) platform allows you to build highly performant and dynamic websites, e-commerce stores, and web applications. It also unites an extensive ecosystem of technologies, services, and APIs into one workflow to unlock team productivity. Integrating with a third-party platform like Auth0 allows Netlify users to deploy any modern frontend stack safely and securely. 

We both share a commitment to an excellent developer experience, so this partnership is a great fit. This extension allows you to leverage Netlify to innovate, scale, and ship while relying on Auth0 to enhance security and a great user experience. 

## Let’s Start Building with Auth0 and Netlify

Challenge: You’re looking to add authentication to your Netlify site easily.

Solution: Use this new extension to add authentication to your Netlify site and connect your Auth0 tenants to your Netlify account dashboard. 

This [guide](https://developers.netlify.com/guides/getting-started-with-the-new-auth0-extension-on-netlify/) will include instructions on how to set up the following while using the web framework Astro:

* Authentication flows for login/logout
* An Auth0-protected serverless function for serving user information

> [Let’s dive in here](https://developers.netlify.com/guides/getting-started-with-the-new-auth0-extension-on-netlify/).

Once complete, you will have built a static site and enabled the Auth0 extension. Congrats on successfully authenticating your new website! 🎉

## Have Questions?

If you want to learn more, check out the new [Netlify documentation](https://docs.netlify.com/integrations/auth0/). Share your thoughts on the guide [here](https://developers.netlify.com/guides/getting-started-with-the-new-auth0-extension-on-netlify/#guide-feedback-form).


Happy building!

_This blog may contain hyperlinks to non-Okta websites that are created and maintained by third parties who are solely responsible for the content on such websites._

New Auth0 Extension for Netlify: Available Now

Learn how to integrate CIBA authentication in your .NET applications to improve security and privacy.

There are scenarios where the user cannot interact directly with an application to use its functionality securely. In these scenarios, CIBA can guarantee security and usability at the same time.
This article will walk you through CIBA authentication and how to implement it in a .NET application.

## What Is CIBA?

CIBA stands for *Client-Initiated Backchannel Authentication*, and it's a [standard flow](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html) for decoupled authentication defined by the OpenID Foundation. Decoupled authentication occurs when the user is authenticated outside the context of an application. For example, consider a call center agent that is asked to modify a customer's order on the phone. Before executing that request, the agent needs to be sure that the user on the phone is actually the customer who placed that order. In this case, the call center agent sends an authentication request to the customer's phone. Once the customer confirms their identity, the operator can perform the requested action. Notice that the user authentication does not occur in the order management application, i.e., the application where the requested action needs to be performed, but on the user's device. This is why this type of authentication is called decoupled authentication.

Read [this article to learn more about CIBA use cases](https://auth0.com/blog/ciba-authenticate-customers-in-call-centers/).

## The CIBA Flow

Let's dig into the following diagram to understand how CIBA works:

![The Client-Initiated Backchannel Authentication (CIBA) flow](https://images.ctfassets.net/23aumh6u8s0i/3FccU3SUoWUH9TjY8zpSao/0dbdc84a573753cba9505edcf9237ee3/ciba-flow.png)

From this diagram, you see that the actors involved in the flow are:

- **The user**. This is the user who interacts with the application starting the authentication flow. In the use case described earlier, this is the call center agent.
- **The client application**. This is the application that initiates the CIBA authentication flow. In our previous example, it was the order management application. Notice that this application must be a [confidential client](https://auth0.com/docs/get-started/applications/confidential-and-public-applications), i.e., an application running in a controlled environment, such as a server environment. You cannot implement the CIBA flow directly in a SPA or desktop application; these applications must rely on a backend server.
- **The authorization server**. It's the server that authenticates the user and supports the CIBA flow, such as Auth0.
- **The end user**. This is the customer who needs to be authenticated to allow the user to perform actions on the client application. In the context of our example, this is the customer asking for a change to their order. The end user must have a mobile device with an application enrolled with the authorization server to receive push notifications.

> While in this diagram you have two distinct users, in some scenarios, the user and the end user can be the same person. Consider the case of a user accessing a kiosk in a retail shop or a device without a browser. Read [here](https://auth0.com/blog/ciba-authenticate-customers-in-call-centers/) for more use cases.

Following the numbered arrows in the diagram, we have:

1. The user interacts with the client application and requests the end user's authentication.
2. The client application submits an HTTP request to the authorization server's `/bc-authorize` endpoint  and then start polling the `/token` endpoint to receive the response.
3. The authorization server sends a push notification to the end user's device.
4. The end user interacts with the push notification. The mobile application retrieves the data associated with the authentication request (consent details) and presents it to the end user. At this point, the end user sends their response, i.e., they can accept or deny the request.
5. The client application receives the end user's response. If the response is successful, it also receives the tokens to perform the requested action.


This is a high-level overview of the CIBA flow. For more details on the messages exchanged by the actors involved in the flow, check out [this document](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba).

## The Sample Application

Once you have a high-level understanding of CIBA flow, let's see how to implement it in a .NET application using Auth0.

Assume a call center scenario where an agent with a user on the phone needs to access that user's sensitive data managed by an application. This could be a hospital call center where users ask for information about their medical records. It could also be a tax center where users ask for information about their current tax situation. The agent needs to be sure that the user is who they say they are before giving this information.

You can imagine a screen like the following in front of the call center agent:

![User data screen to initiates the CIBA flow](https://images.ctfassets.net/23aumh6u8s0i/1Uq6DfvHijZcx1eJVkUXZz/156a145dd050bfbca9600255f3ea9371/user-data-screen-to-initiates-ciba-flow.png)

By clicking the "Load sensitive data" button, the agent initiates the CIBA flow to authenticate the user requesting access to their data.

From a technical perspective, the application is a .NET application running on a server. The screenshot above shows a Blazor Web App, but it could be an ASP.NET Core MVC or a Razor Page application. This application has to call a protected API to get the end user's sensitive data, and for this reason, it needs an access token with the appropriate scopes.

The backend application has a mobile counterpart capable of receiving push notifications, and the user must have this application installed on his device, typically a smartphone.

In the following sections, you will learn how to enable CIBA for this application using Auth0. You will start by enabling CIBA support on the backend application and then enable CIBA on the mobile device.

<div className="alert alert-info alert-icon">
  <i className="icon-budicon-487 icon-info"></i>
  <b>This article focuses on the backend application. It mentions how to deal with the mobile application at a high level but redirects you to the specific platform documentation for more details.</b><br> 
</div>


## Add CIBA Support to the Backend App

To add CIBA support to your backend application, you need first to configure your Auth0 tenant and then configure and modify your application's code.

### Enable CIBA support on your Auth0 tenant

To configure your Auth0 tenant to support CIBA, follow these steps in your [Auth0 dashboard](https://manage.auth0.com/):

- Make sure that [your application is registered with Auth0](https://auth0.com/docs/get-started/auth0-overview/create-applications/regular-web-apps) and take note of the domain, client ID, and client secret.
- Scroll down in the application settings and [enable the CIBA flow](https://auth0.com/docs/get-started/applications/configure-client-initiated-backchannel-authentication#configure-ciba-for-your-application).
- Make sure that the API the application is going to call is [registered with Auth0](https://auth0.com/docs/get-started/auth0-overview/set-up-apis) and take note of its identifier, also known as audience.
- Enable [Auth0 Guardian push notifications for your tenant](https://auth0.com/docs/get-started/applications/configure-client-initiated-backchannel-authentication#enable-auth0-guardian-push-notifications-for-your-tenant) and [configure push notifications for MFA](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-push-notifications-for-mfa).
- The user must have [enrolled in MFA push notifications](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian#enroll-in-push-notifications) to receive them.

Once you have configured your Auth0 tenant, go to your application's source code and update the `appsettings.json` configuration file with the following settings:

```json
// appsettings.json

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  "Auth0": {
    "Domain": "YOUR_AUTH0_DOMAIN",
    "ClientId": "YOUR_CLIENT_ID",
    "ClientSecret": "YOUR_CLIENT_SECRET",
    "Audience": "YOUR_API_AUDIENCE"
  }
}
```

Replace the `YOUR_AUTH0_DOMAIN`, `YOUR_CLIENT_ID`, and `YOUR_CLIENT_SECRET` placeholders with the respective application setting values from the Auth0 dashboard. Replace the `YOUR_API_AUDIENCE` placeholder with the audience of the API you want to call.

### Initiate the CIBA flow

Now you are ready to implement the CIBA flow in your backend application.

As the first step, install the [Auth0 Authentication API SDK for .NET](https://github.com/auth0/auth0.net) by running the following command in the root folder of your project:

```bash
dotnet add package Auth0.AuthenticationApi
```

The Auth0 Authentication API SDK is a generic .NET client for the [Auth0 Authentication API](https://auth0.com/docs/api/authentication). It's a low-level library that targets .NET Standard 2.0 and can be used in the legacy .NET Framework as well as the most recent .NET versions. At the time of writing, only the Auth0 Authentication API SDK supports CIBA for .NET.

> Check out [this article to learn more about the various Auth0 SDKs for the .NET platform](https://auth0.com/blog/choose-the-right-dotnet-sdk-for-auth0/).

To initiate the CIBA flow, we assume that when the call center agent clicks the "Load sensitive data" button, the following C# method is called with the user ID as its parameter's value:

```csharp
private async void GetUserData(string userId)
{
  var authenticationApiClient = new AuthenticationApiClient(new Uri($"https://{Configuration["Auth0:Domain"]}"));

  var response = await authenticationApiClient.ClientInitiatedBackchannelAuthorization(
    new ClientInitiatedBackchannelAuthorizationRequest()
    {
      ClientId = Configuration["Auth0:ClientId"],
      ClientSecret = Configuration["Auth0:ClientSecret"],
      Audience = Configuration["Auth0:Audience"],
      Scope = "openid profile read:sensitivedata",
      BindingMessage = "Request to access your private data",
      LoginHint = new LoginHint()
        {
          Format = "iss_sub",
          Issuer = $"https://{Configuration["Auth0:Domain"]}/",
          Subject = userId
        }
    });

  var isAuthorized = false;
  var isPendingAuthorization = true;
  var cibaTokenResponse = new ClientInitiatedBackchannelAuthorizationTokenResponse();

  while (!isAuthorized && isPendingAuthorization)
  {
    try 
    {
      cibaTokenResponse = await authenticationApiClient.GetTokenAsync(
        new ClientInitiatedBackchannelAuthorizationTokenRequest()
        {
          AuthRequestId = response.AuthRequestId,
          ClientId = Configuration["Auth0:ClientId"],
          ClientSecret = Configuration["Auth0:ClientSecret"]
        });
      
      isAuthorized = true;
      isPendingAuthorization = false;
    } catch (ErrorApiException ex)
    {
      if (ex.ApiError.Error == "authorization_pending") 
        Thread.Sleep(5000);
      else
        isPendingAuthorization = false;
    }
  }

  if (isAuthorized)
  {
    await LoadSensitiveUserData(cibaTokenResponse..AccessToken);
  }
}
```

The `userId` parameter contains the ID value of the user in the context of Auth0. Typically, it's a string in the form of `auth0|3813a4b5e...`. Let's break down the code of the `GetUserData()` method into its main parts.

> Be aware that the code shown here is a simplified version of the code you should have in production. Its goal is to explain how to implement the CIBA flow, ignoring performance details and other optimizations.

### Send the CIBA request

Consider the first section of the method:

```csharp
private async void GetUserData(string userId)
{
  var authenticationApiClient = new AuthenticationApiClient(new Uri($"https://{Configuration["Auth0:Domain"]}"));

  var response = await authenticationApiClient.ClientInitiatedBackchannelAuthorization(
    new ClientInitiatedBackchannelAuthorizationRequest()
    {
      ClientId = Configuration["Auth0:ClientId"],
      ClientSecret = Configuration["Auth0:ClientSecret"],
      Audience = Configuration["Auth0:Audience"],
      Scope = "openid profile read:sensitive-data",
      BindingMessage = "Request to access your private data",
      LoginHint = new LoginHint()
        {
          Format = "iss_sub",
          Issuer = $"https://{Configuration["Auth0:Domain"]}/",
          Subject = userId
        }
    });

  //...other code...
}
```

In this part, you create an instance of the `AuthenticationApiClient` class by passing the URL of your Auth0 tenant. Then, you start the CIBA flow by calling the `ClientInitiatedBackchannelAuthorization()` method. This method is responsible for submitting the HTTP request to the `/bc-authorize` endpoint of Auth0. It needs the details of the authorization request, which is passed through an instance of the `ClientInitiatedBackchannelAuthorizationRequest` class.

Apart from the client ID, client secret, and audience, a few other values are passed in the request:

- **Scope**. This is the string containing the [scopes](https://auth0.com/docs/get-started/apis/scopes) requested by the application. In addition to `openid` and `profile`, which are OpenID Connect standard scopes to get the user profile data in an ID token, notice the `read:sensitive-data` scope, which is a specific permission request to access the user's sensitive data.
- **BindingMessage**. This is a message displayed on the user's device to let them know about the request. This ensures that the action taken on the authentication device (the user's phone) is related to the request sent by the application.
- **LoginHint**. It's an object containing information to identify the user who should authorize the requester to access their sensitive data.

### Wait for a CIBA response

After the CIBA request is submitted, the backend application waits for a response from Auth0. This response depends on the action taken by the user on their device, so you need to poll the Auth0's `/token` endpoint to get the needed tokens:

```csharp
private async void GetUserData(string userId)
{
  //...other code...
  var isAuthorized = false;
  var isPendingAuthorization = true;
  var cibaTokenResponse = new ClientInitiatedBackchannelAuthorizationTokenResponse();

  while (!isAuthorized && isPendingAuthorization)
  {
    try 
    {
      cibaTokenResponse = await authenticationApiClient.GetTokenAsync(
        new ClientInitiatedBackchannelAuthorizationTokenRequest()
        {
          AuthRequestId = response.AuthRequestId,
          ClientId = Configuration["Auth0:ClientId"],
          ClientSecret = Configuration["Auth0:ClientSecret"]
        });
      
      isAuthorized = true;
      isPendingAuthorization = false;
    } catch (ErrorApiException ex)
    {
      if (ex.ApiError.Error == "authorization_pending") 
        Thread.Sleep(5000);
      else
        isPendingAuthorization = false;
    }
  }
  
  //...other code...
}
```

You can see a few variables that help control the loop you are about to start.

Within this loop, you call the `GetTokenAsync()` method to get a response from Auth0. This method needs an object as its parameter, which includes the request ID and the application credentials.

Until a positive response is received from the user, you will get an `authorization_pending` exception. In this case, you should suspend the current thread and retry after a few seconds. In the example above, the thread waits 5 seconds. If the user denies authorization, you get an `access_denied` exception.

If the user authorizes the request, you get a response in the `cibaTokenResponse` object containing the ID and access tokens.

> You should catch opportunely the exceptions you get and give the user an appropriate message about why the CIBA flow was not completed.

### Use the tokens

Finally, you have the access token that allows you to call the API to get the user's sensitive data:

```csharp
private async void GetUserData(string userId)
{
  //...other code...
  
  if (isAuthorized)
  {
    await LoadSensitiveUserData(cibaTokenResponse..AccessToken);
  }
}
```

We don't go into the details of calling the protected API using the access token. If you need guidance on this, check out [this article](https://auth0.com/blog/call-protected-api-in-aspnet-core/#Use-Your-Access-Token).

> We have omitted the step of validating the tokens received for simplicity, but it is fundamental for the application's security. Read [this article to learn more about token validation in .NET](https://auth0.com/blog/how-to-validate-jwt-dotnet/). Specifically, read [this section](https://auth0.com/blog/how-to-validate-jwt-dotnet/#Validate-a-JWT--By-Hand-) to learn how to validate them without using a middleware, which applies in our case since we are using the Auth0 Authentication API SDK.

## Add CIBA Support to the Mobile App

While this article focuses on the implementation of the backend application, we can't help but provide some information on its mobile counterpart.

First, you should use the [Auth0 Guardian SDK](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian) to handle the communication with Auth0 on your mobile app.

While developing your mobile application, you should take care of the following steps in the CIBA flow:

- Your mobile app [receives the push notification](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba#step-4-mobile-application-receives-the-push-notification) from Auth0.
- Then it [retrieves the details of the CIBA request](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba#step-5-mobile-application-retrieves-the-consent-details), in particular, the binding message.
- The app [presents the binding message to the user](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba#step-6-mobile-application-presents-the-consent-details-to-the-user), asking them to accept or deny the request.
- Finally, it manages the user's response by [sending it back to Auth0](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba#step-7-mobile-application-sends-the-user-response-back-to-auth0).

## Summary

This article has given you a high-level idea of what CIBA is and in what scenarios you can use it.
Then, you learned how to configure your Auth0 tenant and application to support CIBA. So, you have seen how to integrate CIBA into a .NET application that runs on a server and what steps to consider when developing the mobile counterpart.

Stay tuned for future evolutions of CIBA support in Auth0.

Use CIBA Authentication with Auth0 and .NET

With .NET 9.0, some interesting authentication and authorization features have been added to the platform. Let’s take an overview of them.

.NET 9 introduces interesting new features, primarily focused on cloud-native development and performance. However, the [list of improvements](https://learn.microsoft.com/en-us/dotnet/core/whats-new/dotnet-9/overview) in other areas of the platform is long. This article will focus on the main innovations introduced by .NET 9.0 in authentication and authorization.

## Support for Pushed Authorization Requests (PAR)

One of the most interesting features brought by .NET 9.0 is support for [Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) (PAR), an OAuth 2.0 and OpenID Connect extension that strengthens the security profile of these protocols. PAR allows applications to not expose the parameters of an authorization request through the browser. Instead, it enables direct communication of these parameters between the application and the authorization server. This is very important when you implement applications in a high-security context, such as in the financial, healthcare, or other regulated sectors. If you want to learn the details of [how PAR works, read this article](https://auth0.com/blog/what-are-oauth-push-authorization-requests-par).

ASP.NET Core adds support for PAR to the native [OpenID Connect middleware](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnecthandler). This is a typical configuration of the middleware if you are not using the [Auth0 SDK](https://github.com/auth0/auth0-aspnetcore-authentication):

```csharp
// Program.cs
...
  
builder.services.AddAuthentication(options =>
  {
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
  })
  .AddCookie()
  .AddOpenIdConnect("Auth0", options =>
  {
    options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";

    options.ClientId = builder.Configuration["Auth0:ClientId"];
    options.ClientSecret = builder.Configuration["Auth0:ClientSecret"];
    options.ResponseType = "code";
});

...
```

If the Identity provider you are using supports PAR, you don't need to do anything different from this. In fact, the OpenID Connect middleware transparently supports PAR by default. In other words, if the middleware detects PAR support by analyzing the standard `.well-known/openid-configuration` discovery document, it automatically leverages the PAR endpoint to pass the authorization request parameters. You can change the default behavior by modifying the value of the new option property `PushedAuthorizationBehavior`. For example, the following setting disables PAR support:

```csharp
// Program.cs
...
  
  .AddOpenIdConnect("Auth0", options =>
  {
    options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
    ...
    options.ResponseType = "code";
    
    options.PushedAuthorizationBehavior = PushedAuthorizationBehavior.Disable;
});

...
```

If you want to force your application to use PAR, you can set the value of `PushedAuthorizationBehavior` to `PushedAuthorizationBehavior.Require`. In this case, you get an error if the Identity provider does not support PAR.

Finally, to help customize PAR support, the [`OnPushAuthorization`](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnectevents.onpushauthorization?view=aspnetcore-9.0#microsoft-aspnetcore-authentication-openidconnect-openidconnectevents-onpushauthorization) event has been added to `OpenIdConnectEvents`.

## OAuth and OIDC Parameters Customization

Staying in the context of the OpenID Connect middleware, now you have a simplified way to add custom parameters to the authorization request. Up to .NET 8, if you wanted to add a custom parameter, such as `audience`, to the authorization request, you had to handle the `OnRedirectToIdentityProvider` event as shown in the following code snippet:

```csharp
// Program.cs
...

.AddOpenIdConnect(options =>
{
  options.Events.OnRedirectToIdentityProvider = context =>
  {
    context.ProtocolMessage.SetParameter("audience", "https://myapi.com");
    return Task.CompletedTask;
  };
});
...
```

> If you are using the [Auth0 SDK for ASP.NET Core](https://github.com/auth0/auth0-aspnetcore-authentication), you already have [an easier way to add the audience parameter](https://github.com/auth0/auth0-aspnetcore-authentication/blob/main/EXAMPLES.md#calling-an-api).

.NET 9 introduces the `AdditionalAuthorizationParameters` option to simplify this process. The previous code is equivalent to the following:

```csharp
// Program.cs
...
  
  .AddOpenIdConnect("Auth0", options =>
  {
    ...
    
    options.AdditionalAuthorizationParameters.Add("audience", "https://myapi.com");
});

...
```

## Configuration Flags for Windows Authentication

When using [HTTP.sys](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/httpsys) as a web server for ASP.NET Core applications on Windows systems, you can now configure [Windows Authentication](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth) by setting two new properties:

- `EnableKerberosCredentialCaching`. If this boolean value is `true`, the Kerberos authentication credentials are cached.
- `CaptureCredentials`. If this boolean value is `true`, the HTTP Server API captures the caller's credentials and uses them for Kerberos or Negotiate authentication.

The following code shows an example of usage of these properties:

```csharp
// Program.cs
...
builder.UseHttpSys(options =>
{
    options.Authentication.Schemes = AuthenticationSchemes.Negotiate;
    options.Authentication.EnableKerberosCredentialCaching = true;
    options.Authentication.CaptureCredentials = true;
});
...
```

## Authentication State Serialization for Blazor Web Apps

If you are a Blazor developer, you know how complicated authentication is since [render modes](https://www.telerik.com/blogs/getting-started-blazor-new-render-modes-net-8) have been introduced in .NET 8. You can get an idea by reading [this excerpt](https://auth0.com/blog/auth0-authentication-blazor-web-apps/#Why-Is-Blazor-Authentication-More-Complicated-Now) from my tutorial on adding authentication to Blazor Web Apps. Basically, in an application model where components can be rendered on the server side, on the client side, and on both sides dynamically, you need to keep the user authentication state in sync between the two sides of your Blazor application. This leads to writing a fair amount of code, as you can see by taking a look [here](https://auth0.com/blog/auth0-authentication-blazor-web-apps/#Syncing-the-Authentication-State). In practice, you need to serialize the user authentication state on the server, then send it to the WebAssembly client, which in turn needs to deserialize it. In addition, both authentication states must be kept in sync in order to reflect on the client side the actual authentication state on the server.

Fortunately, .NET 9 simplifies this approach by providing two new methods:

- `AddAuthenticationStateSerialization()`, which adds the services to serialize the authentication state on the server.
- `AddAuthenticationStateDeserialization()`, which adds the services to deserialize the authentication state in the WebAssembly client.

Instead of creating the serializing and deserializing classes yourself, you can now simply call the two methods respectively on the server and on the client to sync the authentication state.

On the server, you will have:

```csharp
// Program.cs
...
builder.Services.AddRazorComponents()
    .AddInteractiveWebAssemblyComponents()
    .AddAuthenticationStateSerialization();
...
```

On the client, you will write the following:

```csharp
// Program.cs
...
builder.Services.AddAuthorizationCore();
builder.Services.AddCascadingAuthenticationState();
builder.Services.AddAuthenticationStateDeserialization();
...
```

Read the [documentation](https://learn.microsoft.com/en-us/aspnet/core/blazor/security/server/?view=aspnetcore-9.0&tabs=visual-studio#manage-authentication-state-in-blazor-web-apps) to learn more.

## Conclusion

Although they are not revolutionary innovations in authentication and authorization, these new features are very convenient because they aim to simplify the work of .NET developers.
In particular, PAR support prevents developers from implementing the extension specifications themselves and encourages the adoption of increasingly advanced security. Also, simplifying the serialization and deserialization of the authentication state in Blazor relieves developers of the burden of implementing specific classes, resulting in potentially fewer bugs.

Authentication and Authorization Enhancements in .NET 9.0

Learn how to authenticate users of your .NET MAUI Blazor application using Auth0.

Add Auth0 Authentication to Blazor Hybrid Apps in .NET MAUI

Add Private Key JWT authentication to your .NET application to empower security in sensitive contexts.

Sensitive operations require increased security mechanisms, but at the same time, threat actors are on the rise, so it's crucial to raise the bar on application authentication security, such as using Private Key JWT authentication. Private Key JWT is a secure authentication method for applications to get security tokens from an authorization server. In this article, you will learn when you may need it, how it works, and how to implement it in a .NET application using Auth0.

## When a Client Secret Is Not Enough

In the OAuth 2.0 context, your application needs to authenticate in order to get an ID, access, and refresh token. This means that your application must provide its [credentials](https://auth0.com/docs/secure/application-credentials), typically a client ID and a secret, to the authorization server, such as Auth0.

Sensitive applications typically run in a server environment and are [confidential clients](https://auth0.com/docs/get-started/applications/confidential-and-public-applications#confidential-applications), i.e., applications capable of securely storing their credentials. Typically, these are server-rendered web applications or back-end services and applications that run in a protected environment. [Public clients](https://auth0.com/docs/get-started/applications/confidential-and-public-applications#public-applications), such as Single-Page Applications or mobile apps, can't securely store a secret. They must use [specific flows](https://auth0.com/docs/get-started/applications/confidential-and-public-applications#grant-types) that don't include client authentication, and their level of security is generally less reliable than that of a confidential client.

Although client authentication based on client secret provides a higher level of security for obtaining the access token than a public client flow, there are contexts in which it is considered insufficient. Think of banking or financial contexts, where the highest levels of transaction security must be ensured. Or in the healthcare context, where data confidentiality must be protected.

In these contexts, various regulations (e.g., [Open Banking](https://www.openbanking.org.uk/)) require the use of more secure mechanisms to protect transactions. Among these mechanisms, they require a more secure alternative to client authentication based on client ID and secret.

## Private Key JWT Authentication

[Private Key JWT authentication](https://auth0.com/docs/secure/application-credentials#private-key-jwt-authentication) is a secure alternative to client authentication based on a secret. It's a [standard mechanism](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-jwt-bearer) that relies on asymmetric cryptography to authenticate your application.

Basically, you generate a private and public key pair. Keep your private key securely stored and accessible to only your application. Don't even share it with Auth0. Share the corresponding public key with Auth0 instead. By nature, the public key is not sensitive data, so even if an attacker manages to catch it, they can't impersonate your application.

When your application needs an access token, it generates a specific JWT, called *assertion*, and signs it with its private key. Then, it sends this assertion to Auth0 in order to authenticate. The following is an example of an HTTP request to authenticate via an assertion:

```bash
curl --request POST \
  --url 'https://<YOUR-AUTH=-DOMAIN>/oauth/token' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=<YOUR_CLIENT_ID> \
  --data client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOi... \
  --data client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer \
  --data audience=<YOUR_API_IDENTIFIER>
```

Auth0 validates the assertion using your application's public key and, if everything is ok, issues your access token.

If you want to learn more details about [how to authenticate with Private Key JWT, read the documentation](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authenticate-with-private-key-jwt). If you use one of the Auth0's SDKs, you don't need to build an assertion yourself, as you will see later in this article.

> Private Key JWT authentication is only available with the [Enterprise plan](https://auth0.com/pricing).



## Highly Regulated Identity and Private Key JWT Authentication

As mentioned, Private Key JWT authentication is a secure client authentication method required in business contexts where higher levels of security must be guaranteed, such as in finance, insurance, and healthcare.

To meet customers' needs in this area, Okta has released [Highly Regulated Identity (HRI)](https://auth0.com/docs/secure/highly-regulated-identity), a set of Auth0 features that enable high levels of security standards, such as [Financial Data Exchange](https://financialdataexchange.org/) and [Open Banking](https://www.openbanking.org.uk/), and compliance with widely adopted regulations, such as the [Payment Services Directive (PSD2)](https://www.europeanpaymentscouncil.eu/sites/default/files/infographic/2018-04/EPC%20Infographic_PSD2_April%202018.pdf).

> Highly Regulated Identity is an add-on for the Enterprise plan. For an overview of [Highly Regulated Identity, check out this article](https://auth0.com/blog/elevate-security-and-ux-with-highly-regulated-identity/).

Private Key JWT authentication is available in the Enterprise plan, so you don't need HRI to use it in your applications. However, if you need to use PS256 as the signing algorithm for your assertions, you need HRI on top of your Enterprise plan. HRI also supports [mutual TLS](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authenticate-with-mtls) as another secure mechanism for client authentication using a public-private key pair.

## The Sample Project

To see how to use Private Key JWT authentication in practice, you will use an ASP.NET Core web application that gets users' health data from a protected API. You can download the sample project by running the following command in a window terminal:

```bash
git clone -b starting-point --single-branch https://github.com/auth0-blog/dotnet-private-key-jwt-authentication
```

You will get two .NET projects:

- *HealthCkeckApi*, an ASP.NET Core Web API project that provides the user's health data through a protected endpoint.
- *HealthCheckWebApp*, an ASP.NET Core MVC application that implements the frontend used by the user to get their own health data.

You need an Auth0 account to configure and run the application. If you don't have one, you can <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for free now</a>. Follow the README document to configure and run the application.

Once your application is up and running and you have logged in, you will see a page like the following:

![HealthCheckWebApp home page](https://images.ctfassets.net/23aumh6u8s0i/6sAQuTcGWazJolzmaTzicI/08d8248e7dcec5cd978f11b633512823/healthcheckwebapp-home.png)

By clicking the *Show Health Checks* button, you will see a list of data like the following:

![HealthCheckWebApp checks data](https://images.ctfassets.net/23aumh6u8s0i/3hLebkfhp5Sn552D5tuppl/f2532b77a0f0577bda3d9cc04b3ddf45/healthcheckwebapp-data.png)

You will work on the *HealthCheckWebApp* application, which represents the OAuth confidential client that needs an access token to call the protected API. The current application implementation uses the [Auth0 ASP.NET Core Authentication SDK](https://github.com/auth0/auth0-aspnetcore-authentication) to authenticate the user and get the access token from Auth0 by using its client ID and secret.

You will modify this application to use Private Key JWT authentication instead of client ID and secret.

## Create and Register Your Public Key

Let's start by creating a private and public key pair. Go to the `HealthCheckWebApp` folder and generate your private and public key pair. For example, using [OpenSSL](https://www.openssl.org/) you can create the key pair with the following command:

```bash
openssl genrsa -out app_keys.pem 2048
```

This command generates an `app_keys.pem` file containing the private and public key pair you will use as a credential for your application.

Extract the public key from that file with the following command:

```bash
openssl rsa -in app_keys.pem -outform PEM -pubout -out pub_key.pem
```

You will get a `pub_key.pem` file containing only the public key. You will be sharing the public key with Auth0, while your private key must be kept safe and never shared with anyone.

Go to your [Auth0 dashboard](https://manage.auth0.com/) and open the *Credentials* tab of your application configuration page, as shown in the following image:

![Private Key JWT credentials in the Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/3jt9HLrTXYTOIwYFkPWSVE/d0c86d8b49331d22f461ea5482a78fac/auth0-private-key-jwt-credentials.png)

Select *Private Key JWT*, and a window like the following will show:

![Private Key JWT credential configuration](https://images.ctfassets.net/23aumh6u8s0i/5YiXuI8YceCxplwKghjmd2/0f8e8d8440e27795de4e6666a6f4ece9/auth0-private-key-jwt-configuration.png)

This window allows you to define a Private Key JWT credential for your application. Assign a name for the credential and upload the `pub_key.pem` file containing the public key. Optionally, select the signing algorithm and set an expiration date. Finally, click the *Add Credential* button to save your changes.

You will see your credential appearing below the *Application Authentication* section:

![Auth0 Private Key JWT authentication credential list](https://images.ctfassets.net/23aumh6u8s0i/0yhreNj2u7io7iTPnyRMB/844280997c40fc67565a27eb0b4fb3bb/auth0-private-key-jwt-authentication-credentials-list.png)

> You can add multiple credentials for your application, as you will learn in a moment.

## Get Your Access Token

Your application is now configured to use Private Key JWT authentication on the Auth0 side. Let's adjust the application code to use this authentication method instead of the client ID and secret.

Open the `appsettings.json` file in the `HealthCheckWebApp` folder and remove the `ClientSecret` key. You don't need it anymore. The file's content will be as follows:

```json
// HealthCheckWebApp/appsettings.json

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  "Auth0": {
    "Domain": "<YOUR-AUTH=-DOMAIN>",
    "ClientId": "<YOUR-CLIENT-ID>",
    "Audience": "https://myapi.com"
  },
  "HealthCheckApiBaseUrl": "https://localhost:7102"
}
```

Now, edit the `Program.cs` file in the `HealthCheckWebApp` folder by applying the changes highlighted in the following code snippet:

```csharp
// HealthCheckWebApp/Program.cs

// ...existing code...

// 👇 new code
var cryptoProvider = new RSACryptoServiceProvider();
cryptoProvider.ImportFromPem(File.ReadAllText("app_keys.pem"));
var securityKey = new RsaSecurityKey(cryptoProvider);
// 👆 new code

builder.Services
    .AddAuth0WebAppAuthentication(options => {
      options.Domain = builder.Configuration["Auth0:Domain"];
      options.ClientId = builder.Configuration["Auth0:ClientId"];
      // 👇 old code
      //options.ClientSecret = builder.Configuration["Auth0:ClientSecret"];
      options.ClientAssertionSecurityKey = securityKey;
      // 👆 new code
      options.Scope = "openid profile email";
    })
    .WithAccessToken(options =>
      {
          options.Audience = builder.Configuration["Auth0:Audience"];
      });

// ...existing code...
```

You load the key pair from the `app_keys.pem` file, generate an instance of the `RsaSecurityKey` class from the content of that file, and assign it to the `securityKey` variable. Then, you replace the assignment of the `ClientSecret` option with the `ClientAssertionSecurityKey` option and assign the value of the `securityKey` variable.

You are done! The Auth0 ASP.NET Core Authentication SDK will take care of creating the assertion and authenticate your application with Auth0 to get the access token. You will notice no difference in the behavior of the application, but under the hood your application uses a more secure authentication method to get the access token to call the protected API.

<include src="ebook-ads/dotnetIdentity" />

## Credential Rotation

When you configured your application to use Private Key JWT authentication, you should have noticed two things:

- You can set an expiration date.
- You can create multiple credentials for the application.

These two optional features allow you to further strengthen the security of Private Key JWT authentication.
In fact, setting an expiration date for a credential is always a good practice, even with secure mechanisms such as Private Key JWT.

However, setting an expiration date can cause some downtime when the old credential expires and the new one has not yet been activated. To avoid this downtime, you can add a new credential before the old one expires. This way, on the application side, you can replace the old credential with the new one before it expires, preventing the application from becoming inoperable.

For more information about credential rotation, see [the documentation](https://auth0.com/docs/get-started/applications/rotate-credentials).

## Summary

Throughout this article, you learned about Private Key JWT authentication and how it increases your application's level of security in obtaining tokens.

Together with other advanced features of Highly Regulated Identity, Private Key JWT helps achieve a high level of security and compliance required in areas such as finance, insurance, and health care.

You also saw how to implement Private Key JWT in a .NET application using the Auth0 SDK, which relieves you of the task of dealing with low-level details.

The final version of the example application code implementing Private Key JWT is available on [GitHub](https://github.com/auth0-blog/dotnet-private-key-jwt-authentication).



Use Private Key JWTs to Authenticate Your .NET Application

A new release of the package Auth0 Templates for .NET is out with new project templates and other improvements.

A new awesome version of the [Auth0 Templates for .NET package](https://www.nuget.org/packages/Auth0.Templates/) has been released! It brings you new templates and other improvements, which we will discover in a moment. Install now the latest release of the templates by running the following command in a terminal window:

```bash
dotnet new install Auth0.Templates
```

> ⚠️ Make sure you have uninstalled any previous version of the package from your machine before installing the new one.

Ready to learn what's new in the latest release? Let's go!

## New Project Templates

The first big news is that two new templates are now available: the Blazor Web App and the MAUI templates.

### The Blazor Web App template

The Blazor Web App template allows you to create a web application using the .NET 8 Blazor application model. As you may know, this new type of Blazor application has some complexities in properly supporting authentication. Take a look at [this article](https://auth0.com/blog/auth0-authentication-blazor-web-apps/) to learn more about it. Now you can have a starting point for your new Blazor application with Auth0 embedded in a snap by simply running the following command:

```bash
dotnet new auth0blazor -o MyNewBlazorApp
```

As usual, if you also have the [Auth0 CLI](https://github.com/auth0/auth0-cli) installed on your machine and logged in, you can automatically register your app with Auth0. Of course, you can still use the templates with Visual Studio:

![Auth0 Blazor Web App template in Visual Studio](https://images.ctfassets.net/23aumh6u8s0i/1fmXTCgaPVzvKGGiW0QPon/edd5f2a979472be788c9c6d448dc1ed0/auth0-blazor-web-app-vs.png)

Read [more about the Blazor Web App template here](https://github.com/auth0/auth0-dotnet-templates/blob/main/docs/auth0blazor.md).

### The MAUI template

With the MAUI template, you can build desktop and mobile applications with Auth0 authentication for Windows, macOS, iOS, and Android using a single code base. In this case, the command to use is as follows:

```bash
dotnet new auth0maui -o MyNewMauiApp
```

Building your new MAUI app using this template will save you a lot of time, as you can see from reading [this article](https://auth0.com/blog/add-authentication-to-dotnet-maui-apps-with-auth0/).

Check out [this document to learn more about the MAUI template](https://github.com/auth0/auth0-dotnet-templates/blob/main/docs/auth0maui.md).

## Other Improvements

In addition to the new templates, the new package brings you other internal and external improvements. To mention just a few of them:

- The Blazor WebAssembly template now supports .NET 8.
- The program that registers your application with Auth0 is no longer tied to .NET 7.0.
- A few issues with the auto-registration script have been fixed.

These improvements help provide a better experience when scaffolding and registering your application with Auth0.

<include src="ebook-ads/dotnetIdentity" />

## JetBrains Rider Support

Now you can use the Auth0 Templates with JetBrains Rider! Starting with [version 2024.1](https://www.jetbrains.com/rider/whatsnew/), Rider fully supports custom templates, so now you can choose your preferred IDE to build your .NET applications with Auth0 integrated, regardless of your operating system. This is especially important now that [Visual Studio for Mac is close to its retirement](https://learn.microsoft.com/en-us/visualstudio/mac/what-happened-to-vs-for-mac?view=vsmac-2022).

Previously, Rider [didn't support parameters for custom templates](https://youtrack.jetbrains.com/issue/RIDER-16759), which was a clear barrier to using the Auth0 Templates. Now you can use them just like in Visual Studio!

![Auth0 Blazor Web App Template in JetBrains Rider](https://images.ctfassets.net/23aumh6u8s0i/2wWfc13e4He4h6Ob3H7Eyu/d4fcd35aab3ae5a1ed41f6ec25fc486b/auth0-blazor-web-app-rider.png)

## A Look Back and a Glimpse Forward

The first version of the package was released one year ago. Since then, the project has grown with new templates and integration with the Auth0 CLI for automatic registration of your applications. During this year, the package has been downloaded over 8,000 times, and we have received suggestions and contributions.

We want to continue improving the current templates by adding features and improving the developer experience. Your feedback is very important. Share your thoughts by leaving a message below, or by opening a [new issue](https://github.com/auth0/auth0-dotnet-templates/issues/new/choose) to report problems and request new features.
If you like the project, don't forget [to star it on GitHub](https://github.com/auth0/auth0-dotnet-templates).

New Templates for Building .NET Apps with Auth0 Authentication

Calling a protected API from a .NET 8 Blazor Web App can be a bit tricky. Let's see what the problems are and how to solve them.

Call Protected APIs from a Blazor Web App

Learn the best practices for securing ID, access, and refresh tokens in your .NET MAUI applications and keeping a consistent user experience.

Managing Tokens in .NET MAUI

Support for .NET MAUI is now available in the Auth0 SDK for .NET Desktop and Mobile Applications. Let's have a quick overview.

The [.NET MAUI framework](https://dotnet.microsoft.com/en-us/apps/maui) allows developers to build desktop and mobile applications running on Windows, macOS, iOS, and Android. You can do it using a single programming language (C#) and a single codebase. Now, you can easily integrate these applications with Auth0 using the [Auth0 SDK for .NET Desktop and Mobile Applications](https://github.com/auth0/auth0-oidc-client-net).

## Meet the .NET MAUI Package

If you have already used the Auth0 SDK for .NET Desktop and Mobile Applications, you may know its internal architecture. The SDK relies on a core library,  [Auth0.OidcClient.Core](https://github.com/auth0/auth0-oidc-client-net/tree/master/src/Auth0.OidcClient.Core), which implements the fundamental functionality of the authentication SDK, and a set of packages that make this functionality available to the several native UI frameworks supported by .NET: WPF, WinForms, UWP, Xamarin. Now the SDK also supports [MAUI](https://github.com/auth0/auth0-oidc-client-net/tree/master/src/Auth0.OidcClient.MAUI), completing the full range of UI options natively supported by .NET.

The addition of MAUI support to the SDK significantly simplifies the integration of Auth0 authentication and authorization services with your applications.

## Install the SDK

To use the .NET MAUI SDK, you have to install it by running the following command in a terminal window:

```bash
dotnet add package Auth0.OidcClient.MAUI
```

If you use Visual Studio, you can install it through the NuGet Package Manager, as shown in the following picture:

![Auth0 MAUI SDK in NuGet package manager](https://images.ctfassets.net/23aumh6u8s0i/3J75iPqg5IdQdiVPVqXt2Z/7103d1d6b52a7d14ab4020665234de26/autho0-MAUI-SDK-nuget-manager.png)

## Use the SDK

Using the SDK is pretty straightforward. The first thing to do is to register your application in the [Auth0 dashboard](https://manage.auth0.com/). If you don't have an Auth0 account, you can <a href="https://a0.to/blog_signup"   data-amp-replace="CLIENT_ID"   data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for free</a>.


In your MAUI project, create an instance of the `Auth0Client` class by providing the configuration parameters taken from the Auth0 dashboard, as shown in the following code snippet:

```csharp
var client = new Auth0Client(new Auth0ClientOptions()
{
  Domain = "<YOUR_AUTH0_DOMAIN>",
  ClientId = "<YOUR_AUTH0_CLIENT_ID>",
  RedirectUri = "myapp://callback",
  PostLogoutRedirectUri = "myapp://callback",
  Scope = "openid"
});
```

Then, you can invoke the `LoginAsync()` method of the client instance to let the user log in:

```csharp
var loginResult = await client.LoginAsync();
```

On the other side, you can let the user log out by calling the `LogoutAsync()` method:

```csharp
await client.LogoutAsync();
```

## Learn More

Of course, the code shown above represents the very basic usage of the SDK, just to give you a high-level idea of how simple it is to use. In a concrete MAUI application, you must configure it to support the different target platforms and write additional code to handle more complex use cases.

For an example of how to use the MAUI SDK, look at our [.NET MAUI Quickstart](https://auth0.com/docs/quickstart/native/maui).

For a more elaborated tutorial, read [Add Authentication to .NET MAUI Apps with Auth0](https://auth0.com/blog/add-authentication-to-dotnet-maui-apps-with-auth0/). Finally, to learn how to use the MAUI SDK to get access tokens and call an API, check out [Call a Protected API from a .NET MAUI App](https://auth0.com/blog/call-protected-api-from-dotnet-maui-application/).

If you have any questions or comments about the MAUI SDK, leave a comment below.

Auth0 SDK for .NET Desktop and Mobile Applications Supports MAUI

Learn how to authenticate users of your .NET MAUI application using Auth0.

Add Authentication to .NET MAUI Apps with Auth0

Let’s find out how to add Auth0 authentication to the new Blazor application model introduced in .NET 8.

Add Auth0 Authentication to Blazor Web Apps

A new version of the Auth0 Templates for .NET package has been released: discover the new powerful features.

In May, we [announced the release of Auth0 Templates for .NET](https://auth0.com/blog/introducing-auth0-templates-for-dotnet/), a NuGet package that allows .NET developers to scaffold a new project with Auth0 embedded. Today, we are announcing the release of a new powerful version of the package: [Auth0 Templates for .NET 2.1](https://www.nuget.org/packages/Auth0.Templates). 🎉

Go to your terminal window and install the new package by running the following command:

```bash
dotnet new install Auth0.Templates
```

> ⚠️ If you already have a previous version of the package installed on your machine, please uninstall it using the following command before installing the new package:
>
> ```bash
> dotnet new uninstall Auth0.Templates
> ```
>
> 

Let's explore what's new and how you can now create **a working application with Auth0 authentication in less than a minute!**

## Auth0 CLI integration

The most prominent feature introduced in this new release is the integration with the [Auth0 CLI](https://github.com/auth0/auth0-cli), the command line tool that allows you to manage your Auth0 tenants and your application registration from your terminal window.

> 📖 If you are new to the Auth0 CLI, take a look at [the Auth0 CLI Basics Lab](https://developer.auth0.com/resources/labs/tools/auth0-cli-basics) to learn how to use it.

If you have the Auth0 CLI installed on your machine and are already logged in to your Auth0 tenant, you can have your new application automatically registered. Let's do an example to better explain.

### Self-Registration in .NET CLI

Suppose you want to create a Blazor Server application with Auth0 authentication embedded. You can start by running the following command in a terminal window:

```bash
dotnet new auth0blazorserver -o MyBlazorServerApp
```

This command uses the `auth0blazorserver` template to create a Blazor Server application in the `MyBlazorServerApp` folder.

After launching the command, you will see a message similar to the following:

```bash
The template "Auth0 Blazor Server App" was created successfully.

Processing post-creation actions...

Template is configured to run the following action:
Actual command: register-with-auth0.cmd 
Do you want to run this action [Y(yes)|N(no)]?
```

With this message, the template engine asks if you want to register the newly created application with Auth0.

Once you confirm, the new Blazor application will be registered on your current Auth0 tenant. You will see the registration data onscreen for documentation purposes only, as you don't need to configure it manually. In fact, your new application will be automatically configured. All you need to do is run your Blazor application with `dotnet run`!

As you can see, using the integration with the Auth0 CLI allows you to have **an application up and running in less than a minute!**

Of course, you can still pass the configuration options on the command line in case you don't have the Auth0 CLI installed or if you have already registered the application with Auth0. See the [specific options for each template](https://github.com/auth0/auth0-dotnet-templates#usage) for more details.

### Auth0 registration in Visual Studio

If you are using the templates with Visual Studio, you can't leverage the self-registering feature. This is not a limitation of the template, but a restriction imposed by Visual Studio (see [this issue](https://github.com/dotnet/templating/issues/4575) for context).

However, you can run the registration action manually. So, assuming you want to create your Blazor Server application with Visual Studio, select the Auth0 Blazor Server App template as shown in the following picture:

![Auth0 Blazor Server template in Visual Studio](https://images.ctfassets.net/23aumh6u8s0i/4vIKOhrrozhmSDMkYPsEUr/5bd66766af25db726fb3aca5c4d731ab/auth0-blazorserver-app-vs.png)

Then, accept the default values proposed by the template configuration window and create the project.

After the project is created, go to the newly created application and run the following command:

```bash
./register-with-auth0.cmd
```

This command will automatically register your Blazor Server application with Auth0 and configure your application.

> Note: On MacOS you must enable the script to execute. Run the following command before launching the automatic registration:
>
> ```bash
> chmod +x register-with-auth0.cmd
> ```

## .NET 8 Support

The new release of Auth0 Templates for .NET supports .NET 8 by default for most templates. When you use the `dotnet new` command without specifying a framework version, you will get a .NET project with .NET 8 as the target framework. This is also the default .NET version when you are using Visual Studio, as shown below:

![Auth0 Template for ASP.NET Core MVC targeting .NET 8](https://images.ctfassets.net/23aumh6u8s0i/1mnYGKi2t006MED0sC2raQ/902bd9cb7b94be9e4b0d4c6c14b9d3ea/auth0-mvc-app-vs-options.png)

Blazor templates do not currently support .NET 8, but they still target .NET 7. The reason for this choice depends on the new .NET 8 Blazor model, which provides a more fluid approach between the Server and the WebAssembly hosting models. Currently, there are no official guidelines on how to integrate OpenID Connect with the new Blazor model. If you are interested in this topic, you can follow [this thread in the Auth0 Community forum](https://community.auth0.com/t/net-8-0-blazor/119691) to stay updated.

<include src="ebook-ads/dotnetIdentity" />

## Minimal API Template

The [Auth0 Templates for .NET package](https://www.nuget.org/packages/Auth0.Templates/) contains four templates since its first release:

- ASP.NET Core MVC
- ASP.NET Core Web API
- Blazor Server
- Blazor WebAssembly (ASP.NET Core hosted)

This new release adds a new template for [ASP.NET Core minimal API](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis). To use this template, add the `--minimal` option to the `dotnet new auth0webapi` command, as shown in the following example:

```bash
dotnet new auth0webapi -o MyWebAPI --minimal
```

This command creates a minimal API project in the `MyWebAPI` folder, and if you have the .NET CLI installed on your machine, it also registers it with Auth0.

In Visual Studio, you can simply select the *Use minimal API* checkbox as shown in the following picture:

![Options for the Auth0 ASP.NET Core Web API template in Visual Studio](https://images.ctfassets.net/23aumh6u8s0i/30Wl7yaOdnuWBhmdbRZa3v/259aa7ca9bb215da9fba8e62bfee8d87/auth0-webapi-app-vs-options.png)

## Looking Ahead

We hope that these new features will help .NET developers set up their new applications with Auth0 more easily than before. Our goal for the next release is to include a template for the missing Blazor model and add templates for other .NET application types.

Your feedback is valuable. If you experience a problem or have a request, please [open an issue](https://github.com/auth0/auth0-dotnet-templates/issues/new/choose) on the project's GitHub repository.

Remember that [Auth0 Templates for .NET](https://github.com/auth0/auth0-dotnet-templates) is an open source project, so your contribution is welcome! If you think you can help, check out [our contribution policy](https://github.com/auth0/auth0-dotnet-templates/tree/main#contributing) and get involved.



Auth0 Templates for .NET: A New Powerful Version Released

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

A quickly implemented Auth0 Action can enhance security by requiring users to log in from trusted IP addresses or blocks.

Ensure Users Log in from Trusted Networks with Auth0 Actions

Let’s explore the new features brought by .NET 8 to support authentication and authorization in your applications.

The release of **.NET 8** is just around the corner. Among the amazing features it brings to developers, it offers a minor revolution in support for authentication and authorization: moving ASP.NET Core Identity from a page-oriented approach to an API-oriented approach.

Let's explore what's going on.

## ASP.NET Core Identity and Token-based Authentication

ASP.NET Core developers have the built-in [ASP.NET Core Identity](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity) framework to add support for local authentication and authorization. The identity framework includes everything that developers typically need to authenticate and authorize users against a local user store. By default, a SQL Server database is created on Windows and a SQLite database is created on macOS, but you can change it to the DBMS of your choice.

The ASP.NET Core Identity framework is designed for server-rendered web applications, such as ASP.NET Core MVC or Razor Pages applications, and has challenges with SPAs, where token-based authentication seems more appropriate. To address this problem, Microsoft has provided built-in project templates for SPAs based on Angular and React with Identity Server support since .NET Core 3.1. However, the .NET community [has not been totally happy with this approach](https://github.com/dotnet/aspnetcore/issues/42158). To [meet the community's demands](https://github.com/dotnet/aspnetcore/issues/42158#issuecomment-1481742187), Microsoft removed the default support for Identity Server in .NET 8 and redesigned the internal architecture of ASP.NET Core Identity to be more suitable for SPAs and native apps. .NET 8 introduces a new set of Identity API endpoints and support for token-based authentication. But let's go in order.

## Bearer Token Authentication Handler

The first building block of this new infrastructure is the new [bearer token authentication handler](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.bearertokenextensions.addbearertoken). This handler is similar to the classic [cookie authentication handler](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.cookieextensions.addcookie) that ASP.NET Core Identity uses by default. The cookie authentication handler is responsible for two things:

- Creating a new session cookie after the user authenticates.
- Building a `ClaimsPrincipal` user object based on a valid session cookie received in the incoming HTTP request.

Similarly, the bearer token authentication handler is responsible for:

- Creating a new token after the user authenticates.
- Building a `ClaimsPrincipal` user object based on a valid token received in the incoming HTTP request.

In other words, the bearer token handler mimics the behavior of the cookie handler to manage authenticated sessions based on a token instead of a cookie.

> Note that the tokens generated by the bearer token handler are not in JWT format. Also, they don't follow any specific standard. While the documentation mentions [access tokens](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.bearertoken.accesstokenresponse.accesstoken?view=aspnetcore-8.0) and [refresh tokens](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.bearertoken.accesstokenresponse.refreshtoken?view=aspnetcore-8.0), they do not implement the [OAuth 2.0 authorization framework](https://oauth.net/2/).

How can this bearer token handler be used in practice?

Consider the following code:

```csharp
// Program.cs

using Microsoft.AspNetCore.Authentication.BearerToken; //👈
using System.Security.Claims;
 
var builder = WebApplication.CreateBuilder(args);
 
builder.Services
    .AddAuthentication()
    .AddBearerToken();  //👈
builder.Services.AddAuthorization();
 
var app = builder.Build();
 
app.MapGet("/login", (string username) =>
    {
        var claimsPrincipal = new ClaimsPrincipal(
          new ClaimsIdentity(
            new[] { new Claim(ClaimTypes.Name, username)},
            BearerTokenDefaults.AuthenticationScheme  //👈
          )
        );

        return Results.SignIn(claimsPrincipal);
    });
 
app.MapGet("/user", (ClaimsPrincipal user) =>
    {
        return Results.Ok($"Welcome {user.Identity.Name}!");
    })
    .RequireAuthorization();
 
app.Run();
```

This application defines two API endpoints:

- The `/login` endpoint creates a `ClaimsPrincipal` user object based on the username sent in the HTTP request and returns the result of signing in.
- The `/user` endpoint returns the username of the authenticated user.

Note the highlighted lines in the code. You have a reference to the new `Microsoft.AspNetCore.Authentication.BearerToken` namespace, which gives you access to the `BearerTokenDefaults.AuthenticationScheme` value. You also configure the bearer token middleware by using the `AddBearerToken()` extension method.

Now, assume you call the `login` endpoint with curl, as shown below:

```bash
curl 'https://<YOUR_HOST>/login?username=joe'
```

You will see a result like the following:

```json
{
  "token_type": "Bearer",
  "access_token": "CfDJ8Ha5YkqG...omitted content...",
  "expires_in": 3600,
  "refresh_token": "CfDJ8Ha5YkqG...omitted content..."
}
```

This JSON contains an access token and a refresh token that you can use to make your calls to the protected APIs exposed by your application. For example, you can now call the protected `/user` endpoint as follows:

```bash
curl -i https://<YOUR_HOST>/user \
-H 'Authorization: Bearer CfDJ8Ha5YkqG...omitted content...'
```

And you will get the following response:

```json
Welcome joe!
```

In summary, the bearer token authentication handler makes it very easy to set up token-based authentication. This is the building block of the whole ASP.NET Core Identity transition to token-based authentication.

## Identity API Endpoints

The second step in adding token-based authentication to ASP.NET Core Identity is to introduce the Identity API endpoints. Basically, this is an API version of the actions that you can perform with ASP.NET Core Identity through the classic web UI. Once you enable the [Identity API endpoints](https://github.com/dotnet/aspnetcore/blob/main/src/Identity/Core/src/IdentityApiEndpointRouteBuilderExtensions.cs), you will get endpoints like `/register`, `/login`, `/forgotPassword`, `confirmEmail`, etc.

The Identity API endpoints solve two of the most complained problems:

- You can build your own UI for user authentication and account management while maintaining the overall UI style of your application.
- After authentication, your app can get access tokens instead of cookies, so it's a more suitable approach for SPAs and native applications.

> Keep in mind that the Identity API endpoints do not implement [OpenID Connect (OIDC)](https://auth0.com/docs/authenticate/protocols/openid-connect-protocol). They simply expose the standard functionality provided by the ASP.NET Core Identity UI through a custom API. They are intended for first-party authentication.

Adding the Identity API endpoints to an ASP.NET Core application relies on two new methods:

- `AddIdentityApiEndpoints()`, which configures the token-based authentication using the bearer token handler in addition to the cookie authentication, and adds a set of identity services.
- `MapIdentityApi()`, which actually adds the Identity endpoints to your application.

The code in your `Program.cs` file will look like the following:

```csharp
// Program.cs

using System.Security.Claims;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthorization();

builder.Services.AddDbContext<ApplicationDbContext>(
    options => options.UseSqlite(builder.Configuration["ConnectionString"]));

builder.Services.AddIdentityApiEndpoints<IdentityUser>()
    .AddEntityFrameworkStores<ApplicationDbContext>();

var app = builder.Build();

app.MapIdentityApi<IdentityUser>();

app.MapGet("/user", (ClaimsPrincipal user) =>
    {
        return Results.Ok($"Welcome {user.Identity.Name}!");
    })
    .RequireAuthorization();

app.Run();
```

Your client will be able to register a user by calling the `/register` endpoint, authenticate the user through the `/login` endpoint, and so on.

While the Identity API endpoints seem to solve the two main complaints about the classic ASP.NET Core Identity, there are [some concerns about using them in a production context](https://andrewlock.net/should-you-use-the-dotnet-8-identity-api-endpoints/), mainly on the security and scalability side.

## Blazor Identity UI

In addition to the changes to ASP.NET Core Identity, .NET 8 integrates the authentication framework into the Blazor project template. You can create a new .NET 8 Blazor application with identity support by running the following command:

```bash
dotnet new blazor -au Individual
```

You will get a Blazor application with everything you need to manage users and authentication locally. You will get a SQLite database to store the user accounts. You will get a SQL Server database if you use Visual Studio to scaffold the application instead of the .NET CLI. You also will get all the pages that allow users to register, authenticate, and manage their account.

The following image shows the built-in login page of a Blazor app:

![Blazor login page](https://images.ctfassets.net/23aumh6u8s0i/3J8DlVMk9qsHw9tLIAwpue/cd94d62d51ce5dc6627bda3c75d14a42/blazor-identity-ui-login.png)

The user authentication and management pages that implement the Blazor Identity UI are not Razor pages as it happens with the classic ASP.NET Core Identity, but [Razor components](https://learn.microsoft.com/en-us/aspnet/core/blazor/components). The template provides you with the source code for all of the UI components in the `Pages/Account` folder of the project. This allows you to customize them according to your application design.

<include src="ebook-ads/dotnetIdentity" />

## Custom Authorization Policies Simplification

Apart from the new features related to ASP.NET Core Identity, .NET 8 introduces a simplification to the definition of custom authorization policies. Previously, you had to write a lot of code to define a parameterized authorization policy to apply to an API endpoint.

For example, suppose you want to define a policy for an endpoint that only authorizes users over the age of 18 and that can be used as shown below:

```csharp
[ApiController]
[Route("api/[controller]")]
public class DrinkController : Controller
{
    [MinimumAgeAuthorize(18)]
    [HttpGet("beer")]
    public string BeerDispenser(ClaimsPrincipal user) => $"Here is your beer, {user.Identity?.Name}!";
}
```

With previous .NET versions, to implement your custom authorization policy, you must write the code outlined in the following code snippet:

```csharp
class MinimumAgeAuthorizeAttribute : AuthorizeAttribute
{
  ...
}

class MinimumAgePolicyProvider : IAuthorizationPolicyProvider
{
  ...
}

class MinimumAgeRequirement : IAuthorizationRequirement
{
  ...
}

class MinimumAgeAuthorizationHandler : AuthorizationHandler<MinimumAgeRequirement>
{
  ...
}
```

You must define an `AuthorizeAttribute`. Then you need to implement an `IAuthorizationPolicyProvider` to handle your custom policy and an `IAuthorizationRequirement` to define the requirement. Finally, you have to implement the `AuthorizationHandler`.

The code snippet shown above outlines the classes you need to implement. To see an example of the actual implementation, take a look at this [code sample](https://gist.github.com/captainsafia/309e408cb5e2c2e5acd44d2e19f7f88e).

Using the new `IAuthorizationRequirementData` interface, your implementation code becomes as follows:

```csharp
class MinimumAgeAuthorizeAttribute : AuthorizeAttribute, IAuthorizationRequirement, IAuthorizationRequirementData
{
  public MinimumAgeAuthorizeAttribute(int age) => Age =age;
  public int Age { get; }

  public IEnumerable<IAuthorizationRequirement> GetRequirements()
  {
    yield return this;
  }
}

class MinimumAgeAuthorizationHandler : AuthorizationHandler<MinimumAgeAuthorizeAttribute>
{
  protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, MinimumAgeAuthorizeAttribute requirement) 
  {
    ...
  }
}
```

You only need to implement two classes instead of four as in the previous example. See [here](https://gist.github.com/captainsafia/7c54e92d12df695ff0908e989fb8531f) for the complete code.

## Summary

Throughout this article, you have learned about the new features that .NET 8 brings to support authentication and authorization. Most of these features are related to the extension of the ASP.NET Core Identity framework to support token-based authentication, which paves the way for authentication in SPAs and native applications.

As a side effect, you get access to the bearer token authentication handler, which allows you to issue access tokens, and to the Identity API endpoints, which allow you to embed authentication support in your Web API.

In addition, the Blazor project template now supports authentication through the Identity API endpoints and a rich set of Razor components designed for user authentication and management.

Finally, the new `IAuthorizationRequirementData` interface allows you to create custom authorization policies with less code.


.NET 8: What's New for Authentication and Authorization

Learn how to validate a JSON Web Token (JWT) in different contexts using C# in .NET.

**JSON Web Tokens (JWTs)** have become very popular. Many developers use them in their applications for authentication and authorization purposes, but not all of them really know why and how to validate their JWTs.

This article will explain why you need to validate a JWT, what it means in general, and give you an overview of the many ways you can do it in the .NET platform.

## What Are JWTs?

If you landed on this article, you probably know what a JSON Web Token is. If not, [here is a great introduction to JWTs](https://jwt.io/introduction) and [a tool to decode them](https://jwt.io/#debugger-io).

Simply put, JSON Web Token is an [open standard](https://datatracker.ietf.org/doc/html/rfc7519) that defines how to share information between parties using the [JSON format](https://datatracker.ietf.org/doc/html/rfc8259). The [JWT structure](https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-token-structure) consists of three concatenated Base64 url-encoded strings, separated by dots: the header, the payload, and the signature The information carried by a JWT is **digitally signed so you can verify its origin and trust it**. The digital signature also guarantees the integrity of the information, but it doesn't guarantee privacy unless explicitly encrypted.

Besides this, the JWT specification doesn't define the specific purpose of a token. While most developers think of authentication when dealing with JWTs, this is not an intrinsic property of tokens in the JWT format. JWT is just a format. The meaning of the token depends on the specific context or application.

For example, in the [OpenID Connect](https://openid.net/developers/how-connect-works/) (OIDC) context, the JWT format is used for the ID token, which is the token that proves a user is authenticated. In the [OAuth 2.0](https://auth0.com/docs/authenticate/protocols/oauth) context, the [JWT format can optionally be used for the access token](https://datatracker.ietf.org/doc/html/rfc9068), which is the token that allows a client application to access a specific resource on behalf of the user.

> To learn more about ID and access tokens and their differences, you can read [this blog post](https://auth0.com/blog/id-token-access-token-what-is-the-difference/) or watch [this video](https://www.youtube.com/watch?v=vVM1Tpu9QB4) instead.

<include src="ebook-ads/JwtHandbook" />

## What Does Token Validation Mean?

The main purpose of a JWT is to carry information that the recipient can trust. So, the first thing your application needs to do when it receives a JWT is to ensure that the information it carries is trustworthy. This is where validation comes in.

In short, validating a JSON Web Token means ensuring that the token has the structure defined in the standard specification and that you can trust the information it carries.

The JWT validation is based on the following five criteria:

- **Token structure**. The first check is about the token's structure. Does the token match the structure of a JSON Web Token? If the token doesn't follow the standard guidelines, it's not valid.

- **Token integrity**. The next check is for the token's integrity. Has the token been tampered with? You can verify this by checking the signature. If you verify that the token's signature is valid, then it has not been altered in any way.
- **Token expiration**. JWTs have an expiration time defined in the `exp` claim. Is the token expired when it has been received? If a token has expired, you should no longer trust its contents.
- **Expected authority**. The next check is to verify that the token was issued and signed by the expected sender (authority). There are two steps to this check:
  - Verify that the authority is the one expected by your application by comparing it to the `iss` claim (issuer).
  - Verify that the key used to sign the JWT actually belongs to the expected authority.
- **Expected audience**. Finally,  verify that the token is intended for your application. In other words, you should check that the `aud` claim matches with the value that identifies your application. For example, in an ID token, the value for the audience is the client ID; in an access token in JWT format, the value for the audience is the [API identifier](https://auth0.com/docs/get-started/apis/api-settings#general-settings).

> To learn more about [digital signatures, read this article](https://auth0.com/blog/how-to-explain-public-key-cryptography-digital-signatures-to-anyone/). Check out [this article](https://auth0.com/blog/rs256-vs-hs256-whats-the-difference/) for the differences between the signing algorithms used in a JWT.

Token validation doesn't involve the custom information carried by the token. This is an application-specific logic, which is out of the scope of token validation. For example, validating an ID token does not include verifying that the user's email address in the `email` claim exists.

## Validate a JWT Using an Auth0 SDK

Now that you know what validating a JWT means, you are ready to learn how to validate your tokens in .NET.

Before jumping into the validation code, you should evaluate whether you really need to explicitly validate the JWTs you receive from an issuer like Auth0. Depending on the specific application, you may want to use an Auth0 SDK, which will take care of all the validation steps for you. For example, if you are developing an ASP.NET Core MVC application or a Blazor Server application, you can use the [Auth0 ASP.NET Core Authentication SDK](https://github.com/auth0/auth0-aspnetcore-authentication). This SDK will take care of the entire process of obtaining the JWT tokens for your application, including token validation. Check out [this article](https://auth0.com/blog/exploring-auth0-aspnet-core-authentication-sdk/) for an overview of this specific SDK.

So, if your application can benefit from an SDK, the best move is to write less code and get the JWT validation for free. Take a look at [this article to learn which Auth0 SDK is right for your .NET application type](https://auth0.com/blog/choose-the-right-dotnet-sdk-for-auth0/). 

## Using the ASP.NET Core Middleware

If, for some reason, you can't use an Auth0 SDK, you can configure your ASP.NET Core application by using two middleware:

- The [OpenIdConnect middleware](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.OpenIdConnect), which allows your ASP.NET Core web applications to authenticate users and get ID and access tokens via [OpenId Connect](https://openid.net/developers/how-connect-works/).
- The [JwtBearer middleware](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.JwtBearer), which enables your ASP.NET Core web API to handle access tokens.

Both middleware provide you with a convenient way to obtain and validate JWT tokens. The following code snippet shows an example of how to configure OpenIdConnect middleware:

```csharp
// Program.cs

var builder = WebApplication.CreateBuilder(args);


builder.Services.AddAuthentication(options => {
    options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
  })
  .AddCookie()
  .AddOpenIdConnect("Auth0", options => {
    options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
    options.ClientId = builder.Configuration["Auth0:ClientId"];
    options.CallbackPath = new PathString("/callback");
  });

// ...other code...
```

The next example shows how to use the JwtBearer middleware:

```csharp
// Program.cs

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
  .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
  {
    options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
    options.Audience = builder.Configuration["Auth0:Audience"];
  });

// ...other code...
```

In both cases, by configuring the `Authority` option, you implicitly ask the middleware to validate your tokens. The middleware will use this value to retrieve the issuer's signing key, which is needed to validate the token's signature. All the other required validation steps are performed automatically. There is nothing else you need to do.

### Simplified configuration for the JwtBearer middleware

Starting with .NET 7, you can [use the JwtBearer middleware in a simplified way](https://auth0.com/blog/whats-new-in-dotnet-7-for-authentication-and-authorization/#Simplified-Configuration). You define your validation values in the `appsettings.json` file, as in the following example:

```json
// appsettings.json

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  "Authentication": {
    "Schemes": {
      "Bearer": {
        "Authority": "https://{DOMAIN}",
        "ValidAudiences": [ "{AUDIENCE}" ],
        "ValidIssuer": "{DOMAIN}"
      }
    }
  }
}
```

Then you can simply add the middleware to your ASP.NET Core application, as follows:

```csharp
// Program.cs

// ...existing code...

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication().AddJwtBearer();

// ...existing code...
```

The behavior is exactly the same as before but with much less code.

### Custom validation with the ASP.NET Core middleware

If you have specific needs, you can customize the JWT validation using the `TokenValidationParameters` option. For example, if you already have the issuer's public key stored on your file system, you can configure your middleware as shown in the following example:

```csharp
// Program.cs

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
  .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
  {
    options.Audience = builder.Configuration["Auth0:Audience"];
    options.TokenValidationParameters = 
      new Microsoft.IdentityModel.Tokens.TokenValidationParameters
      {
        ValidateIssuer = true,
        ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}",
        ValidateIssuerSigningKey = true,
        IssuerSigningKey = new X509SecurityKey(new X509Certificate2(certificateFilePath)),
        ValidateLifetime = true
      };
  });

// ...other code...
```

You can see that the `Audience` option is still there while the `Authority` option is missing. Instead of the `Authority` option, you find the `TokenValidationParameters` option, which is assigned an instance of the `TokenValidationParameters` class. The properties of this instance define what to check in order to complete the JWT validation. Specifically, you ask to validate the issuer (`ValidateIssuer`) and provide the value to match with (`ValidIssuer`). You ask to validate the issuer's signature (`ValidateIssuerSigningKey`) and provide the issuer's public signing key (`IssuerSigningKey`) embedded in a certificate stored in the file system. And finally, you ask to check the expiration time (`ValidateLifetime`).

You can see how removing the `Authority` option from the middleware configuration forces you to manually specify what to check in order to validate the token.

## Validate a JWT “By Hand”

In case you can't use the ASP.NET Core middleware, for example, when you are not developing a web application, don't get desperate. .NET gives you what you need, although this requires some effort on your side.

### Validate your token

First, you need to install the `Microsoft.IdentityModel.Tokens` package from NuGet:

```bash
dotnet add package Microsoft.IdentityModel.Tokens
```

This package provides everything you need for token manipulation, including validation, of course.

Have a look at the following function:

```csharp
public bool ValidateToken(
  string token, 
  string issuer, 
  string audience, 
  ICollection<SecurityKey> signingKeys,
  out JwtSecurityToken jwt
)
{
  var validationParameters = new TokenValidationParameters {
          ValidateIssuer = true,
          ValidIssuer = issuer,
          ValidateAudience = true,
          ValidAudience = audience
          ValidateIssuerSigningKey = true,
          IssuerSigningKeys = signingKeys,
          ValidateLifetime = true
  };

  try
  {
    var tokenHandler = new JwtSecurityTokenHandler();
    tokenHandler.ValidateToken(token, validationParameters, out SecurityToken validatedToken);
    jwt = (JwtSecurityToken)validatedToken;
    
    return true;
  } catch (SecurityTokenValidationException ex) {
    // Log the reason why the token is not valid
    return false
  }
}
```

This function takes a token and validates it by using the other parameters: the issuer, the audience, and the signing keys. If the token is valid, it returns `true` and provides a `JwtSecurityToken` instance representing the token as the `jwt` output parameter.

Once again, you see the `TokenValidationParameters` class, which allows you to define the validation criteria. This time there is no implicit validation. You need to specify all the required validation criteria and the valid values. Then you create a token handler (`JwtSecurityTokenHandler`) and use it to validate the token against the validation parameters. If the validation succeeds, you get an object representing the token, which you assign to the output parameter after casting to `JwtSecurityToken`. Finally, the function returns `true`.

If the validation fails, it should log the reason for the failed validation and return `false`.

### Get the signing keys

The `ValidateToken()` function expects you to pass the basic information for the token validation: the token issuer identifier, the audience, and the issuer's signing keys. You may have all this information on hand or need to retrieve some of it. For example, you can obtain the signing key of the issuer online. According to the [OIDC standard](https://openid.net/specs/openid-connect-discovery-1_0.html), you can find the set of keys (*JSON Web Key Sets*) to verify the issuer's signatures at a public and well-defined URL: `https://{DOMAIN}/.well-known/openid-configuration`.

Read [this document to learn more about the JSON Web Key Sets](https://auth0.com/docs/secure/tokens/json-web-tokens/locate-json-web-key-sets).

To validate a JWT using the `ValidateToken()` function, you must first retrieve the signing key from this URL. As you can see, things start to get complex. This is why I suggest using an Auth0 SDK in the first place, or at least the ASP.NET Core middleware, if possible.

However, if using one of these tools is not feasible in your specific case, here is what you need to do to get the issuer's signing keys.

First, you need to install another package from NuGet: the `Microsoft.IdentityModel.Protocols.OpenIdConnect` package:

```bash
dotnet add package Microsoft.IdentityModel.Protocols.OpenIdConnect
```

This package provides you with the `ConfigurationManager` class, which helps you retrieve the JSON Web Key Sets. The following code shows you how to obtain the signing key of your JWT issuer:

```csharp
var configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(
  $"https://{builder.Configuration["Auth0:Domain"]/.well-known/openid-configuration}",
  new OpenIdConnectConfigurationRetriever(),
  new HttpDocumentRetriever());

  var discoveryDocument = await configurationManager.GetConfigurationAsync();
  var signingKeys = discoveryDocument.SigningKeys;
```

Once you have the signing keys, you are ready to use the `ValidateToken()` function.

## Recap

Throughout this article, you have learned what JWT validation is and why you need to do it. You also learned that as a .NET developer, you have many options for validating the JWTs your application receives: from a zero-code approach to an almost manual validation.

With the Auth0 SDKs, you get the JWT validation for free. No specific code is required. The SDKs validate tokens for you.

Using the ASP.NET Core middleware, OpenIdConnect and JwtBearer, you get implicit token validation in the default cases. However, you can customize your validation criteria if you are dealing with special cases.

In case you need full control over the validation process, you can rely on the `Microsoft.IdentityModel.Tokens` package for the JWT manipulation and validation and on the `Microsoft.IdentityModel.Protocols.OpenIdConnect` package for retrieving the issuer's signing keys.

Of course, the suggestion is to delegate as much as possible to the SDKs and middleware because the less code you write, the fewer bugs you may create 🙂.


How to Validate JWTs in .NET

Create your .NET applications secured with Auth0 in less than a minute with Auth0 Templates for .NET.

<div class="alert alert-info alert-icon">
   <i class="icon-budicon-500"></i>
   <strong>A new version of Auth0 Templates for .NET is available!<br/>
Check out <a href="/blog/auth0-templates-for-dotnet-powerful-version/">Auth0 Templates for .NET: A New Powerful Version Released</a> to learn what new features it brings to you.
   </strong>
 </div>

Project templates are a handy way to scaffold an application in minutes, if not seconds. .NET developers are used to templates since Microsoft provides several built-in project templates for .NET through the [.NET SDK](https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-new-sdk-templates) or [Visual Studio](https://learn.microsoft.com/en-us/visualstudio/ide/creating-project-and-item-templates).

Now you have .NET templates with Auth0 embedded, including the right Auth0 SDK and best practices for a given type of application! You can build your .NET projects integrated with Auth0 in seconds using the .NET CLI or the IDE you prefer: Visual Studio or Visual Studio Code.

## What Is Auth0 Templates for .NET?

[Auth0 Templates for .NET](https://github.com/auth0/auth0-dotnet-templates) is a project that provides you with a set of project templates to help you scaffold your application with Auth0 support for authentication and authorization. Currently, the project offers templates for the following application types:

- ASP.NET Core MVC
- ASP.NET Core Web API
- Blazor Server
- Blazor WebAssembly (ASP.NET Core hosted)

More templates will be added in the near future. The templates target .NET 7 and allow you to create your applications by using the typical approach you are accustomed to using the built-in templates.

## Install the Package

The Auth0 Templates for .NET project uses the [modern template approach](https://learn.microsoft.com/en-us/dotnet/core/tools/custom-templates), which guarantees high compatibility across different development environments and operating systems. This means that you can use the templates with your preferred development environment: .NET CLI, Visual Studio for Windows and Mac, or Visual Studio Code.

Even JetBrains Rider is supported, but at the time of writing, there is still an [issue with parameter support](https://youtrack.jetbrains.com/issue/RIDER-16759) that prevents the full power of the templates from being used.

To install the [Auth0 Templates for .NET NuGet package](https://www.nuget.org/packages/Auth0.Templates/), run the following command in a terminal window:

```bash
dotnet new install Auth0.Templates::2.0.1
```

Once the package is installed, use your preferred IDE to create your application.

## Create Your .NET Project

Let's see how you can use the templates to create a new .NET application. First, there are some preliminary steps to take. The templates assume that you have already registered your application with Auth0 and have all the necessary configuration settings at hand.

To integrate your application with Auth0, you need an Auth0 account. You can <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free one now</a>. Then you need to [register your application](https://auth0.com/docs/get-started/auth0-overview/create-applications) or [your API](https://auth0.com/docs/get-started/auth0-overview/set-up-apis) in the Auth0 dashboard. The registration step will return some data that you will use to set up your app through the templates. Basically, this data is a subset of the following:

- the Auth0 domain, 
- the client ID, 
- the client secret, 
- the API identifier or audience.

Once you have this data from the Auth0 dashboard, you are ready to use the Auth0 templates for building your app.

### Use the templates in .NET CLI

You can leverage the `dotnet new` command to list the available templates. For example, you can run the following command to get the list of available Auth0 templates:

```bash
dotnet new list auth0
```

As a result of this command, you should see the following list:

```bash
Template Name                 Short Name         Language  Tags                        
----------------------------  -----------------  --------  ----------------------------
Auth0 ASP.NET Core Web API    auth0webapi        [C#]      Web/WebAPI/Auth0            
Auth0 ASP.NET Core Web App    auth0webapp        [C#]      Web/MVC/Razor Pages/Auth0   
Auth0 Blazor Server App       auth0blazorserver  [C#]      Web/Blazor/Auth0            
Auth0 Blazor WebAssembly App  auth0blazorwasm    [C#]      Web/Blazor/WebAssembly/Auth0
```

Suppose you want to learn the CLI syntax for using the Blazor Server template. You run the following command in your terminal:

```bash
dotnet new auth0blazorserver --help
```

This command will show you all the options you can provide to build an already configured Blazor Server application.

To create a new Blazor Server app through the Auth0 template, use the following command:

```bash
dotnet new auth0blazorserver \
    --domain <YOUR_AUTH0_DOMAIN> \
    --client-id <YOUR_CLIENT_ID> \
    -o MyBrandNewApp
```

> The line continuation character (`\`) shown above is just for presentation purposes. Use the appropriate character for your command line shell if you want to use it in your operating system.

Replace the placeholders `<YOUR_AUTH0_DOMAIN>` and `<YOUR_CLIENT_ID>` with the actual values you got when registering your app in the Auth0 dashboard. This command will create your Blazor Server application in the `MyBrandNewApp` folder.

After creating the app, you can run it and test authentication support in a minute!

> Read [this document to learn how to use the available Auth0 templates](https://github.com/auth0/auth0-dotnet-templates/tree/main#usage).

### Use the templates in Visual Studio

The templates installed with the above command are also available in Visual Studio. Select the Auth0 template for the app you want to create, as shown in the following picture for Visual Studio for Windows:

![Auth0 templates in Visual Studio for Windows](https://images.ctfassets.net/23aumh6u8s0i/5A53ehX7663L0HxkB65Aos/2cbbbb09f3ad4c4979e052f4f02b2ac2/auth0-blazorserver-app-vs.png)

The following picture comes from Visual Studio for Mac:

![Auth0 templates in Visual Studio for Mac](https://images.ctfassets.net/23aumh6u8s0i/7nyet9ozGX1bk4Kf4AFipb/00d4a3fbb394bde20e132526244161ce/auth0-blazorserver-app-vs-mac.png)

You will then be prompted for the registration information, as shown in the following picture (Visual Studio for Windows):

![Auth0 template options in Visual Studio for Windows](https://images.ctfassets.net/23aumh6u8s0i/3YMXIB1UY58WD2iFCeydyX/8e03f036e38cc6a6a5136328c3077947/auth0-blazorserver-app-vs-options.png)

This is the corresponding screen on Visual Studio for Mac:

![Auth0 template options in Visual Studio for Mac](https://images.ctfassets.net/23aumh6u8s0i/2rctCGwBn68ACigGj6wf2L/98b0805b10d53e76d49014f53c9123f9/auth0-blazorserver-app-vs-mac-options.png)

Next, you specify the project's name and where you want to save it, as you would with standard templates. That's it! Once the application is created, you can run it and test authentication.

> Read [this document to learn how to use the available Auth0 templates](https://github.com/auth0/auth0-dotnet-templates/tree/main#usage).

<include src="ebook-ads/dotnetIdentity" />

## Looking Forward

This is the first release of the [Auth0 Templates for .NET](https://www.nuget.org/packages/Auth0.Templates/) package, but we want to add new templates and improve the developer experience as well. Your feedback is highly appreciated, so please leave your comments below and let us know what you think about this project.

The [Auth0 Templates for .NET project](https://github.com/auth0/auth0-dotnet-templates) is open source, so your contribution is also welcome! If you think you can help with this project, check out [our contribution policy](https://github.com/auth0/auth0-dotnet-templates/tree/main#contributing) and get involved.


Introducing Auth0 Templates for .NET

arthur-bellore

I’m a tech content creator. I enjoy breaking up seemingly complicated topics into easy-to-understand pieces for people to read. When I’m not in front of a computer, you’ll usually find me reading books.

Cybersec Writer

Arthur Bellore

Transport Layer Security (TLS) is the cryptographic protocol behind pretty much any computer network used today: from web browsing to email, APIs, and VoIP. But how exactly does it work?

## SSL vs. TLS

SSL, or Secure Sockets Layer, is the predecessor to TLS. It was a cryptographic protocol developed by Netscape in 1994, but since it had serious flaws, it was never released to the public. SSL 2.0 was released publicly one year later, in 1995, but it, too, was found to have serious flaws. Finally, SSL 3.0 was rebuilt from the ground up and released in 1996.

Microsoft, who had its own version of the protocol, and Netscape agreed to hand over the project to the Internet Engineering Task Force (IETF) and make it an open standard. As part of the deal, the name was changed to TLS, Transport Layer Security, to signify that it no longer had ties with Netscape.

The first upgrade to SSL 3.0 was published in 1999 in [RFC 2246](https://datatracker.ietf.org/doc/html/rfc2246) as TLS 1.0. Tim Dierks, the editor of RFC 2246, has said [in his blog](https://tim.dierks.org/2014/05/security-standards-and-name-changes-in.html) that TLS 1.0 was really SSL 3.1, but they changed the name “so it wouldn’t look the IETF was just rubberstamping Netscape’s protocol.” Indeed, if you look at RFC 2246, it says:

This document describes TLS Version 1.0, which uses version { 3, 1 }. Version value 3.1 is historical: TLS version 1.0 is a minor modification to the SSL 3.0 protocol, which bears the version value 3.0.

TLS became the standard of encryption and authentication over computer networks, and it’s still being used today. The most recent version of the protocol is TLS 1.3, which was released in August 2018.

### What is the difference between SSL and TLS?

SSL hasn’t been updated since its release in 1996, and it was deprecated in 2015 in [RFC 7568](https://datatracker.ietf.org/doc/html/rfc7568). Most [modern browsers disable it by default](https://en.wikipedia.org/wiki/Version_history_for_TLS/SSL_support_in_web_browsers) or don’t support it outright anymore.

Despite this, because of the association between the two, many people still use the term SSL when they really mean to say TLS. Vendors typically use the same terms their target customers use to facilitate messaging, so their marketing collateral generally contains terms such as “SSL/TLS” or “SSL,” even though SSL is deprecated.

We now know that SSL and TLS are different things, but for the remainder of this article, SSL will be used interchangeably with TLS to match its everyday usage.

## Why SSL/TLS Was Created

For two computers to communicate with each other, they must perform a set of agreed-upon operations in a specific order. A **protocol** is what dictates those operations. The HTTP protocol is the protocol that web servers and clients use to establish a connection and communicate with each other through the Internet.

It works roughly as follows:

1. The server listens for new connections on port 80
2. The client connects to the server, and this starts a chain of operations as set forth by the HTTP protocol
3. The client sends a GET request to the server; the server receives the request, processes it, then sends back a response: headers and index.html, plus other content it might need to serve (CSS files, JavaScript files, cookies, etc.) for the client to render the content correctly.

This works to distribute content between two remote computers, but there is a problem: HTTP was intended to expand the local knowledge management tools throughout the multiple computers at CERN in the late 1980s, so it was designed as a clear text protocol.

Because it’s clear text, a malicious actor could insert themselves between client and server and potentially read sensitive information, such as credit card numbers or passwords, or they could intercept the client’s requests and serve back malicious files pretending to be server.

As the Internet evolved and the number of sensitive information flying around increased exponentially, an encryption layer sitting below HTTP was necessary. However, this is a bit tricky: if a bad actor can “listen in” the conversation between client and server while the connection is unencrypted, how can they exchange encryption keys securely?

One option would be for the two parties to create a public-private key pair and send over the public key pair to the other party, so they can use that to encrypt their packet before sending them over the wire.

The problem with this is that asymmetric (public-key) cryptography is _much slower_ than symmetric cryptography.

The "strength" of asymmetrical cryptography relies on modular arithmetic, mathematical operations that are very hard to do in the opposite direction. The numbers used in these operations need to be big enough to provide the necessary security, but performing arithmetic with very large numbers can be taxing on a CPU.

Symmetric cryptography, on the other hand, works differently and does not suffer from this problem. On top of that, most devices have AES instruction sets integrated into their CPUs to speed up AES operations, making AES encryption have almost zero overhead on modern devices.

The TLS protocol gets around this issue by using asymmetric cryptography to exchange keys at the beginning and then switch to symmetric keys (“sessions keys”) from then on in a process known as the TLS handshake.


## TLS handshakes

The exact steps of the TLS handshake will depend on which TLS version is supported by the client and server, as well as which parameters they are set to use.

Since most modern browsers still support TLS 1.2 and a lot of websites still use TLS 1.2 (according to a [paper published by Syed-Winkler](https://www.grin.com/document/1037281), as of February 2021, TLS 1.3 is supported by 42.9% of surveyed websites, while TLS 1.2 is supported by 99.3%), we will talk about TLS 1.2 first and then discuss how TLS 1.3 differs from 1.2.


### The TLS 1.2 handshake

TLS 1.2 can be configured to use many key exchange algorithms, and among them, the most well-known and widely used is the RSA key exchange algorithm. Let’s go over how the RSA algorithm works in TLS 1.2, then talk about how the process differs in TLS 1.3 with the [Diffie-Hellman](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange) (DH) key exchange algorithm.

The RSA key exchange works roughly as follows in TLS 1.2:

1. **Server listens for new connections on port 443.**
2. **Client connects to port 443 and initiates the handshake process with a ClientHello message to the server.** This message contains the TLS versions and cipher suites the client supports and a 32-byte random number known as Client Random.
3. **Server says “hello” back with a ServerHello message.** The server selects a cipher and the TLS version from the list provided by the client, then generates a different 32-byte random number known as Server Random and sends it all back along with the server’s own SSL certificate.
4. **Client uses the SSL certificate to verify the server’s identity.** SSL certificates contain a public key generated by the server and a digital signature signed with the private key of a trusted third party known as a certificate authority (CA). Most web browsers and operating systems come bundled with public keys from trusted CAs, which are used to verify that the CA issued the certificate.
5. **The client verifies the server has the matching private key to the certificate through ClientKeyExchange.** The client generates the pre-master secret (a 48-byte random number) and encrypts it with the server’s public key obtained from the certificate. If the server is the true owner of the certificate, it must be able to decrypt the message and obtain the original pre-master secret.
6. **Server decrypts the pre-master secret.** Now both the server and client have the pre-master secret, the Server Random, and the Client Random. They can use that to derive the master secret using the previously agreed cipher and arrive at the same (symmetric) key, which will become the session key once both parties verify their keys match.
7. **Client sends a ChangeCipherSpec message.** This indicates that the client is ready to create the session key and start communicating through an encrypted tunnel using that key.
8. **Client proves to server it has the correct keys.** The client hashes all handshake records up to that point, encrypts them with the session key, and sends them to the server. If the server generates the correct key, it will be able to decrypt that message and verify the record hashes (which the server can independently generate).
9. **Server proves to the client that it has the correct keys.** The server does the same thing and sends it to the client.
10. **A secure connection is established.** If both keys match, the TLS handshake is complete.

<br>
#### Problems with TLS 1.2

TLS 1.2 left a lot of its configuration parameters up to the users, which often resulted in bad choices (the old security adage of “among too many options, the worst one will be chosen”).

Additionally, in the name of backward compatibility, TLS 1.2 also allowed old, insecure ciphers to be used. (TLS 1.2 itself was released in 2008.) As time passed, it became more prone to attacks as vulnerabilities in older cipher or versions of TLS were discovered.

On top of all that, the RSA key exchange has a few weaknesses:

* **The same public-private key pair is used both to authenticate the server and to encrypt the pre-master secret (item #5 above).** If an attacker obtains the private key, they will be able to re-generate the session keys and be to decrypt the entire session.
* **There is no Perfect Forward Secrecy (PFS).** Since the server’s private key doesn’t change, an attacker might record and store encrypted data for years, hoping to decrypt it years down the line if the server’s private key is ever leaked or compromised.
* **Performance.** It’s necessary to make two round trips between the client and server until the session key is established.

To address these problems, the IETF began developing TLS 1.3 in 2013 and finally released it to the public in August 2018.

### What changed in TLS 1.3

In practice, the main differences between TLS 1.3 and 1.2 are:

* Shorter handshake
* Only supports key exchange algorithms with perfect forward secrecy (PFS), such as ephemeral Diffie-Hellman
* Support for 0-RTT (Zero Round Trip Time) resumption

This represents a bit of a paradigm change in TLS 1.3: shifting the focus from user configurability and backward compatibility to security by being more opinionated.

This allowed the designers to create a shorter handshake (by restraining DH as the only key exchange algorithm) but also prevented developers from choosing insecure options by restricting the number of options available in the first place.

For example, while it was technically possible to use DH as the key exchange method in TLS 1.2, the participants were responsible for setting the DH parameters. Picking the right parameters is crucial to make sure the DH exchange is secure, as some parameters can be trivially broken.

In 2015, security researchers [published a paper](https://weakdh.org/) describing how the WeakDH attack, which affected 8.4% of the top 1 million domains at the time, could trick servers into using small (insecure) DH parameters, enabling adversaries to decrypt data transmitted between client and server.

TLS 1.3 makes it impossible to use anything but a set of DH parameters that are believed to be secure.

### The TLS 1.3 handshake

Because there are significantly fewer options for the client and server to agree on, the TLS 1.3 handshake is much simpler:

1. **Server listens for new connections on port 443.**
2. **Client connects to port 443 and initiates the handshake process with a ClientHello message to the server.** Since the list of cipher suites was vastly reduced in TLS 1.3 (from 37 to 5), the client assumes the server is going to use one of the five. It proactively calculates a key pair for each of the cipher suites and sends it to the server along with the protocol version.
3. **Server calculates the key session.** With the client’s key share, the server is able to generate the session key.
4. **Server says “hello” back with a ServerHello message.** The server generates its own key share and sends it over to the client, so it also can generate the session key, along with the server’s encrypted SSL certificate (using the session key created on #3).
5. **Client generates master secret and a secure connection is established.** The client receives the server’s key share and calculates the session key. It decrypts and verifies the server’s certificates, and if everything is good, the handshake is complete.

Note that there are two different public-private key pairs on an ephemeral DH exchange: the first is the ephemeral pair, created every time client and server establish a connection, which guarantees forward secrecy. The second pair, embedded on the SSL certificate, is used for authentication and doesn’t change.

Given that a new key is generated for every session, this feature guarantees PFS. If the encryption keys are compromised at a later date, the leaked key will only be able to decrypt the specific session to which it corresponds; all the prior sessions are still safe. As a result, large-scale storage of data transmitted between server and client is rendered worthless.

## How Auth0 Can Help

The temptation to intercept, undermine, and circumvent encryption has never been stronger. Cybercriminals are working to find ways to get around the issues that strong encryption presents due to the volume of valuable information that is sent between computers today.

While this rarely results in direct assaults against cryptographic algorithms or protocols, it frequently prompts attackers to devise novel methods of intercepting or capturing information. With these threats ever present, it is more crucial than ever to focus on maintaining strong and up-to-date implementations of effective encryption protocols.

Some applications are still running TLS versions older than 1.2, and others are still running the original SSL protocol. If yours is one of them, you should consider upgrading it immediately. Auth0 [supports both TLS 1.2 and TLS 1.3](https://auth0.com/docs/customize/custom-domains/self-managed-certificates/tls-ssl) and can help you keep your applications secure.

The TLS Handshake Explained

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Auth0 at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community.

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [**Products That Count**](https://productsthatcount.com/) and [**Aiven.io**](http://Aiven.io).


President, Auth0

Shiven Ramji

New partnerships aim to bring secure customer identity to the platforms developers use every day in one click, or less

Almost a decade ago, _The New Kingmakers_ made reference to the rise of a developer class that would fundamentally reshape technology decision-making. Today, two-thirds of professional developers have a voice when their organizations are purchasing new technologies, according to [Stack Overflow](https://survey.stackoverflow.co/2022/#technology-most-loved-dreaded-and-wanted). Product-led growth is official “a thing,” and companies that make life easier for developers have been crowned with success again and again.

The acquisition of Auth0 accelerated Okta’s own journey with developers. Over 2.8 million unique developers look to [Auth0, now the Okta Customer Identity Cloud](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/) each month for expertise on how to implement customer identity, across in-person events, the Auth0 Ambassador program, and digital channels like docs, technical blogs, and JWT.io.

Today, at [Oktane22](https://www.okta.com/oktane22/), we announced the next giant leap in our journey toward making identity easier for developers: New partnerships with three of the leading developer platforms: DigitalOcean, Netlify, and Vercel. These are like-minded platforms that put developers at the heart of their missions. Together, we intend to bring expert advice and easy integrations to where developers already spend their time–with the ultimate vision of providing secure customer identity in one click or less within each platform environment.

“Creating compelling experiences is hard enough without having to be an identity expert, too. And the stakes are too high to get it wrong,” said Shiven Ramji, Chief Product Officer, Customer Identity at Okta. “Okta Customer Identity Cloud powered by Auth0 can be called by your app and hosted in your cloud of choice, but we don’t want to stop there. This is the first step in a multi-year journey to fully integrate secure identity capabilities where developers are building the future. We are honored to have DigitalOcean, Netlify, and Vercel join us on this quest.”

## Abstracting Away Complexity

Developers are facing all kinds of application complexity and maintenance work that takes them away from innovation. The Covid-19 pandemic only amplified the need to be hyper-focused on shipping differentiated, user-centric products. Security has become a cat-and-mouse game as attackers shift their tactics and new privacy laws are established. Developers need to balance all of these priorities while dealing with resourcing and talent pressures.

Customer identity stands at the intersection of these forces: security, privacy, and user experience. Getting it right enables everyone to safely access any technology and developers to integrate customer identities across the stack. But according to a [Gartner](https://www.gartner.com/en/documents/4009255)® report, “The cost of maintaining a homegrown CIAM toolset has grown, compared with commercial offerings. There is a growing preference for buying versus building, which is enabling the business to refocus development resources.”

## Empowering Developers for a Safer Internet

Together, we believe Okta, DigitalOcean, Netlify, and Vercel can streamline the education, implementation, and activation of customer identity for developers across the globe. Today, we’re starting with improving education and awareness around the complexity of identity, followed by improving discoverability for our integrations along the developer journey, with the ultimate vision of one-click integrations.

Democratizing access to enterprise-grade customer identity for developers will have a massive impact on the security of end-consumers and empower developers to focus on innovation. As part of Okta Customer Identity Cloud, we can put adaptive multi-factor authentication (MFA), bot detection, passkeys, and more in the hands of developers with the literal flip of a switch. Meeting developers where they are is a key part of our strategy, and we couldn’t be more excited to welcome DigitalOcean, Netlify, and Vercel to our network.

“We’re very excited to be working with Okta to better equip developers and small businesses to add customer identity into their Apps built on DigitalOcean,” said Tyler Healy, Vice President of Security at [DigitalOcean](https://www.digitalocean.com/). “When it comes to developers and digital entrepreneurs, simplicity is vital. This partnership will only further DigitalOcean’s ability to simplify innovation on our platform and enable builders to spend more time creating software that changes the world.”

“Developers are moving to a decoupled, composable web architecture because they want more flexibility to use any tool or framework to build faster, better-performing web experiences. At the same time, they need a great developer experience in a simple workflow. That’s where Netlify plays a key role as the platform connecting all developer’s tools, including Auth0 by Okta, and APIs in one place to build and run web apps. Working with Okta, we look forward to making identity and authentication as easy and simple as possible for millions of developers,” said Matt Biilmann, CEO and co-founder [Netlify](https://www.netlify.com/)

“As a leading cloud platform for frontend developers, Vercel provides innovators with the speed and reliability they need to create at the moment of inspiration. Security and identity are at the core of building delightful digital experiences,” said Malte Ubl, CTO at [Vercel](https://vercel.com/). “By joining forces with Okta, we’re not only simplifying the role that identity plays on the web but also making a commitment to enhancing the speed and breadth of developer-friendly cybersecurity in an increasingly digital world.” 

## Neutrality to Build Your App, Your Way

Developers want the freedom and power to choose the best solutions for their digital ecosystem. Okta’s commitment to neutrality means not being restricted to a specific technology stack and having the ability to control and customize identity now and in the future. We are designing easy-to-integrate solutions that free developers to use any technology, regardless of platform, device, or infrastructure. We are 100% focused on identity, so developers can focus on innovation.

## Availability and Signup

Developers can learn more about Okta’s new developer platform partnerships and get started with Okta Customer Identity Cloud [on our Developer Center](https://developer.auth0.com/resources/get-started/cloud?utm_source=blog&utm_medium=website&utm_campaign=partnerships). We will release more information about the DigitalOcean, Netlify, and Vercel integrations as they become available.

If you’re a developer platform interested in joining our quest to make identity easier for developers, [please reach out to our tech partnerships team](https://docs.google.com/forms/d/e/1FAIpQLSfGzaE5a6-OSy1D1N8PMeSE8pXCfsr4UkzDqUpW-vUGq2rYHg/viewform).

## About Okta

Okta is the World’s Identity Company. As the leading independent Identity partner, we free everyone to safely use any technology—anywhere, on any device or app. The most trusted brands trust Okta to enable secure access, authentication, and automation. With flexibility and neutrality at the core of our Okta Workforce Identity and Customer Identity Clouds, business leaders and developers can focus on innovation and accelerate digital transformation thanks to customizable solutions and more than 7,000 pre-built integrations. We’re building a world where Identity belongs to you. Learn more at [okta.com](http://okta.com/).

Okta Partners with DigitalOcean, Netlify, and Vercel to Simplify Identity for Developer

Let’s explore the new .NET 7 features for improving and simplifying authentication and authorization support in .NET applications.

The release of .NET 7 continues the simplification effort that began with .NET 5. Following this line, the new release provides .NET developers with a few features related to authentication and authorization that make .NET developers' lives a bit easier. Let's take a quick look at those features, which range from simplifications in authentication configuration to the addition of new authorization test tools, to improvements to Blazor's authentication support.

## Default Authentication Scheme

When you configure authentication for your application, you need to register the authentication service through `AddAuthentication()`. For example, the following is the code needed to configure `JwtBearer` as the authentication scheme in an ASP.NET Core Web API:

```csharp
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
     .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
     {
         options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
         options.TokenValidationParameters = 
           new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
             ValidAudience = builder.Configuration["Auth0:Audience"],
             ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
         };
     });
```

Although you are defining just one authentication scheme (`JwtBearerDefaults.AuthenticationScheme`), the  `AddAuthentication()` method requires that you specify the default scheme to use when it is not specified in your API endpoints (see [this document for more details on multiple authentication schemes in ASP.NET Core](https://learn.microsoft.com/en-us/aspnet/core/security/authorization/limitingidentitybyscheme?view=aspnetcore-6.0#use-multiple-authentication-schemes)).

Starting with .NET 7, the default scheme is no longer required when you define just one authentication scheme. It is automatically inferred by the framework. In practice, you can write the previous code as follows:

```csharp
builder.Services.AddAuthentication() //👈 no default scheme specified
     .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
     {
         options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
         options.TokenValidationParameters = 
           new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
             ValidAudience = builder.Configuration["Auth0:Audience"],
             ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
         };
     });
```

In case you need to restore the old behavior for any reason, you can disable the new feature using the following statement:

```csharp
AppContext.SetSwitch("Microsoft.AspNetCore.Authentication.SuppressAutoDefaultScheme", true);
```

## Simplified Configuration

One of the recurrent critiques of .NET authentication and authorization is its complexity (see [this thread](https://www.reddit.com/r/dotnet/comments/vttrib/is_auth_way_too_hard_in_net/) and [this one](https://social.msdn.microsoft.com/Forums/en-US/4d3844d5-9175-49ba-8c2f-8257f2c67639/authentication-and-authorization-is-too-complicated-too-abstract?forum=aspdotnetcore), for example). Actually, .NET provides developers with an articulate system for managing authentication and authorization. This system is great for the flexibility it offers, but it may be hard for a beginner to digest all the details. It may be hard even for a more experienced developer who is not used to dealing with the identity features every day.

To overcome this issue, the .NET team started an initiative aiming at simplifying the authentication and authorization configuration. The .NET 7 release introduces the first step in this direction, bringing you a simplified approach to configure ASP.NET Core Web APIs authorization based on access tokens in JWT format.

> Check out [this article to learn how to protect your ASP.NET Core Web API](https://auth0.com/blog/aspnet-web-api-authorization/).

If you ever had secured an ASP.NET Core Web API with Auth0, the following code should look familiar to you:

```csharp
using Microsoft.AspNetCore.Authentication.JwtBearer;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
     .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
     {
         options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
         options.TokenValidationParameters = 
           new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
             ValidAudience = builder.Configuration["Auth0:Audience"],
             ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
         };
     });

builder.Services.AddAuthorization();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();
```

Now, you can directly rely on the built-in configuration system to define your Web API's authorization options. In fact, in addition to default authentication schemes, .NET 7 automatically loads the options to configure the authentication service from the new  `Authentication` section of the `appsettings.json` configuration file. With this new feature, the code shown earlier becomes as follows:

```csharp
using Microsoft.AspNetCore.Authentication.JwtBearer;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication().AddJwtBearer(); //👈 new feature

builder.Services.AddAuthorization();

var app = builder.Build();
```

All the configuration settings are moved to the `appsetting.json` file as follows:

```json
{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  //👇 new section
  "Authentication": {
    "Schemes": {
      "Bearer": {
        "Authority": "https://YOUR_AUTH0_DOMAIN",
        "ValidAudiences": [ "YOUR_AUDIENCE" ],
        "ValidIssuer": "YOUR_AUTH0_DOMAIN"
      }
    }
  }
  //👆 new section
}
```

The new `Authentication` section keeps the configuration settings for any authentication scheme supported by your application, although currently only the `JwtBearer` scheme is supported.

Notice that now you don't need anymore to call `UseAuthentication()` and `UseAuthorization()`. The framework takes care of automatically adding the required middleware to the request pipeline.

## Authorization Policies for Specific Endpoints

ASP.NET Core allows you to specify policies to make more accurate authorization decisions based on the access token content or other advanced criteria. Usually, these policies are defined globally at the application level and attached to the endpoint definitions the policy applies to.

> Take a look at [this article to learn how to use policies to protect ASP.NET Core Web APIs](https://auth0.com/blog/permission-based-security-aspnet-webapi/), for example.

Defining policies globally is pretty good for reuse. However, sometimes you may need just a specific policy for one endpoint. In this case, you can specify your policy directly on the endpoint definition.

The following is an example of how you can use this new feature:

```csharp
app.MapGet("/api/special-endpoint", () => "A special endpoint!")
    .RequireAuthorization(p => p.RequireClaim("scope", "api:special"));
```

## The `user-jwts` Tool

Testing a token-protected Web API could be complex. You can easily use tools like curl or Postman, but you need to pass a valid access token along with your HTTP request. To get a valid access token, you usually need a working identity and access management system at your disposal, such as [Auth0](https://auth0.com/). You need to configure your API with this system and log in by providing valid credentials.

Auth0 allows you to test your registered API using a token issued directly in the [Auth0 dashboard](https://manage.auth0.com/), but you still need to register your application with Auth0.

.NET 7 brings a new CLI tool that helps simplify protected Web API testing: `user-jwts`. This tool is integrated with the .NET CLI and allows you to generate access tokens in JWT format. The tool is based on the same infrastructure as the [secret manager](https://auth0.com/blog/secret-management-in-dotnet-applications/) and enables your application to validate the generated access token. Basically, the following command allows you to generate a new access token:

```bash
dotnet user-jwts create
```

You can use this token with curl, Postman, or any other HTTP client to make your call to the protected endpoints of your Web API without the need to register your application with an actual identity and access management system.

Beyond the basic usage, the `user-jwts` tool allows you to customize your access token by specifying the scopes, custom claims, and other properties so that you can also test endpoints with access policies. See the [official documentation](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/jwt-authn) to learn more.

<include src="ebook-ads/dotnetIdentity" />

## Dynamic Authentication Requests in Blazor WASM

Blazor WebAssembly uses the `Microsoft.AspNetCore.Components.WebAssembly.Authentication` package to handle OpenID Connect authentication. This package allows you to statically define at the startup time how authentication will occur. However, there are scenarios where you may need to authenticate users at runtime with a different configuration. For example, you may need to perform [step-up authentication](https://auth0.com/docs/secure/multi-factor-authentication/step-up-authentication) or may want the user to change their account.

In .NET 7, Blazor WebAssembly supports the creation of dynamic authentication requests using the new `InteractiveRequestOptions` class and the `NavigateToLogin()` method of the `NavigationManager` object.

The following example shows the basic use of these new features:

```csharp
InteractiveRequestOptions requestOptions = new()
{
    Interaction = InteractionType.SignIn,
    ReturnUrl = NavigationManager.Uri,
};
NavigationManager.NavigateToLogin("authentication/login", requestOptions);
```

The `InteractiveRequestOptions` class also provides a way to add custom parameters to the authentication request. For example, consider [Auth0's `screen_hint` parameter](https://auth0.com/docs/authenticate/login/auth0-universal-login/new-experience#signup) that allows you to show the signup form instead of the default login form. You can send this parameter to Auth0 as shown below:

```csharp
InteractiveRequestOptions requestOptions = new()
{
    Interaction = InteractionType.SignIn,
    ReturnUrl = NavigationManager.Uri,
};
requestOptions.TryAddAdditionalParameter("screen_hint", "signup");
NavigationManager.NavigateToLogin("authentication/login", requestOptions);
```

## Blazor WASM Authentication Diagnostics

Detecting authentication issues is not easy, especially if you are running a WebAssembly code, as it happens with Blazor WebAssembly applications. The .NET 7 release tries to improve its support for authentication diagnostics by introducing the debug level for the `Microsoft.AspNetCore.Components.WebAssembly.Authentication` library. After [enabling logging for Blazor WebAssembly](https://learn.microsoft.com/en-us/aspnet/core/blazor/fundamentals/configuration?view=aspnetcore-7.0#logging-configuration), you can add the following setting in the `wwwroot/appsettings.json` configuration file to get detailed information about the authentication process:

```json
"Logging": {
    "LogLevel": {
        "Microsoft.AspNetCore.Components.WebAssembly.Authentication": "Debug"
    }
}
```

<include src="SignupCTA" text="Try out Auth0 authentication for free." linkText="Get started →" />

## Conclusion

Probably the new features introduced by .NET 7 to mitigate the complexity of authentication and authorization support will not drastically change your life as a developer. However, they confirm the effort Microsoft is making to simplify the use of its development platform. In the area of authentication and authorization, the commitment to reduce configuration complexity with an [initiative](https://github.com/dotnet/aspnetcore/issues/34545) that will continue in subsequent .NET releases looks pretty promising.

I hope that the combination of these and future simplifications will go in the right direction of making authentication and authorization integration into .NET applications less and less challenging.


What's New in .NET 7 for Authentication and Authorization

Learn how to call a protected API from your .NET MAUI application.

Call a Protected API from a .NET MAUI App

pablo-cibraro

Pablo is an internationally recognized expert and entrepreneur with more than 22 years of experience in designing and implementing large distributed systems with Microsoft technologies and a Connected System MVP. <br>
For the last few years, Pablo has helped numerous Microsoft teams develop tools and frameworks for building service-oriented and web applications with .NET. <br>
Pablo now focuses on technologies that enable developers to build large-scale systems and web applications on the cloud, such as HTML5, Node.js, ASP.NET, Windows Azure and Amazon AWS.

Agilesight Cofounder

Pablo Cibraro

Learn about the new ASP.NET minimal Web APIs introduced in .NET 6.0 and how to secure them with Auth0.

Securing ASP.NET Minimal Web APIs with Auth0

A map to choose the right SDK to integrate Auth0 in your .NET application.

The .NET ecosystem has become quite complex. On the one hand, developers can create different types of applications for different platforms. On the other hand, in its 20-year history, .NET has generated different versions of the development platform, some incompatible with each other or compatible under specific criteria.

Auth0 provides developers with a few SDKs for different application types and different versions of the platform. Which one is right for your application? Let's find out together!

> If you want to find out directly what is the SDK or package to use in your .NET application to integrate with Auth0 without sitting through the rationale behind it, jump to the section [The Matrix of Solutions](#The-Matrix-of-Solutions).

## The Dimensions of the Problem

Let's start by exploring the dimensions of the problem, that is, the factors that influence the choice: the application type, the .NET target, and the role of Auth0.

### The application type

As the first dimension, you need to consider your **application type**. As a .NET developer, you know that the development platform allows you to create applications of several types: from Web to desktop apps, from Web APIs to mobile apps. You can also use different frameworks to build your app. For example, you leverage ASP.NET or ASP.NET Core to build a Web application, but you can use ASP.NET Core MVC or Razor Pages or Blazor as the frameworks that support your UI and application architecture. Something similar happens for desktop app UIs: you can use WinForms, Windows Presentation Foundation (WPF), Universal Windows Platform (UWP), Multiplatform Applcation UI (MAUI), etc.

Identifying your application type and the technology you use or you are going to use is the first step to determining which SDK you must use.

### The .NET target

The second dimension is the .NET version your application runs on, which in the .NET lingo is called **your application's target**. The .NET platform has evolved over the past two decades and has undergone several transformations. From the initial multi-language framework for Windows programming, it has now become a cross-platform development environment that enables the creation of Web, desktop, and mobile applications. You can take into account the following targets:

- *.NET Framework*. This was the initial Windows framework, which will be deprecated, but on which many applications still run.
- *.NET Core*. The initial cross-platform version of .NET, which is not fully compatible with the .NET Framework. The last .NET Core version was 3.1.
- *.NET Standard*. Actually, this is not a true .NET version. It is a specification that aims at defining a common set of APIs between .NET Framework and .NET Core to ensure a degree of compatibility between the two versions. Auth0 SDKs follow .NET Standard 2.0 specifications to keep this compatibility.
- *.NET*. This is the current and universal version of the development platform that aims to replace all the previous ones. From the Auth0 point of view, it can be seen as the evolution of .NET Core.

To learn more about [the differences between the .NET targets, check out this article](https://auth0.com/blog/navigating-dotnet-maze).

### The role of Auth0

The third dimension is **the purpose of using the Auth0 platform** in your application. Your application can use Auth0 for three main reasons:

- To add *authentication* so that your users can log in using the [Auth0 Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login) page, Single Sign-On (SSO), Passwordless, Social Login, and the [other approaches available with Auth0](https://auth0.com/docs/authenticate).
- To *control access* so that only authorized users can use your application's functionality.
- To *manage users and other features* provided by your [Auth0 tenant](https://auth0.com/docs/get-started/auth0-overview/create-tenants).

Clarifying the purpose of Auth0 in your application is also important to determine which SDK you must use.

## The Auth0 SDKs and Packages

After analyzing the dimensions of the problem, let's see what Auth0 offers to meet the needs of .NET developers. You can use a few SDKs to integrate Auth0's authentication, authorization, and management features into your .NET applications. Each SDK includes one or more packages that you can install from [NuGet](https://www.nuget.org/profiles/auth0).

Let's take a look at these SDKs and their packages.

### Auth0 ASP.NET Core Authentication SDK

The [Auth0 SDK for ASP.NET Core Authentication](https://github.com/auth0/auth0-aspnetcore-authentication) is designed for adding authentication support to your Web application built with server-side frameworks: ASP.NET Core MVC, Blazor Server, and Razor Pages. It provides you with one package &mdash; [**Auth0.AspNetCore.Authentication**](https://www.nuget.org/packages/Auth0.AspNetCore.Authentication), which hides most of the complexity of the authentication and authorization process.

Check out [this article for a quick introduction to the Auth0 ASP.NET Core Authentication SDK's main features](https://auth0.com/blog/exploring-auth0-aspnet-core-authentication-sdk/).

### Auth0 OIDC Client for .NET

The [Auth0 OIDC Client for .NET](https://github.com/auth0/auth0-oidc-client-net) supports [OpenID Connect](https://auth0.com/docs/authenticate/protocols/openid-connect-protocol)-based authentication in your .NET desktop application as well as in your mobile application based on Xamarin and MAUI. The SDK provides multiple packages depending on the framework used for your application's UI:

- [**Auth0.OidcClient.UWP**](https://www.nuget.org/packages/Auth0.OidcClient.UWP). This package supports Universal Windows Platform (UWP). Check out [this document to learn how to use it](https://auth0.com/docs/quickstart/native/windows-uwp-csharp).
- [**Auth0.OidcClient.WPF**](https://www.nuget.org/packages/Auth0.OidcClient.WPF). This package supports authentication for desktop apps using Windows Presentation Foundation (WPF). Take a look at [this document to learn how to use this package](https://auth0.com/docs/quickstart/native/wpf-winforms).
- [**Auth0.OidcClient.WinForms**](https://www.nuget.org/packages/Auth0.OidcClient.WinForms). With this package, you can add authentication to your WinForms-based desktop application. [This document](https://auth0.com/docs/quickstart/native/wpf-winforms) will guide you on how to use it.
- [**Auth0.OidcClient.Android**](https://www.nuget.org/packages/Auth0.OidcClient.Android). This package adds authentication to Xamarin-based mobile apps for Android. Read [this document](https://auth0.com/docs/quickstart/native/xamarin) to learn how to start.
- [**Auth0.OidcClient.iOS**](https://www.nuget.org/packages/Auth0.OidcClient.iOS). This package adds authentication to Xamarin-based mobile apps for iOS. Check out [this document](https://auth0.com/docs/quickstart/native/xamarin) to learn how to use it.
- [**Auth0.OidcClient.MAUI**](https://www.nuget.org/packages/Auth0.OidcClient.MAUI). With this package, you can add authentication to your MAUI applications. Get started with [this document](https://auth0.com/docs/quickstart/native/maui).

### Auth0 .NET SDK

The [Auth0 .NET SDK](https://github.com/auth0/auth0.net) enables your .NET Framework and .NET Standard application to authenticate users and manage your Auth0 tenant. It implements two packages:

- [**Auth0.AuthenticationApi**](https://www.nuget.org/packages/Auth0.AuthenticationApi). This package is a wrapper around the [Auth0 Authentication API](https://auth0.com/docs/api/authentication), which allows you to add login, logout, signup, and other functionality to your application. This is not a high-level authentication library, since you need to handle the steps of the [authentication and authorization process](https://auth0.com/docs/get-started/authentication-and-authorization-flow). It assists you in building authorization URLs through a few [URL Builders](https://auth0.github.io/auth0.net/#using-url-builders), but it's up to you to [run validation](https://github.com/auth0/auth0.net#authentication).
  Check out [this document for an introduction to how to use the *Auth0.AuthenticationApi* package](https://auth0.github.io/auth0.net/#using-the-authentication-api).
- [**Auth0.ManagementApi**](https://www.nuget.org/packages/Auth0.ManagementApi). This package allows you to interact with your Auth0 tenant programmatically. It is a wrapper around the [Auth0 Management API](https://auth0.com/docs/api/management/v2) and basically allows you to do with your .NET application what you can do with your [Auth0 dashboard](https://manage.auth0.com/): you can manage users and roles, create and get application settings, manage your Auth0 Actions, control your branding, and so on.
  Check out [this document for a quick introduction to how to use the *Auth0.ManagementApi* package](https://auth0.github.io/auth0.net/#using-the-management-api).

<include src="ebook-ads/dotnetIdentity" />

## The Matrix of Solutions

Now that you've reviewed the dimensions of the problem and the available Auth0 packages let's create a map that allows you to find on the fly which package to use for a given application type.
In the following, you will see three sections, one for each Auth0 role in your application. Within each section, you will find a matrix that matches the application type with the .NET target and proposes the appropriate package.
Note that a specific SDK may not be available for some combinations because native .NET support is sufficient or because there are viable third-party alternatives.

### Authentication

If your application uses Auth0 to add authentication support, check out this matrix to choose the right package:

<style>
  table {
    width: 100%;
    border-collapse: collapse;
    font-size: 15px;
  }
  table, td, th {
    border: 1px solid;
  }
  table th {
    background-color:#eeeee4;
  }
  table tr td:first-child {
    background-color:#eeeee4;
  }
  table a:link {
    inline-size: 250px;
    /* overflow-wrap: break-word; */
    word-break: break-all;
    font-size: 15px;
  }
  td {
    padding: 5px;
  }
</style>

| | .NET Framework | .NET (Core)|
| ------------------ | ------------------------------------------------------------ | ------------------------------------------------------------ |
| **ASP.NET MVC** | [Microsoft.Owin.Security.OpenIdConnect](https://www.nuget.org/packages/Microsoft.Owin.Security.OpenIdConnect) | |
| **ASP.NET Core MVC** | | [Auth0.AspNetCore.Authentication](https://www.nuget.org/packages/Auth0.AspNetCore.Authentication) |
| **Razor Pages** | | [Auth0.AspNetCore.Authentication](https://www.nuget.org/packages/Auth0.AspNetCore.Authentication) |
| **Blazor Server**<br/>**Blazor WebApps** | | [Auth0.AspNetCore.Authentication](https://www.nuget.org/packages/Auth0.AspNetCore.Authentication) |
| **Blazor WebAssembly** | | [Microsoft.AspNetCore.Components.WebAssembly.Authentication](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Authentication/) |
| **Xamarin** | [Auth0.OidcClient.Android](https://www.nuget.org/packages/Auth0.OidcClient.Android)<br />[Auth0.OidcClient.iOS](https://www.nuget.org/packages/Auth0.OidcClient.iOS) | [Auth0.OidcClient.Android](https://www.nuget.org/packages/Auth0.OidcClient.Android)<br />[Auth0.OidcClient.iOS](https://www.nuget.org/packages/Auth0.OidcClient.iOS) |
| **WPF** | [Auth0.OidcClient.WPF](https://www.nuget.org/packages/Auth0.OidcClient.WPF) | |
| **WinForms** | [Auth0.OidcClient.WinForms](https://www.nuget.org/packages/Auth0.OidcClient.WinForms) | |
| **UWP** | [Auth0.OidcClient.UWP](https://www.nuget.org/packages/Auth0.OidcClient.UWP) | |
| **MAUI** | | [Auth0.OidcClient.MAUI](https://www.nuget.org/packages/Auth0.OidcClient.MAUI) |
| **Console** | [Auth0.AuthenticationApi](https://www.nuget.org/packages/Auth0.AuthenticationApi) | [Auth0.AuthenticationApi](https://www.nuget.org/packages/Auth0.AuthenticationApi) |

<br/>

Notice that for ASP.NET MVC, we suggest using [Microsoft's standard OWIN library](https://learn.microsoft.com/en-us/aspnet/aspnet/overview/owin-and-katana/). Similarly, you can use [Microsoft's standard library for Bazor WebAssembly applications](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Authentication/).

### Access control

If your application uses Auth0 to check access control to server resources, that is, you are implementing a Web API, check out this matrix to choose the right package:

| | .NET Framework | .NET (Core) |
| -------------------- | ------------------------------------------------------------ | ------------------------------------------------------------ |
| **ASP.NET Web API** | [Microsoft.Owin.Security.Jwt](https://www.nuget.org/packages/Microsoft.Owin.Security.Jwt) | |
| **ASP.NET Core Web API** | | [Microsoft.AspNetCore.Authentication.JwtBearer](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.JwtBearer) |

<br/>

As you can see, you can use Microsoft's standard libraries to check JWT tokens in Web APIs.

### Auth0 tenant management

If your application needs to manage users and other Auth0 tenant features, refer to this table:

| | .NET Framework | .NET (Core) |
| ------------ | ------------------------------------------------------------ | ------------------------------------------------------------ |
| **Any app type** | [Auth0.ManagementApi](https://www.nuget.org/packages/Auth0.ManagementApi) | [Auth0.ManagementApi](https://www.nuget.org/packages/Auth0.ManagementApi) |

<br/>

The Auth0 Management API can be used for any application type targeting any .NET version.

<include src="SignupCTA" text="Try out Auth0 authentication for free." linkText="Get started →" />

## Summary

Throughout this article, you learned the criteria you must follow to determine the appropriate SDK and package for your .NET application. The current platform complexity is reflected in the complexity of choosing the right package, of course. With the [.NET platform unification](https://auth0.com/blog/dotnet-5-whats-new/), general simplification is expected in the near future, but we cannot forget the legacy code that is still up and running.

So, for your next .NET project, go and pick the right Auth0 SDK!


Choosing the Right .NET SDK for Auth0

What's new in .NET 6? What are the main relevant features brought by the new version of the .NET platform? Let's take a quick look.

With the release of .NET 6, Microsoft consolidates its plan to create a unified platform to develop applications for any device and operating system. Together with this vision, .NET 6 brings many new features aiming to simplify development and gain performance. Let's take a quick look at the main points.

## Unified Platform Support
The vision of a [unified platform for the .NET world started with .NET 5](https://auth0.com/blog/dotnet-5-whats-new/). That release was meant to be the unified successor of [the various .NET flavors: .NET Framework, .NET Standard, .NET Core, Mono](https://auth0.com/blog/navigating-dotnet-maze/), etc. Beyond this goal, .NET 5 wanted to be a development platform to create any kind of application for any platform. However, at that time, an important piece was missing to complete the puzzle: a unified framework to create cross-platform UIs. Now, with [.NET MAUI](https://devblogs.microsoft.com/dotnet/announcing-net-maui-preview-10/), i.e., the **.NET Multi-platform App UI** framework, the puzzle is complete. Although at the time of writing [.NET MAUI is in preview](https://devblogs.microsoft.com/dotnet/announcing-net-maui-preview-10/), it is mature enough to be considered part of the .NET 6 release.

Now with .NET 6, you can really create the application you want and run it practically everywhere: from desktop to mobile, from the web to the cloud.

![.NET 6 unified platform](https://images.ctfassets.net/23aumh6u8s0i/GOa5gfL6LckpRRhqaBRJe/69341464075cbd46cf88fcbe36af4aa5/dotnet-unified-platform.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6/)]
</p>

In particular, the new [.NET MAUI](https://github.com/dotnet/maui) framework allows you to build desktop and mobile native user interfaces with a single codebase.

![.NET MAUI overview](https://images.ctfassets.net/23aumh6u8s0i/4WkvXpMRwu7j5T82HiW04A/069649d85ea4e1def0831672b5fc8698/dotnet-maui-overview.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/introducing-net-multi-platform-app-ui/)]
</p>

## Simplified Development
One of the main goals of the .NET 6 release is to provide developers with features that simplify their work. You can find support for simplified development throughout the platform, but three contexts are really exciting: new C# features, Hot Reload support, and minimal web APIs.

### C# 10 features
.NET 6 brings you [C# 10 with plenty of new features](https://devblogs.microsoft.com/dotnet/welcome-to-csharp-10/) that help you write code more easily. Let's take a quick look at a few of them.

#### Global and implicit usings

As a C# developer, you know how annoying it is to declare the same namespace in every file of your project. Consider, for example, the `System` namespace. Its use is very common, and I'm pretty sure you forget it all the time and let Visual Studio suggest it.

Now you can declare namespaces using a global `using`, as shown in the following example:

```csharp
global using System;
```

With this declaration, you don't need to insert the `using System;` declaration in all files anymore. You can declare a namespace through `global using` in any file, and it will be available in the entire project.

If you prefer (and I think it's a good practice), you can declare your namespaces in a file named `GlobalUsings.cs`.

You can also take advantage of implicit `using`s by configuring the `<ImplicitUsings>` element in your `.csproj` file, as shown below:

```xml
<PropertyGroup>
    
    <ImplicitUsings>enable</ImplicitUsings>
</PropertyGroup>
```

This way, the compiler will automatically add the required `global using` directives based on the type of your project.

#### New namespace syntax

You know that the usual way to declare a namespace is as follows:

```csharp
namespace Geometry
{
  class Triangle 
  {
    // ...class members...
  }
}
```

Now you can use the file-scoped namespace syntax to get the same result:

```csharp
namespace Geometry

class Triangle 
{
  // ...class members...
}
```

With this approach, everything you define in the current file belongs to the declared namespace. By removing a nesting level, you make the code a bit cleaner. However, you can't create nested namespaces with this new syntax.

#### Natural types for lambda expressions

Consider the following assignment of a lambda expression to a variable:

```csharp
Func<string, int> parse = (string s) => int.Parse(s);
```

You need to declare the target type of the lambda expression, `Func<string, int>` in the example. Starting with C# 10, you can write the above code as follows:

```csharp
var parse = (string s) => int.Parse(s);
```

The compiler will try to infer the "natural" type of the lambda expression.

### Hot Reload
To improve the developer's productivity, .NET 6 extends [the Hot Reload feature](https://devblogs.microsoft.com/dotnet/announcing-net-6/#hot-reload) to Visual Studio and almost any type of project. It allows you to run an application in your development environment, make changes, and get the changes applied without stopping, rebuilding, and rerunning the application.

In previous .NET releases, this feature was available just for the .NET CLI via the `dotnet watch` command. Not without [some minor hiccups with the community](https://www.theverge.com/2021/10/22/22740701/microsoft-dotnet-hot-reload-removal-decision-open-source), you can now benefit from it in [Visual Studio 2022](https://devblogs.microsoft.com/dotnet/update-on-net-hot-reload-progress-and-visual-studio-2022-highlights/#improved-user-experience-in-visual-studio-2022) as well by simply clicking a button:

![Visual Studio 2022 Hot Reload button](https://images.ctfassets.net/23aumh6u8s0i/3wu09sA8C4IQ5uKfmGoITK/e13d618f3f497e72281665de780b472d/vs2022-hot-reload-button.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/update-on-net-hot-reload-progress-and-visual-studio-2022-highlights/)]
</p>

### Minimal web APIs
One astonishing feature introduced by .NET 6 to simplify your code is [minimal web APIs](https://docs.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis). Along the lines of top-level statements, now you can build a fully working web API application with a few lines of code. Consider the following sample:

```csharp
//Program.cs
var app = WebApplication.CreateBuilder(args).Build();

app.MapGet("/", () => "Hello World!");
app.Run();
```

This is all the code you need to run a simple *Hello World!* web API.

If you have some experience building web APIs with ASP.NET Core, you know that you usually need a more articulate project. You need at least a `Program.cs` file with the setup code for the application, a `Startup.cs` file where you configure your API, and a controller class defining the API routes and implementing the endpoints.

That's a lot of simplification!

## Performance Improvements
In the last years, the .NET team put a lot of effort into improving the platform performance in compiling and execution time and reducing memory consumption. With .NET 6, you can appreciate these improvements in many parts of the framework. For example, the effort to [improve inner-loop performance](https://github.com/dotnet/core/issues/5510) in building .NET projects has given awesome results, as you can see from the following diagram:

![dotnet6-build-improvements](https://images.ctfassets.net/23aumh6u8s0i/2ZVS4o4DKc6OroBO0Lb76b/187a5cbf18d934d9a1cefae71f1535f5/dotnet6-build-improvements.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6-preview-2/)]
</p>

Other performance improvements include the IO subsystem. For example, the `FileStream` class [was almost completely rewritten](https://devblogs.microsoft.com/dotnet/file-io-improvements-in-dotnet-6/) with amazing results even with respect to .NET 5, as the following table summarizes for the writing operation:

![FileStream performance improvement](https://images.ctfassets.net/23aumh6u8s0i/6RgFjbKytdIQk6pHtEaHxT/1d524bb8a02e4688979d71f3151aef3f/filestream-performance-improvement.png)

<p align="center">
[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6/)]
</p>
You can check out [a detailed report on performance improvements in .NET 6](https://devblogs.microsoft.com/dotnet/performance-improvements-in-net-6/) with related benchmarks for more information.

## Summary

This quick overview of .NET 6 shows that this is a consolidation release of the .NET platform. It aims to complete the unified platform vision started with .NET 5, improves the internals of the platform to provide the best performance, and starts a process of development simplification that probably will go further in future releases.

<include src="asides/DotNetCore" />

.NET 6 Highlights

Learn how to use .NET Core to implement a reverse proxy to overcome specific needs.

Building a Reverse Proxy in .NET Core

Learn about the new features introduced by the .NET Core 3.0 release.

Exploring .NET Core 3.0. What's New?

Learn what Dependency Injection and IoC are and what .NET Core provides you to support them.

Understanding Dependency Injection in .NET Core

How to create your .NET project template to use with .NET CLI and Visual Studio.

How to Create Your .NET Project Template

An overall view of .NET, Microsoft's cross-platform development environment that allows you to build any type of application with C# and other languages.



Microsoft's ambition to provide developers with one platform to solve any type of problem has been fulfilled by .NET. For a couple of decades already, the .NET platform has been powering up web, desktop, and mobile applications in both the startup and enterprise scenes.

Without any doubt, .NET plays a central role in the software development industry. .NET popularity in the developer community is a fact. You can measure it through the number of open source projects around the world and the presence of [C# among the five most popular programming languages](https://www.tiobe.com/tiobe-index/). Its popularity is going to grow even more, especially after [the latest release (.NET 5)](https://auth0.com/blog/dotnet-5-whats-new/), which revolutionizes the industry by pioneering the concept of universal software development.

To understand the power of .NET, let's explore some of its technical foundations.

## What is .NET?

.NET is an open-source and cross-platform development platform for building many types of applications. Designed by Microsoft, the platform supports multiple programming languages and libraries to build web, mobile, desktop, IoT applications, and more.

![.NET 5 platform](https://images.ctfassets.net/23aumh6u8s0i/2bsVrNvzMOk64yfFw0ZU3O/b88d3412d42844d54011f31d69d5860f/dotnet5_platform)

<p align="center"><i><a href="https://devblogs.microsoft.com/dotnet/introducing-net-5/">[Source: Microsoft]</a></i></p>

Even if C# is considered the main programming language for .NET, you can use many other different languages of your choice. The languages directly supported by Microsoft are:

- [C# (C sharp)](https://docs.microsoft.com/en-us/dotnet/csharp/): A modern object-oriented programming language that belongs to the C language family. Its syntax may look familiar to C, C++, Java, and JavaScript developers.

- [F# (F sharp)](https://dotnet.microsoft.com/languages/fsharp): A functional-oriented programming language, member of the [ML](https://en.wikipedia.org/wiki/ML_(programming_language%29) language family. It also supports the object-oriented programming paradigm.

- [Visual Basic](https://docs.microsoft.com/en-us/dotnet/visual-basic/): The historical Microsoft programming language. It has become a full object-oriented programming language within the context of .NET.

.NET supports the [*Common Language Infrastructure*](https://en.wikipedia.org/wiki/Common_Language_Infrastructure) (CLI), so your source code is compiled into a [*Common Intermediate Language*](https://en.wikipedia.org/wiki/Common_Intermediate_Language) (CIL), independently of the programming language you use. This guarantees great interoperability between languages in the platform.

Besides the above mentioned languages supported directly by Microsoft, many other programming languages can compile to the .NET CIL. For example, ClojureCLR, Eiffel, IronPython, PowerBuilder, and many others. For a complete list, check out [this page](https://en.wikipedia.org/wiki/List_of_CLI_languages).

## .NET Architecture and Components

.NET allows you to build different application types, ranging from command-line to desktop applications, from web to mobile applications, from gaming to IoT applications.

This is possible thanks to its modular and optimized architecture.

### .NET Components

The .NET architecture is based on two main components:

- *CoreCLR*: This is the .NET runtime. It is responsible for executing CLI programs and includes a just-in-time compiler.

- *CoreFX*: The platform’s API implementing the CLI Standard Libraries, that is, the set of libraries that provide the most common functionalities, such as file system management, exception handling, network communication, threading, reflection, and so on. The CoreFX component is sometimes called the *Unified Base Class Library*.

### .NET Application Models

Above the core components, you have the different **application model frameworks**, that is, the libraries that offer support for developing different types of applications. So, for example, you have:

- [ASP.NET](https://dotnet.microsoft.com/apps/aspnet): The framework that allows you to build [web applications](https://auth0.com/docs/quickstart/webapp/aspnet-core-3) and [web APIs](https://auth0.com/blog/how-to-build-and-secure-web-apis-with-aspnet-core-3/).

- [Windows Presentation Foundation (WPF)](https://docs.microsoft.com/en-us/dotnet/desktop/wpf/?view=netdesktop-5.0): A graphical user interface for [Windows desktop applications](https://auth0.com/docs/quickstart/native/wpf-winforms).

- [Xamarin](https://auth0.com/blog/easy-authentication-xamarin-auth0/): The framework for building cross-platform mobile, TV, and desktop applications.

- [Blazor](https://auth0.com/blog/what-is-blazor-tutorial-on-building-webapp-with-authentication/): The framework to build client web applications by using C#. It also allows you to generate [client web apps in WebAssembly code](https://auth0.com/blog/securing-blazor-webassembly-apps/).

- [ML.NET](https://dotnet.microsoft.com/apps/machinelearning-ai): The machine learning framework that simplifies the integration of machine learning models in your .NET application.

In addition to application model frameworks, .NET offers you support for most of the common programming tasks: from file management to network communication, from security to database access. For example, on the networking side, it supports socket programming, HTTP communication, and [gRPC](https://auth0.com/blog/securing-grpc-microservices-dotnet-core/). This allows you to [create microservices](https://auth0.com/blog/implementing-microservices-grpc-dotnet-core-3/) with the protocol that better fits your needs.

For any other needs not embedded in the framework, you can find a huge number of specific libraries on the public [NuGet repository](https://www.nuget.org/). In fact, [NuGet](https://docs.microsoft.com/en-us/nuget/) is the package manager for .NET. It allows you to create, share, and use many .NET libraries for almost any purpose.

## .NET Design and Development Support

.NET support for software development is not limited to the multiple programming languages you can use. .NET also promotes the use of some best practices while letting you use the approach you prefer to build your application.

For example, it encourages you to [use dependency injection to decouple your application’s components](https://auth0.com/blog/dependency-injection-in-dotnet-core/). Dependency injection helps you design better software by limiting the component interdependence and facilitating reuse. In addition, it makes it easier to test your components.

By the way, on the testing side, .NET also comes with support for [unit and integration tests via xUnit](https://auth0.com/blog/xunit-to-test-csharp-code/).

On the front of the development experience, developers can choose from different approaches. They can use the [.NET CLI ](https://docs.microsoft.com/en-us/dotnet/core/tools/)environment, using the command line to create new projects, adding dependencies, build, run, and so on.

They can use [Visual Studio Code](https://code.visualstudio.com/) for an intermediate approach: an advanced cross-platform editor on top of the .NET CLI. Or they can use a powerful IDE like [Visual Studio](https://visualstudio.microsoft.com/vs/), available for both Windows and Mac, that provides you an interactive programming experience.

Regardless of the tool you choose, you can use many project templates to quickly start creating your new application. You can also [create your own .NET project template](https://auth0.com/blog/create-dotnet-project-template/).

## From the .NET Framework to the .NET Platform

Microsoft launched the .NET project in 2002. Since the beginning, the .NET goal was to create a universal platform for programming with any language. Of course, as the first step, Windows was the main .NET target.

However, Microsoft submitted the specifications of the .NET runtime infrastructure and the C# programming language to [ECMA](https://www.ecma-international.org/) for standardization. This led to the birth of a few porting projects on other platforms: Linux, embedded systems, mobile devices, browsers, and so on.

This also led to a fragmentation of the platform and sometimes generated confusion among developers. Take a look at [this article to learn more about the evolution of .NET](https://auth0.com/blog/navigating-dotnet-maze/).

Let’s try to clarify the differences among a few common concepts.

### .NET Framework

The .NET Framework was the initial flavor of .NET. It provides the developer with a set of APIs for the most common programming needs and interacts with the underlying operating system. It runs only on Windows, and its lifecycle is coming to an the end right now, after [the release of .NET 5](https://auth0.com/blog/dotnet-5-whats-new/).

### Mono

The Mono project brings .NET to Linux machines. It is the best known porting project based on the .NET standard specifications. Even if Mono's aim is to run on Linux applications built for the .NET Framework and vice versa, the compatibility is not always guaranteed. There are a couple of reasons for this: some .NET Framework features are too tied to the Windows operating system, and often the Mono implementation lags behind the newest .NET Framework features.

### .NET Core

.NET Core is a complete rewriting of the .NET Framework with the cross-platform goal in mind. Its redesigned architecture defines a minimal feature set as the common core across Windows, Linux, and Mac platforms. The rest of the features can be downloaded as library packages.

### .NET Standard

The .NET Standard is not another .NET implementation. It is a formal specification of .NET APIs that helps to create cross-platform libraries. If a platform supports a given .NET Standard version, then a library supporting the same version will run on it, regardless of the device type and the framework implementation (.NET Framework, Mono, .NET Core).

### .NET

Since the beginning, the .NET term has been used to indicate the universal development platform. However, many implementations arose since then, so the .NET name created ambiguities. .NET 5 aims to make concrete the initial vision of a universal development platform. It replaces the current existing implementations: .NET Framework, .NET Core, and even Mono. So, from .NET 5 on, only .NET will exist as a name and as a platform.

## Auth0 and .NET

Auth0 has extensive support for .NET that allows you to easily integrate modern authentication and authorization into your .NET applications: from specific SDKs to documentation, from blog posts to sample projects. In this section, you find a list of the .NET resources that Auth0 provides you.

### .NET QuickStarts

Auth0 Quickstarts help you in setting up your first [authentication](https://auth0.com/docs/authentication) and [authorization](https://auth0.com/docs/authorization) integration. They guide you in adding the needed code and the required configuration step by step. If you are logged in, the code snippets are configured for your account. If you don't have an account, you <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">can sign up for free with Auth0</a>.

The following .NET-related Quickstarts are available:

- [**ASP.NET Core Web API v3.1**](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi): This Quickstart helps you to add authorization to an ASP.NET Core Web API using the standard [JWT](https://jwt.io/) middleware.
- [**ASP.NET Core v3.1 Web Application**](https://auth0.com/docs/quickstart/webapp/aspnet-core-3): This Quickstart demonstrates how to add user login to an ASP.NET Core Web Application.
- [**WPF/Windows Forms (WinForms**)](https://auth0.com/docs/quickstart/native/wpf-winforms): The Quickstart guides you in adding user login Windows desktop C# applications.
- [**Xamarin**](https://auth0.com/docs/quickstart/native/xamarin): This Quickstart helps you add user login to Xamarin applications.
- [**Windows Universal App**](https://auth0.com/docs/quickstart/native/windows-uwp-csharp): Reading this Quickstart, you will learn how to add user login to [Windows Universal](https://docs.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide) C# applications.

### Software Development Kits (SDKs)

Auth0 provides you the following SDKs to help you to integrate authentication and authorization in your .NET applications:

- [**.NET Client Library for Auth0**](https://github.com/auth0/auth0.net): This SDK supports two APIs:
  - *The Authentication API*: This API allows you to add [OIDC](https://auth0.com/docs/protocols/openid-connect-protocol)-based authentication to your application
  - *The Management API*: This API allows you to interact with the [Auth0 Management API](https://auth0.com/docs/api/management/v2) and deal with your [Auth0 tenant](https://auth0.com/docs/videos/get-started-series/architect-your-tenant).
- [**Auth0 OIDC Client for .NET** ](https://github.com/auth0/auth0-oidc-client-net): This library supports [OIDC authentication](https://auth0.com/docs/protocols/openid-connect-protocol) for .NET desktop applications based on WinForms, WPF, and UWP as well as Xamarin mobile applications.

### .NET blog posts

In addition to SDKs and Quickstarts, Auth0 provides you with specific content, use cases, and code examples through its [developer blog](https://auth0.com/blog/developers/). You can find [many .NET-related articles](https://auth0.com/blog/search/?query=.net) that help you build and secure your applications and keep up to date with the most recent features. Most articles include a sample project to demonstrate how to practically implement your apps. You can download them from GitHub, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up with Auth0</a> if needed, configure the app, run it, and explore the code.

So, enjoy building your next .NET project with Auth0!



What is .NET? An Overview of the Platform

A guide for understanding the differences between .NET, .NET Core, .NET Framework, .NET Standard, etc. by exploring the history of the platform.


If you are confused in front of the different facets of .NET, or if you are not clear on the differences between .NET, .NET Core, .NET Framework, .NET Standard, and similar, well, this article is for you.

## What .NET Means Today

Say you are a new developer that wants to approach .NET. Caught up in the excitement, you navigate to [Microsoft's website](https://dotnet.microsoft.com/) and find the following definition:

![.NET: Free. Cross-platform. Open source. A developer platform for building all your apps (web, mobile, desktop, game, IoT).](https://images.ctfassets.net/23aumh6u8s0i/2yLTpLYPjn9DUjXgqHkN0f/03d54d78d435bc55ea6885a912cc9945/dotnet-platform.gif)

Cool! This platform looks great! You can build any kind of application by using C# or [any other .NET compatible programming language](https://en.wikipedia.org/wiki/List_of_CLI_languages).

However, there are issues are around the corner...

Maybe you find an awesome library on [NuGet](https://www.nuget.org/), but learn that it is for the .NET Framework and cannot use it in your project unless you target your project to .NET Standard 2.0. In that case, your application will also run on .NET Core.

What? Isn't .NET Framework just .NET? And what are .NET Standard and .NET Core?

Welcome to the .NET maze! If you don't want to get lost in it, you need [Ariadne's thread](https://en.wikipedia.org/wiki/Ariadne).

I understand that not everyone likes history, especially in the IT field. Many people prefer to know what and how to do things *today*. But, as it happens in everyday life, the past has a great influence on the present and also on the future. To understand today's and future .NET, you need to take a step back and trace its history, at least in broad strokes.

## In the Beginning Was the .NET Framework

In 2002, Microsoft promised one framework to build applications with any programming language: C# (born for that occasion), Visual Basic, and [many other languages](https://en.wikipedia.org/wiki/List_of_CLI_languages). The framework granted a common API set, language independence, interoperability with the underlying operating system and other non-.NET applications, portability (at least in perspective, at the time), and many interesting features.

Although the long-term idea was to make .NET a cross-platform framework, **the .NET Framework only ran on Windows**.

Don't get me wrong. Even if I'm speaking in the past tense, the .NET Framework is still alive and operative. Its [current version is 4.8](https://devblogs.microsoft.com/dotnet/announcing-the-net-framework-4-8/), and it is the last version of the framework, as you will learn later. But a huge amount of code runs on it, so you cannot consider it a dead framework yet.

## Mono on the Stage

One interesting thing is that Microsoft published the specifications of the [*Common Language Infrastructure* (CLI)](https://en.wikipedia.org/wiki/Common_Language_Infrastructure), that is, the .NET Framework runtime, and the C# language. Even better, they set them as open standards: [ECMA-335](https://www.ecma-international.org/publications-and-standards/standards/ecma-335/) and [ECMA-334](https://www.ecma-international.org/publications-and-standards/standards/ecma-334/). So pretty much anyone could implement the .NET runtime and the C# programming language.

In 2007, this paved the way for a project to port .NET to Linux: [the Mono Project](https://www.mono-project.com/). Other attempts to port .NET on Linux were made: [DotGNU](https://www.gnu.org/software/dotgnu/pnet.html) and [CrossNet](https://archive.codeplex.com/?p=crossnet), among others. However, only the Mono Project attracted significant interest and generated a production-ready framework.

However, not everything in the .NET Framework could be ported to Mono due to some strict dependencies on Windows. In addition, the state of Mono development was usually not so aligned with the current state of the .NET Framework. This actually created some friction with the real portability of .NET applications to Linux.

## .NET Everywhere

The open specifications of the .NET fundamental components were the first step towards the quick spread of the framework. Microsoft on one side and other independent developers on the other side brought the .NET Framework to different platforms.

When the .NET Framework was born, Microsoft also released the [.NET Compact Framework](https://en.wikipedia.org/wiki/.NET_Compact_Framework). It was a reduced version of the framework designed to run on devices with limited computing capacity, such as PDAs, mobile phones, set-top boxes, etc.
In 2007, the [.NET Micro Framework](https://netmf.github.io/) was launched: a more efficient version of the .NET Compact Framework that could also run directly on the hardware.

The same year, [Silverlight](https://en.wikipedia.org/wiki/Microsoft_Silverlight) brought .NET to the browser, providing developers with a framework for building rich Internet applications similar to Adobe Flash.

In 2009, the [MonoTouch](https://en.wikipedia.org/wiki/Mono_(software%29#MonoTouch) project started. It was the first attempt to port the Mono framework (that is, the Linux implementation of the .NET Framework) to iOS and Android. In a few years, the MonoTouch project became the foundation for [Xamarin](https://dotnet.microsoft.com/apps/xamarin), the framework for building Android and iOS apps with C# (2013).

So, as early as 2013, .NET allowed you to build applications for Windows and Linux machines, for embedded devices, for the browser, and for iOS and Android devices.

You may think that it was amazing! However, the proliferation of different environments led to a fragmentation of the framework itself. That wasn't much of a problem for those who were developing applications. Applications are usually platform-specific. This fragmentation was a big problem for library developers. In fact, a .NET assembly could theoretically be loaded in any .NET runtime. Unfortunately, it could break at any point if it calls an API that wasn’t supported by the platform it is running on.

The cross-platform dream had not yet come true.

<include src="TweetQuote" quoteText="As early as 2013, .NET allowed you to build applications for Windows and Linux machines, for embedded devices, for the browser, and for iOS and Android devices."/>

## The Rise of .NET Core

In 2014, to pursue the goal of an actual cross-platform development framework, Microsoft started writing .[NET Core](https://github.com/dotnet/core) from scratch. The first release was ready in 2016. The new framework was a complete redesign of the .NET specifications with cross-platform support in mind. In fact, its runtime ran on Windows, Linux, and macOS.

This new framework didn't have the backward-compatibility constraints that the .NET Framework had. Its modular architecture provided smaller versions of the framework's core components, letting the developer download the additional components from the NuGet repository. This refactoring enabled simplified deployment and portability.

## The Need for a Standard

While .NET Core was a step in the right direction for cross-platform support, it brought yet another implementation in the already entangled .NET ecosystem. In other words, a library developer has another potential pain point for the portability of their library.

Microsoft tried to put order into this chaos by [introducing the .NET Standard](https://devblogs.microsoft.com/dotnet/introducing-net-standard/). This is not just another framework implementation, but a formal specification of .NET APIs that multiple .NET platforms have to implement. Different .NET Standard versions define different .NET API sets. This way, a .NET implementation declares which .NET Standard version it supports. The library developer needs to target that specific .NET Standard version.

For example, if you want your library to run on .NET Framework 4.5, .NET Core 2.1, and Mono 4.6, you should target your project to [.NET Standard 1.1](https://github.com/dotnet/standard/blob/master/docs/versions/netstandard1.1.md). See the [official documentation to take a closer look at the .NET Standard](https://docs.microsoft.com/en-us/dotnet/standard/net-standard).

Targeting a .NET Standard is a matter of specify the [Target Framework Moniker (TFM)](https://docs.microsoft.com/en-us/dotnet/standard/frameworks) in the .NET project file. It is something like the following in your .NET project file:

``` xml 
<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <TargetFrameworks>netstandard2.0</TargetFrameworks>
  </PropertyGroup>
  ...
</Project>
```

## Only .NET from Now On

Finally, in November 2020, [.NET 5 was released](https://auth0.com/blog/dotnet-5-whats-new/). This new version of the framework aims to be the unified .NET platform from now on. No more need for different implementations: .NET 5 is the common set of APIs that runs on Windows, Linux, Mac, iOS, and Android. So, if your project targets .NET 5, your code will run on all those platforms.

![.NET 5 platform](https://images.ctfassets.net/23aumh6u8s0i/62ADaRg2zm1S8J9gpKX6Kv/a062f9c576330a811fb155da37104beb/dotnet5_platform)
<p align="center"><i><a href="https://devblogs.microsoft.com/dotnet/introducing-net-5/">[Source: Microsoft]</a></i></p>

If you need a given platform's APIs, you should use a specific TFM. For example, if you want to use [Windows.Forms](https://docs.microsoft.com/en-us/dotnet/desktop/winforms/?view=netdesktop-5.0) for your desktop application, you need to specify the `net5.0-windows` TFM, since this feature is supported on the Windows operating system. Of course, in this case, you know that your code will run only on that specific platform.

.NET 5 removes the need for .NET Standard. Actually, you may think of .NET 5 as the evolution of .NET Standard. However, .NET 5 is not a formal specification but an actual implementation. Also, the release of .NET 5 marks the end of .NET Framework.

At this point, you might ask: .NET 5 is the subsequent version of .NET Core 3.1. What happened to .NET 4?

The answer is pretty simple: there is no .NET 4! Microsoft decided to skip this version to avoid confusion with .NET Framework 4.x. So, from now on, .NET will have no more Framework, Core, Compact, or Micro.  The future of .NET will have no other qualifier than just its version.

<include src="asides/DotNetCore" />


.NET Core vs .NET Framework vs .NET Standard: A Guided Tour

Learn the best practices to store and manage secrets in your .NET applications.

Secrets Management in .NET Applications

What's new in .NET 5? Learn how .NET Core and .NET Framework evolve into the new cross-platform framework.

.NET 5, the successor of .NET Core 3.1 and .NET Framework 4.8, aims to provide .NET developers with a new cross-platform development experience. It puts order to the .NET universe fragmentation that has been arising over the years and brings new amazing features. Of course, you cannot learn all about .NET 5 right now, but you can focus on just five things to have a clear understanding of what is going on.

## The Unified Platform

The first thing you have to know is that .NET 5 brings you a new unified vision of the .NET world.

If you have been working with .NET, you may be aware of its platform fragmentation since its first release in 2002. The .NET Framework was initially designed for Windows, but its runtime specification, also known as Common Language Infrastructure (CLI), was standardized as [ECMA 335](https://www.ecma-international.org/publications/standards/Ecma-335.htm).

The standardization allowed anyone to create their own implementation of the .NET runtime. And in fact, a few of them appeared on the horizon: [Mono](https://www.mono-project.com/) for Linux-based systems, [Silverlight](https://www.microsoft.com/silverlight/) for browser-based applications, .[NET Compact](https://en.wikipedia.org/wiki/.NET_Compact_Framework) and [Micro](https://en.wikipedia.org/wiki/.NET_Micro_Framework) frameworks for mobile and resource-constrained devices, and so on. Then, Microsoft decided to write .NET Core from scratch with cross-platform compatibility in mind.

These different implementations raised the need to understand where a .NET package could run on. Should you build different versions of your library to distribute it? The answer to this question was [.NET Standard](https://docs.microsoft.com/en-us/dotnet/standard/net-standard), i.e., a formal specification of the common APIs you should expect across CLI implementations. In other words, if you build your library for one specific .NET Standard, you'll be guaranteed it will run on all the runtimes that implement that specification.

You understand that, in this messy situation, the desired cross-implementation compatibility is not so easy to achieve. This is why .NET 5 appears on the scene.

![.NET 5 Platform](https://images.ctfassets.net/23aumh6u8s0i/l9JJaTYKjT55fB2VDus2R/d3bbe04d363cf6e022e24ca882840173/dotnet5_platform)

[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/introducing-net-5/)]

The new .NET platform is the unified successor of the various .NET flavors: .NET Framework, .NET Standard, .NET Core, Mono, etc. It is officially the next version of .NET Core 3.1, but basically determines the end of .NET Framework, .NET Standard, and the other variants that caused big headaches to .NET developers.

.NET 5 provides a common set of APIs that aligns the different runtime implementations. This set of APIs is identified by the `net5.0` [Target Framework Moniker](https://docs.microsoft.com/en-us/dotnet/standard/frameworks) (TFM), which is the token you set in your .NET project to specify the target framework. This enables your application to run on any runtime implementation supporting .NET 5. However, you can still build applications for a specific platform. For example, to build an application that uses Windows API, you need to specify the `net5.0-windows` TFM. This way, building a platform-specific application is **your** choice, not a choice depending on the runtime implementation you are using to develop your application.

Of course, achieving this unified platform required a significant effort and an internal architecture rearrangement. A few features have been removed from the core API set, as you will see later on, but [the platform gained a general improvement in performance](https://devblogs.microsoft.com/dotnet/performance-improvements-in-net-5/).

While the new .NET 5 comes with the platform unification goal, the initial plan changed because of COVID-19. In fact, .NET 5 sets the foundations of the unification, but it will be completed with .NET 6 in November 2021. With that release, you will get the stable release of the new Universal UI and support for the specific TFMs for Android (`net6.0-android`) and iOS (`net6.0-ios`), for example.

<include src="TweetQuote" quoteText=".NET 5 was born with cross-platform compatibility in mind."/>

## New Features in C# #

The second thing you should know is about C#. .NET 5 comes with C# 9, the new version of the .NET platform's main programming language. There are several new features, but here you will find a taste of the most relevant ones.

### Top-level statements

Among the new features, one of the most notable is the introduction of **top-level statements**. To learn what they are, take a look at the following classic minimal program:

<include src="AmpWarning" fullUrl="https://auth0.com/blog/dotnet-5-whats-new"/>

``` csharp 
using System;

namespace HelloWorld
{
    class Program
    {
        static void Main(string[] args)
        {
            Console.WriteLine("Hello World!");
        }
    }
}
```

Just to write one string to the console, you need to define a namespace, a class, and the static method `Main()`. Now, you can get rid of this code infrastructure and simply write the following:

``` csharp 
System.Console.WriteLine("Hello World!");
```

Top-level statements allow you to focus on what really matters in small console programs and utilities and use C# with a more scripting-oriented approach.

### Record types

Another interesting new feature is **record types**. With records, you can declare an immutable reference type, i.e., a class-based type that cannot be changed after its creation. An example of a built-in immutable reference type is the `System.String` class. After you create an instance of a `System.String`, you cannot change its value anymore.

Consider the following record type declaration:

``` csharp 
public record Person
{
    public string FirstName { get; }
    public string LastName { get; }

    public Person(string first, string last) => (FirstName, LastName) = (first, last);
}
```

You can create an instance of the `Person` record as you do with a class, but you can't change its `FirstName` property:

``` csharp 
var person = new Person("John", "Doe");

person.FirstName = "Jack";	//throws an error
```

However, you can compare two instances of the `Person` record similarly to primitive values:

``` csharp 
var person = new Person("John", "Doe");
var anotherPerson = new Person("John", "Smith");

Console.WriteLine(person == anotherPerson);  //false
```

### Init setters

C# 9 also adds the `init` accessor to define **properties that can only be initialized**. To better explain its use cases, consider the following class definition:

``` csharp 
public class Person {
    public string FirstName { get; init; }
    public string LastName { get; init; }
    public string Address { get; set; }
}
```

This class defines a person with `LastName` and `FirstName` properties that can be initialized, but not changed. The `Address` property can be changed at any time:

``` csharp 
var person = new Person {
    FirstName = "John",
    LastName = "Doe",
    Address = "124 Conch Street, Bikini Bottom, Pacific Ocean"
}

person.Address = "17 Cherry Tree Lane";
person.FirstName = "Jack";	//throws error
```

If you want to learn more about the features brought by C# 9, please [check out the official documentation](https://docs.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-9).

## .NET MAUI, the Universal UI

As the third thing, you have to know that .NET 5 is bringing to you a new way to build cross-platform user interfaces. Thanks to the **.NET Multi-platform App UI** framework, also known as **.NET MAUI**), you will be able to build user interfaces for Android, iOS, macOS, and Windows with a single project.

> Actually, this feature is still in progress and will be released with .NET 6, but [you can start taking a look at .NET MAUI](https://github.com/dotnet/maui) to be ready when it is officially released. Take a look at [the roadmap](https://github.com/dotnet/maui/wiki/Roadmap) to follow its progress.

.NET MAUI can be considered an evolution of [Xamarin.Forms](https://dotnet.microsoft.com/apps/xamarin/xamarin-forms), the open-source framework for building iOS and Android apps with a single .NET codebase. But this new framework proposes a universal model for building UIs on mobile and desktop platforms.

![.NET MAUI](https://images.ctfassets.net/23aumh6u8s0i/5QASNuBVJCrC7bIIH6RLct/0edcc3942920c3e8dc49b49026bfeff0/maui-overview)

[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/introducing-net-multi-platform-app-ui/)]

In addition to the well-known [Model-View-ViewModel](https://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93viewmodel) (MVVM) pattern, .NET MAUI supports the new *Model-View-Update* (MVU) pattern. This is a one-way data flow pattern inspired by the [Elm programming language architecture](https://elmprogramming.com/model-view-update-part-1.html) that provides an effective way to manage UI updates and application state.

## Supporting Single-File Applications

The fourth thing you will get in .NET 5 is the support of **single-file applications**, that is, applications published and deployed as a single file. That means that your application and all its dependencies are bundled into one file. For example, say you run the following command within the folder of your .NET 5 project:

``` bash 
dotnet publish -r linux-x64 --self-contained true /p:PublishSingleFile=true
```

You will get a single file containing your application built for Linux, all the dependencies you used in your project, and the .NET runtime (`--self-contained true`). This means that you even don't need to install the .NET runtime on the target machine.

Of course, you can also specify these parameters in your project configuration:

``` xml 
<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net5.0</TargetFramework>
    
    <PublishSingleFile>true</PublishSingleFile>
    
    <SelfContained>true</SelfContained>
    
    <RuntimeIdentifier>linux-x64</RuntimeIdentifier>
  </PropertyGroup>

</Project>
```

Be aware that this feature doesn't use the same approach as the single-file applications you can build in .NET Core 3.1. In .NET Core 3.1, the single-file application is just a way to package binaries. At run time, they are unpackaged to a temporary folder, loaded, and executed. In .NET 5, the single-file application has a new internal structure, and it is directly executed with no performance penalty.

Take a look at the documentation to [learn more about this deployment type](https://docs.microsoft.com/en-us/dotnet/core/deploying/single-file).

## No Longer Supported Technologies

The last of the five things you are learning about .NET 5 concerns what is no longer supported. As said above, the architectural review and the attempt to make .NET 5 an actual cross-platform programming framework led to removing a few features supported in .NET Framework. Let's take a quick look at the removed features and the possible alternatives.

### Web Forms

For a long time, [ASP.NET Web Forms](https://dotnet.microsoft.com/apps/aspnet/web-forms) has been the main technology to build dynamic web UIs. However, it is not a secret that its lifetime was closely bound to .NET Framework's destiny. .NET Core doesn't support Web Forms, so the fact it is no longer supported in .NET 5 shouldn't actually be news.

However, you have a few alternatives to build web UIs. If you are building traditional web applications, [Razor Pages](https://docs.microsoft.com/en-us/aspnet/core/tutorials/razor-pages/?view=aspnetcore-5.0) are one of these alternatives. If you want to build single-page applications, you can use [Blazor](https://docs.microsoft.com/en-us/aspnet/core/blazor/?view=aspnetcore-5.0).

### Windows Communication Foundation (WCF)

Even [WCF](https://docs.microsoft.com/en-us/dotnet/framework/wcf/whats-wcf), the traditional communication framework for Windows, is going to be deprecated. This may appear a bit shocking for the developers that have used it to build their service-oriented applications. However, it is pretty understandable if you realize that the primary goal of .NET 5 is becoming a cross-platform framework.

The alternative to WCF recommended by Microsoft is to migrate to [gRPC](https://docs.microsoft.com/en-us/aspnet/core/grpc/?view=aspnetcore-5.0). But if you are nostalgic about WCF or want to prepare a smooth transition, you can give the [CoreWCF](https://github.com/CoreWCF/CoreWCF) open-source project a try.

### Windows Workflow Foundation

Finally, .NET 5 will not even include [Windows Workflow Foundation](https://docs.microsoft.com/en-us/dotnet/framework/windows-workflow-foundation/), the workflow engine technology available in .NET Framework. There is no official replacement for this technology. However, you can use an open-source porting project, [CoreWF](https://github.com/UiPath/corewf), to attempt moving your existing workflows on .NET 5 or creating new ones.

## Summary

At the end of this article, you have a high-level idea of how .NET 5 will impact your existing .NET projects and which opportunities the new platform is going to offer you. Maybe these highlighted five things may seem like little stuff, but they should allow you to find your way around this turning point in the .NET evolution.

Of course, you can [try .NET 5 right now by downloading its runtime and SDK]( https://dotnet.microsoft.com/download/dotnet/5.0).

While .NET 5 is out, many applications that need security rely on older versions of .NET. Here’s how you can secure an [ASP.NET](http://asp.net/) Core 3.x with Auth0. The same patterns should apply to .NET 5. Let us know in the comments if you bump into any difficulties.

<include src="asides/DotNetCore" />

Five Things You Should Know About .NET 5

Matt leads the Developer Relations team at Ionic, an app development platform that helps companies ship powerful cross-platform apps using one codebase. A .NET developer for many years, he embraced the open web after realizing he should probably pay attention to an up-and-coming language called “JavaScript.” Today, he specializes in cross-platform hybrid apps built with web technologies. When not coding, you can find him traveling the world, hiking, and exploring the local sights and culture.

Learn how to secure your Ionic app by adding user authentication with Auth0 and Ionic Auth Connect.

Adding Auth0 to an Ionic Angular App Using Auth Connect

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Value-added distributor to provide Auth0’s identity management solutions for LATAM’s top companies

**BUENOS AIRES, Argentina – June 29, 2021 –** The** **[Auth0 Identity Platform](https://auth0.com/),  a product unit within Okta (NASDAQ: OKTA), today announced a partnership with [CLM](https://clm.com.br/), a value-added distributor that specializes in advanced data center infrastructure and cybersecurity. CLM is Auth0’s first distribution partner in Latin America (LATAM) and extends Auth0’s reach into Brazil, Colombia, Ecuador, and Peru to provide local partners and their customers with an extensible, trusted identity management solution.

CLM operates in LATAM and specializes in creating opportunities across the channel ecosystem by educating their clients on best of breed solutions such as Auth0 to solve their customer identity management needs. The addition of CLM to Auth0’s [Partner Program](https://auth0.com/partners) and Auth0’s growth in LATAM indicates demand for cloud-based identity management solutions that balance security and customer experience. 

The onset of COVID-19 has accelerated the transition to digital globally. Delivering a secure and frictionless customer experience online starts with a [Customer Identity and Access Management (CIAM)](https://auth0.com/resources/whitepapers/ciam-buyers-guide) solution that enables businesses to capture, convert, and retain customers and fuel business growth. A [recent PwC survey](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) found that approximately half of consumers (49%) in LATAM say they will walk away from a brand they love after just one bad experience. 

“Companies cannot predict exactly what their business and customers will need tomorrow, especially in response to today’s rapidly changing digital environment. With identity at the heart of security and any transformation process, an adaptable and modular identity solution that supports the breadth of all identity needs is essential,” said Gabriel Camargo, product director at CLM. “Auth0 is a trusted identity management provider and a natural addition to our best-in-class portfolio of disruptive vendors.”

Together, Auth0 and CLM are supporting major companies in Latin America—including [AK Networks](http://akcela.com.br/) and [XP Inc.](https://www.xpi.com.br/)—to meet their evolving identity management and security goals.

“We are honored to welcome CLM to our Partner Program and join forces to deliver growth opportunities to customers in Brazil and throughout LATAM,” said Ghazi Masood, SVP, Americas at Auth0. “The addition of Auth0 to CLM’s cybersecurity portfolio means partners and their customers now have a set of extensible building blocks to solve for any identity use case without having to compromise between convenience, privacy, or security—allowing them to innovate and launch products and services faster.”

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications<br />
[press@auth0.com](mailto:press@auth0.com)<br />

Grupo Muchnik for Auth0<br />
[auth0@muchnik.co](mailto:auth0@muchnik.co)<br />

Auth0 Expands Global Partner Network in Latin America with CLM

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Auth0 integrates netID to support customer privacy needs in Europe

**London/Montabaur, Germany – August 17, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, and the [European netID Foundation](https://enid.foundation/en/) today announced the availability of netID Single Sign-On on [Auth0 Marketplace](https://marketplace.auth0.com/), a catalog of trusted technology integrations to extend the functionality of Auth0’s identity management platform. 

[netID](https://marketplace.auth0.com/integrations/netid-single-sign-on) enables users to sign into apps and websites with their netID account and to decide privately and transparently which data to share. As an independent European identity provider with more than 38 million active user accounts in Germany, netID provides the necessary infrastructure for [Single Sign-On (SSO)](https://auth0.com/blog/what-is-single-sign-on-a-non-developer-s-guide/) but does not store any user data itself. Users can manage the consents they’ve given at any time in netID’s Privacy Center.

“Whether in finance, e-commerce, or online publishing, engaging with users in an all trusted and transparent way is key to driving success. We are excited about the partnership with Auth0 and the availability of the netID Single Sign-On integration. Joint customers can now seamlessly integrate our product and offer users a European alternative to U.S. social login providers,” says Achim Schlosser, board member, and chief technology officer of the European netID Foundation.

“After speaking with many customers, we have identified the integrations that matter to them. The availability of netID on [Auth0 Marketplace](https://marketplace.auth0.com/) is a direct response to the growing need for privacy-enhancing technologies in Europe and part of our continued commitment to international markets,” said Cassio Sampaio, SVP of Product at Auth0. “We are thrilled to have netID as a vetted and valuable vendor in Auth0 Marketplace.” 

Auth0 reviews partner integration functionality and makes available integrations that are easy to discover and integrate for customers. Partners can participate in the growing demand for digital identity solutions and increase their visibility as part of the Auth0 Marketplace and can learn more here: [https://auth0.com/partners](https://auth0.com/partners).

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), provides a modern identity platform that helps organizations meet the security, privacy, and convenience needs of their users. Please visit [Auth0 Identity Platform](https://auth0.com/identity-platform) to learn more.

## About the European netID Foundation

The European netID Foundation was established in March 2018 by Mediengruppe RTL Deutschland, ProSiebenSat.1, and United Internet with its brands WEB.DE and GMX. With an independent market solution, the foundation supports Internet offerings from all industry sectors with the implementation of the new European data protection law and, for this purpose, has created the open login standard netID. The initiators of the foundation together reach around 50 million unique users every month and together have more than 38 million active accounts. The foundation is explicitly open to additional partners and initiatives. Further information is available at [www.enid.eu](https://enid.foundation).

<include src="asides/AboutAuth0" />

### Media Contacts
Alexandra Roszkowski<br />
[presse@enid.eu](mailto:presse@enid.eu) <br />
+49 162 25 27-188<br />

Sarah Konarski & Nele Mascher<br />
Finn Partners for Auth0, DACH<br />
[auth0de@finnpartners.com](mailto:auth0de@finnpartners.com)<br />

Auth0 Marketplace Now Offers netID Solution

daniel-krzyczkowski-2020

Software Engineer passionate about Microsoft technologies. Awarded with Microsoft Most Valuable Professional title. The main part of his activities is to share knowledge and passion about Microsoft Azure, IoT, Universal Windows Platform and DevSecOps.


Software Engineer

Daniel Krzyczkowski

How to securely access secrets stored in the Azure Key Vault service using the new Azure SDK and managed identities.

Secrets Access with Managed Identities in .NET Applications

duncan-godfrey

Duncan is a security, engineering, and business leader. His background is in security engineering and, in particular, cloud security.

Sr. Director of Security and Compliance

Duncan Godfrey



The death of the corporate network had long been predicted. You can't rely on your old corporate controls anymore &mdash; firewalls, NIDS, and WAFs don't keep attackers out; "they are a Band-aid," they said. They give you a "false sense of security," they cried. I know you think your hardened perimeter protects you, but eventually, someone will find their way past it. Once there is that single crack, an attacker can rampage around your network's soft center. Building a castle wall around your data won't stop a persistent threat.

The security industry had an answer for that; you started to hear about more and more companies pushing towards a Zero Trust security model. Then you started to read about Google's [BeyondCorp](https://cloud.google.com/beyondcorp#:~:text=BeyondCorp%20began%20as%20an%20internal,authorization%20for%20Google's%20core%20infrastructure.) implementation. And then you visited the vendor floor at a major security conference, and you found a lot of companies willing to sell you that zero trust dream. 

It all made total sense. Why should you trust a device just because it's inside your perimeter? Why do you even need a perimeter?! Do I even know what my perimeter is?!

Then, on Monday morning, you returned to your headquarters and were confronted with your reality. Most people were still in your office. They came in every day and left again. Maybe they did some work here and there outside of the building, a flex-day to work around an appointment or a school sports day. The corporate applications that kept your Business running mostly still lived in your data center, within your building, and accessed from the local network. Your perimeter was pretty hard; it was the walls of your buildings that wrapped around your employees. Adding external access outside of your corporate VPN introduced its own set of problems and risks. Then, before you could start decoupling them, they were still heavily integrated with an old legacy IAM system, which was also sitting in your data center. 

What you had was mostly fine. It's hard to get investment in the [digital transformation](https://auth0.com/blog/what-digital-transformation-is-and-what-it-isnt/) when things are static and mostly the same.

Then it wasn't the same. 

Overnight your workforce moved out of the office, off your network to their homes. And, your corporate network was no more. The process now was remote.

I've repeatedly heard this story from many Security and IT leaders. Their world has suddenly changed overnight. A scramble began to build or upgrade the infrastructure needed to move their employees into a remote environment: they quickly spun up a VPN, or in some cases, they just open applications up to the Internet. They allowed users to roam beyond their castle walls and allowed access to data in ways that would have terrified them previously.

## There Never Was a Castle Wall Around Your Data

I was having some fun in the intro, but most security professionals have had the realization that their networks were not fortresses. Unless you are able to disconnect your users from the Internet, then you were only ever one firewall rule change, misconfigured wireless access point, or a secret operations maintenance backdoor away from having unexpected and unmonitored remote access. If you issued Laptops, then unless you had locked in a mandatory full tunnel VPN, then your users were likely taking them home to work on the weekends, and you lost visibility into their activity "off-net."

The reality of [Shadow IT](https://en.wikipedia.org/wiki/Shadow_IT) in Enterprise environments is not new. People expect to move quickly, and if your infrastructure was static and restrictive, then likely your users had silently adopted a new cloud tool. This means that your data was being moved to unknown and unmonitored locations. Finding and curbing this has always been ongoing risk mitigation for IT and Security teams.

## Remote Is Here to Stay So Make It Your Strength, Not Your Weakness

In the early months of this pandemic, we thought a lot of this new infrastructure would be temporary. But we already see a changing landscape for remote work. Twitter's [announcement](https://techcrunch.com/2020/05/12/twitter-says-staff-can-continue-working-from-home-permanently/) they would permanently move to a remote model received a lot of headlines, and they were quickly joined by a number of large [companies](https://github.com/arjunmadgavkar/Newly-Remote-Companies/blob/master/List.md), including [Atlassian](https://www.smartcompany.com.au/startupsmart/news/atlassian-remote-work-permanent/), that have made it clear that this will be their new normal.

This has always been our normal at Auth0, and, in fact, we viewed our remote workforce as a competitive advantage. We could find talent anywhere in the world, offer candidates real mobility and flexibility, and attract top talent who wanted to escape expensive tech centers. Employees had been identifying remote work as a key differentiating job perk before it became a necessity.

So, your security controls need to catch-up with this new reality. Remember, being nimble with your infrastructure and policy means you can now move at the speed of the Business. You can give them what they want!

## A Remote Workforce Doesn’t Have to Reduce Your Security Posture, in Fact, the Opposite Is True as Long as You Put the Right Building Blocks in Place

This new environment changes your [Threat Model](https://en.wikipedia.org/wiki/Threat_model#:~:text=Threat%20modeling%20is%20a%20process,and%20mitigations%20can%20be%20prioritized.) and your risk. For example, a fundamental principle for our environment has always been that our employee laptops are never on a "safe" network. Sometimes, people are in the office, but likely they are at home or traveling. With this in mind, you harden them accordingly - making sure they are resistant to a colocated attacker and that you have deep visibility into their behavior.

The Zero Trust concept is itself maturing, and with NIST's publication of their [Draft ZT Paper](https://csrc.nist.gov/News/2019/zero-trust-architecture-draft-sp-800-207), an agreed definition of a Zero Trust Architecture (ZTA) is forming. This also clears the way for the Federal Government and risk-averse Enterprises to consider this approach. The security industry rallying around a standard approach is good for our users as we are all working together. And, to tie it back to our threat model, what this approach does is recognize that a lot of attacks are successful because that attacker is able to steal a credential and leverage it. So that an "outsider" immediately looks like an insider and is therefore trusted. 

This puts authentication at the forefront of your security controls and further drives home that Identity is the perimeter. And, at a minimum, this means the building blocks of:
	
1. Strong [authentication](https://auth0.com/blog/what-is-an-authentication-server/), are you using [multifactor authentication](https://auth0.com/learn/get-started-with-mfa/) everywhere in your Enterprise? Preferably use a hardware token.
2. Maintain an agile IAM solution that provides centralized SSO for all these new apps to be monitored and controlled.

2020 has forced some quick and reactive changes upon us. As we move forward, there should also be space for some positive security wins to come out of a terrible situation. This is the new normal, but we do have the building blocks to secure it, especially if you begin building with Identity at the heart of your Security Architecture.


The Death of the Corporate Network

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Streaming companies must adapt to unprecedented network strain



Everyone is coping with the Coronavirus pandemic in their own ways, yet people around the world seem to share a few rituals: washing our hands, wearing masks, and of course, catching up on our Netflix queue. 

With much of the world’s population stuck at home under social distancing, quarantine, and mandatory lockdowns, consumer spending on streaming has increased [anywhere from 20% to 50%](https://www.nytimes.com/interactive/2020/04/11/business/economy/coronavirus-us-economy-spending.html) depending on the channel. Given this unprecedented surge in demand, it’s not hyperbolic to say the internet is going through the most intense stress test in its history.

The global desire for entertainment and escapism is [creating a windfall for streaming services](https://www.cnn.com/2020/03/02/investing/coronavirus-stay-at-home-stocks/index.html). Netflix, for example, [more than doubled](https://www.theguardian.com/media/2020/apr/21/netflix-new-subscribers-covid-19-lockdown) its projected number of new subscribers since the pandemic began, and [Disney+ added](https://www.theguardian.com/media/2020/apr/09/disney-netflix-rival-doubles-subscriptions-in-virus-lockdown) 22 million subscribers as well. However, a combination of network slowdowns (and failures) and streaming models that don’t monetize increased traffic means that the situation for streaming media companies is more complicated than it first appears.

Media companies are facing new challenges and new opportunities and working to develop technological solutions that help them weather this historic moment.

## Quarantined Nations Increase Their Streaming Time

We can see the effects of COVID-19 on streaming services by watching how currently quarantined countries (those hits hardest by the virus) have been behaving. Even without a full-blown quarantine, the rise of voluntary social distancing and enforced isolation creates at least a comparable situation.

Though China [is showing signs of recovery](https://www.cnn.com/2020/03/19/asia/coronavirus-covid-19-update-china-intl-hnk/index.html), they implemented mass quarantine first and can give us useful data on streaming behavior. Chinese Nielsen [data shows a significant rise](https://mp.weixin.qq.com/s/vxKFJOFeXLWuasuvtu7kBw) in TV viewing, but people are also streaming less conventional content. Quarantined Chinese citizens are getting creative with streaming entertainment, [streaming concerts](https://www.nytimes.com/2020/03/04/arts/music/arts-coronavirus.html), and [setting up digital clubbing and digital gyms](https://www.bbc.com/news/world-asia-china-51628693) in their living rooms.

Italy, still in quarantine, has seen a similar rise in streaming content, with an average viewing-time increase of [11% nationally with highs of 17%](https://www.corriere.it/spettacoli/20_febbraio_29/effetto-coronavirus-volano-ascolti-telegiornali-talk-9399464c-5afe-11ea-8b1a-b76251361796.shtml?refresh_ce-cp) in the Lombardy region. During the nationwide quarantine, the Italian telecoms giant Telecom Italian SpA has reported an overall [70% increase in internet traffic](https://www.bloomberg.com/news/articles/2020-03-12/housebound-italian-kids-strain-network-with-fortnite-marathon) from work-from-home traffic and daytime online gaming.

**The spread of the novel coronavirus is also forcing studios and streaming services to rethink how they create and distribute content**, jumping release dates forward, skipping the box office, and closing down production. This will all lead to greater strain on streaming services and the larger internet.

The outbreak is closing theaters [across the United States and across the world](https://www.npr.org/2020/03/17/817136846/as-coronavirus-shuts-down-theaters-universal-shifts-some-films-to-on-demand), which has been linked to a [13% rise in streaming in the US that could rise up to 60%](https://time.com/5806060/coronavirus-movie-theaters-streaming/) based on prior crises. Production companies are fighting this by streaming [first-run movies straight to home services](https://www.vulture.com/2020/03/coronavirus-is-pushing-movies-online-faster-than-ever-before.html): Universal released _Emma_ and other new movies to streaming services, the new Pixar movie _Onward_ is going right to Disney+, and huge films like _Frozen 2_, _Birds of Prey_, and _The Invisible Man_ are coming much sooner than their prior release date.

While these first-run movies popping up on streaming services does create a large viewership base at home, it may not lead to the massive streaming profits being predicted.

<include src="TweetQuote" quoteText="Consumer spending on streaming media is up 20-50%. What streaming media companies can do to make sure they can withstand the quarantine-driven stress test."/>

## Streaming Services Are Doing Better Than Expected

It seems like a simple, logical equation: more time at home equals more streaming, which means greater profits for streaming services. But many streaming services, like Netflix, aren’t modeled to reap more profits from an increase in individual streaming time - which is why some were predicting that Netflix might not see a huge boost in profits.

  “If you have to decide between food and your Netflix subscription, it seems to me like you disconnect your Netflix. You’re probably not going to add another $13 a month if you don’t know when your next paycheck’s going to come in.” — Laura Martin, the senior entertainment analyst at Needham & Company, [told the Guardian](https://www.theguardian.com/film/2020/mar/12/coronavirus-binge-watching-netflix-streamers-viral).

**Netflix doesn’t monetize volume**. They make their money [from subscriptions](https://www.vox.com/2019/12/17/21025154/netflix-global-growth-numbers-sec-streaming-investors) ([and some product placement](https://www.cnbc.com/2017/07/27/bill-gates-ben-does-product-placement-in-netflix-and-amazon-shows.html)). The stock market reflects this uncertainty — Netflix has seen [less than a quarter of a percent of growth](https://www.cnbc.com/quotes/?symbol=NFLX) in the last month.

However, despite a [majority of consumers being aware of Netflix](https://morningconsult.com/2019/09/19/in-tvs-content-war-netflixs-shows-capture-biggest-share-of-viewer-awareness/) before lockdown and quarantine conditions, Netflix has seen a surprising surge in subscriptions. In fact, they’ve doubled their estimates: from an estimated 7 million new subscribers [to 15.77 million new subscribers](https://www.theguardian.com/media/2020/apr/21/netflix-new-subscribers-covid-19-lockdown). 

This may be a temporary situation however: considering the shutdown of television and movie production across the board, time will tell if new subscribers will stick around for old content.

**A la carte streaming services like Amazon Prime may see a boost in revenue**. An Amazon Prime subscription [nets users a variety of shows and movies](https://www.businessinsider.com/amazon-prime-benefits-what-is-included) for “free,” like Netflix, but the newest releases must be rented or purchased.

Then again, despite the [rush of online ordering](https://blog.aboutamazon.com/company-news/amazons-actions-to-help-employees-communities-and-customers-affected-by-covid-19) and their strong grip on streaming media, [Amazon stock isn’t seeing much of a surge either](https://www.cnbc.com/quotes/?symbol=AMZN). Though the entire stock market has taken a hit, [early predictions that streaming company stock would be safe refuges](https://nypost.com/2020/02/28/how-coronavirus-benefits-netflix-and-other-in-home-services/) may have been premature.

Meanwhile, Twitch — the [most popular streaming service](https://www.nytimes.com/2019/12/15/business/tech-video-game-streaming-twitch.html) for gaming videos and livestreams — [has seen a 10% growth](https://www.theverge.com/2020/3/18/21185114/twitch-youtube-livestreaming-streamelements-coronavirus-quarantine-viewership-numbers) in viewership as of March 18. Unlike Netflix or Amazon Prime, Twitch monetizes through ads and will likely see a commensurate rise in revenue.

But differing monetization methods don’t tell the whole story. These potential revenue boosts or profit stagnation trends are dependent on network architecture surviving the sudden swell of usage, which may not be a guarantee.

## Strained Network Architecture Will Need Relief

Social distancing and quarantine [are closing schools](https://www.npr.org/sections/health-shots/2020/03/16/816428320/coronavirus-u-s-enters-quarantine-life-as-many-schools-and-businesses-close) and [workplaces](https://www.washingtonpost.com/national/coronavirus-outbreak-shutdown-america/2020/03/13/d8589434-6550-11ea-acca-80c22bbee96f_story.html), which means a glut of people at home streaming media for entertainment, work, and educational purposes placing unprecedented strain on the internet. Some websites are [even taking bets](https://www.sportsbettingdime.com/news/odds-global-netflix-outage-playstation-network-xbox-live-crash/) on which streaming or web service will go down next.

[Microsoft Teams crashed](https://www.independent.co.uk/life-style/gadgets-and-tech/news/microsoft-teams-service-status-crashes-outage-issues-today-work-home-down-a9404771.html) under the increased load of remote video conferences, and YouTube and Netflix have started [throttling quality on their videos](https://edition.cnn.com/2020/03/19/tech/netflix-internet-overload-eu/index.html) in order to reduce bandwidth in the face of the surge. Hulu [users reported a widespread outage](https://www.cnet.com/news/hulu-is-down-as-users-complain-of-videos-not-loading/) on March 20, one that seemed to affect multiple devices:

![hulu-activity-03-20-2020](https://images.ctfassets.net/23aumh6u8s0i/6Gp4ntk7M1cxNGwTHZxD3k/049ae9a357782e60896684ff437b7297/hulu-activity-march-20-2020)
[DownDetector.com](http://DownDetector.com) - Hulu - March 20, 2020

Many companies [suspended their data caps](https://www.cnet.com/news/carriers-are-suspending-internet-data-caps-during-coronavirus/) and [increased streaming limits](https://www.pcgamer.com/discord-ups-streaming-viewer-limit-while-coronavirus-keeps-people-at-home/) in order to help people stay entertained and in contact during isolation and quarantine. However, these acts of generosity may increase the amount of simultaneous traffic online.

Streaming services may need to try new network solutions to stay ahead of this bloom of potentially network-crashing traffic.

## Private Cloud Boosts Streaming Infrastructure

In the face of this inflating audience and inflating screen time, streaming services using a public cloud may want to consider other options to bolster their network architecture.

There’s nothing wrong with choosing a public cloud; it’s a perfectly reasonable option for a smaller streaming service. Larger streaming services, however, can increase their bandwidth and reduce their downtime and slowdowns with a private cloud solution.

A private cloud service like Auth0 offers scalability and can provide a [greater request-per-second](https://auth0.com/blog/how-finservs-can-reduce-risk-increase-innovation-with-private-cloud/) (rps) baseline — one that can add capacity as needed. It also has enhanced uptime over a public cloud, with a guaranteed 99.99% uptime.

<include src="TweetQuote" quoteText="How private cloud can help streaming companies withstand quarantine streaming pressures."/>

A private cloud doesn’t share resources or bandwidth with other companies, which is where a public cloud can sometimes struggle. Public cloud services like AWS do create server instances as needed, but they’re doing that for every business or individual using the service.  COVID-19 isolation causes internet traffic to increase through every channel — streaming media, [communication](https://www.voicesage.com/blog/communication-best-practices-for-organisations-working-to-contain-covid-19/), [education](https://nypost.com/2020/03/17/coronavirus-in-ny-teachers-prepare-for-unprecedented-challenges-of-remote-learning/), and more — public cloud services are going to be hit from multiple angles at increasing speeds.

A private cloud can help streaming companies with servers dedicated to their businesses. Moreover, a private cloud can be managed or unmanaged, depending on whether you have the time and dedicated staff to maintain it.

## Getting Through This Together, Apart

The COVID-19 pandemic is a situation without precedent, creating entire nations of at-home workers, students, and entertainment-seekers all jumping on the internet at the same time. And with isolation and [lockdown orders](https://www.wsj.com/articles/china-reports-no-new-domestic-coronavirus-infections-for-the-first-time-since-outbreak-started-11584611233) coming [faster every day](https://www.washingtonpost.com/world/2020/03/20/coronavirus-latest-news/), this isn’t a situation [likely to change in the immediate future](https://www.washingtonpost.com/health/2020/03/16/social-distancing-coronavirus/).

Keeping streaming services going is a necessity for education, entertainment, and the economy. After a discussion with Netflix CEO Reed Hastings, the Internal Market Commissioner of Brussels, Thierry Breton, had this to say in [a statement to Politico](https://www.politico.eu/article/brussels-in-talks-with-netflix-about-reducing-internet-congestion/):

  “We all have a joint responsibility to take steps to ensure the smooth functioning of the internet during the battle against the virus propagation.”

With scalable network solutions such as a private cloud, we can deploy and use more servers to keep everyone entertained, educated, in shape, and in contact with one another until the situation is resolved. And, hopefully, we can all get back to business — and life — as usual.

<include src="asides/AboutAuth0" />


The (Surprisingly Complex) Impact of COVID-19 on Streaming Media

kapehe-jorgenson

Kapehe is an R&D Content Engineer for Auth0 with a passion for learning and teaching. With her primary focus on ReactJS and JavaScript, she is impressed with what code can create for the web. Technology and web development are constantly evolving and naturally bring that need for continual learning. She enjoys writing tutorials, hosting local meetups, and learning with others to expand coding knowledge.

R&D Content Engineer

Kapehe Jorgenson

Utilize the power of JAMstack and build a portfolio with Gatsby Cloud, Netlify, and DatoCMS.



<AmpContent>
<amp-youtube
    data-videoid="9t3kZ0rVDTw"
    layout="responsive"
    width="315" height="560">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/9t3kZ0rVDTw" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

**TL;DR:** In today's article, we are going to be building a [JAMstack](https://jamstack.org/) application using [Gatsby Cloud](https://www.gatsbyjs.com/cloud/) and [Netlify](https://www.netlify.com/). Using the power of these two, we will see just how easy it is to go from ground zero to a fully deployed website. We will also go over the idea of JAMstack and how it's changing the way we think of web development.

## The Art of JAMstack

The term JAMstack was first coined and created by Netlify. It's probably safe to say that most of us have used JAMstack in one way or another in our web development. Okay, but what is JAMstack? Let's chat about it.

Let's go over what the JAM in JAMstack means.

* J: JavaScript - Arguably one of the most popular coding languages in the world, it makes sense we are using it. Creating apps with [React](https://reactjs.org/), [Vue](https://vuejs.org/), or even just plain vanilla JavaScript, this helps build the stack and keeps our requests client-side.
* A: API's - This one is cool because it utilizes the power of an API and takes away the need for a database or a backend that needs to host a server.
* M: Markup - Next, we can have templated markup that is prebuilt. Once we pull in a static site generator like [Jekyll](https://jekyllrb.com/) or [Gatsby](https://www.gatsbyjs.org/), we can get that content displayed quickly.

These three together make for some pretty fast load times. While these three are working hard to creating a fast website, we have so many resources out there. JAMstack takes JavaScript further than what we are used to in SPAs. JAMstack takes an extra step to generate a static version of the site, whereas SPAs are usually client-side rendered.

In today's project, we will be building a portfolio with Gatsby Cloud and Netlify. Let's go over those.

<include src="TweetQuote" quoteText="JAMstack is changing the way we think of web development!"/>

## What is Gatsby

In our project today, we are going to be using [Gatsby](https://www.gatsbyjs.org/). Gatsby is a React-based, static site generator that is powered by [GraphQL](https://graphql.org/). Being a static site generator means it takes our React applications and creates a static HTML file. Once we have that, then whatever JavaScript is needed is loaded on top of our site to add extra functionality. It takes the load off browsers as we are just serving HTML. We don't need to call any databases or to run any server code to generate our pages. We can utilize the power of JavaScript and API's to get our info.

Not only is it going to make things lightning-fast because HTML is faster for a browser to render than JavaScript, but it's also super easy to get started with. We will get into that in a bit when we start building our site.

### Gatsby Cloud

We will also be using [Gatsby Cloud](https://www.gatsbyjs.com/). Gatsby Cloud is a product provided by Gatsby that allows us to create and manage our Gatsby sites faster. Gatsby Cloud provides a few starter projects that we can use to connect Gatsby, a data source ([DatoCMS](https://www.datocms.com/) for this project), and a deployment tool (Netlify for this project). We can connect all of these things and have a site up in a few quick clicks.

We will talk more on DatoCMS in just a bit. We will also go over how to use this amazing new product, Gatsby Cloud, that Gatsby has given us.

<include src="TweetQuote" quoteText="Gatsby Cloud is a product provided by Gatsby that allows us to create and manage our Gatsby sites faster."/>

## What is Netlify

Before the days of [Netlify](https://www.netlify.com/), we had to use companies like [AWS](https://aws.amazon.com/) or [DigitalOcean](https://www.digitalocean.com/) to create a server and then host our website on that server. Today we have Netlify that takes care of that for us. Deploying a website to Netlify is almost too easy. (I was skeptical on my first deploy!)

There are many ways to get your website up and running. In today's project, we will be using Gatsby Cloud to connect to Netlify. Let's see just how easy it is to use Gatsby Cloud to deploy to Netlify!

## What is DatoCMS

Our content is going to live somewhere. Rather than building our own CMS (Content Management System), we are going to utilize a tool called [DatoCMS](https://www.datocms.com/). All of our content (portfolio items) will be managed there. This is great because we don't have to create our own dashboards or editors. All of this is taken care of for us in the DatoCMS built-in dashboard.

So let's say we have a blog, and we want just a single blog post to be updated. We can update that content, the data will live in DatoCMS, and when we deploy, it will rebuild that one item rather than the entire blog. Sounds time efficient!

Let's build!

## What We Will Build Today

In today's project, we are going to be building a portfolio! Using Gatsby Cloud, Netlify, DatoCMS, and the power of JAMstack, we will get a website built up in no time. Let's see how quickly a portfolio can be created in the JAMstack world!
    
## Starting Our Project

First things first, let's get a Gatsby site built. We are going to head over to [Gatsby Cloud](https://www.gatsbyjs.com/). Here we will see the homepage. Click on "Log in" and we will be redirected to a page with a button that says "Sign in with GitHub". Once we click on that, we are going to use our own GitHub credentials and log into the Gatsby Cloud.

> Note: We may need to authorize Gatsby Cloud at this point if we have never used it.

![Gatsby Cloud homepage](https://images.ctfassets.net/23aumh6u8s0i/1sMfmSEiTCLI7TjacXcfSi/2e04a961fd49786173a9cb84a30f7b7e/gatsby-cloud-2)

Next, we will want to create a new project. By clicking on the "Create new site +" button, we are going to start that process. We do not have a Gatsby site yet, so we are going to want to click on "I don't have a Gatsby site yet" and then hit, "Next".

![The step that shows "I don't have a Gatsby site yet"](https://images.ctfassets.net/23aumh6u8s0i/2tluYwoIs7wdZEIqAhnidn/321f50846c0539ae48c3c460262117c3/create-new-site-2)

Here we are going to see a four-step process to build our website.

### Four steps in the Gatsby Cloud

* Step #1 - Starter: From the starters list, we are going to use the "Portfolio with DatoCMS". Click on that starter and click "Next".

* Step #2 - Repository: Here, we will give our repository a name. Because of the link to our personal GitHub, Gatsby Cloud will create the repo for us and put it in our GitHub account. If our GitHub account has access to multiple GitHub organizations, we will need to choose the correct one that we want to use. Once the correct organization is selected, we will install Gatsby Cloud. Next, we will name it, and click "Next". In this tutorial, we will use `jamstack-portfolio`.

**Note**: Netlify requires that Site names are unique globally. If following along, a unique name must be used.

![Image of naming our project for GitHub repo name](https://images.ctfassets.net/23aumh6u8s0i/7EWzemqBqvkYHnneX1bqxu/b5ff59156048c5bc35680000fd9d7267/github-name-2)

* Step #3 - Connect CMS: In this step, we are going to either [create a DatoCMS account](https://dashboard.datocms.com/signup) or [connect to an existing one](https://dashboard.datocms.com/login). Click on the "Connect" button to be directed to "Authorize with DatoCMS". A popup will appear, and we will either create a new, free account with DatoCMS or log in to an existing one. Once we authorize all of that, we will return to see that we are indeed "Connected" to our DatoCMS. Once we see that, hit "Start my site".

![Image showing DatoCMS connection](https://images.ctfassets.net/23aumh6u8s0i/2q5pODvevF2RKIFIioXwA7/80af80dd8942531f3919b926a60fc6a5/datocms-connected-2)

* Step #4 - Summary: After just a moment, we will be redirected to the "Summary" tab. Here we have a bunch of information. We see that the set up was successful, we see the link to our DatoCMS project, and we also see our newly created GitHub link. Click on "Finish" to be redirected back to our [Gatsby Cloud dashboard](https://www.gatsbyjs.com/dashboard/sites).

Once on our dashboard, we will see that our newly created project is building. Give it a couple of minutes. Once it finishes, we should see a green checkmark and a "Deployed in (deploy time here)". 

> Note: To double-check that the repo was created, go to the GitHub account that was connected to Gatsby Cloud and go to "Repositories". There we will see our newly created repo!

### Quick recap!

So far, we have done the following:

1. We have created a GitHub repo that has all of our Gatsby code.
2. We have stored our data into DatoCMS, a headless CMS.
3. All of this is built as a static site via Gatsby Cloud.

This is a portfolio we are building, so we want to show off projects that we have built. Let's see how this is done!

## Updating Data in DatoCMS

All of our data lives in DatoCMS; let's go update it! We'll head on over to our [DatoCMS dashboard](https://dashboard.datocms.com/projects) and update an item.

![DatoCMS Dashboard view](https://images.ctfassets.net/23aumh6u8s0i/7Dxw3Q4Qk639dCLnOlwtDE/b2c7ea90b527b49ad104e737883b0775/datocms-dashboard-2)

Click on the project that we created earlier. In our case, we named it "jamstack-portfolio", so we should see that name in our list of projects. At the top of the page, we will see a button that says "Enter project", click on that.

Once we see the words, "Hello Admin!", we can update any of the data from there. 

Let's click on "Works". Here we are looking at the list of "Portfolio Items" that are viewed on our website. "Flyer 1", at the top of the list, happens to be one of the auto-generated items that we can go in and update. Let's go ahead and click on "Flyer 1", and we can update most everything on it. The title, the images, the content, anything! For this example, let's change the following:

* Title
* Cover Image
* Excerpt

It should look like this:

![Updating title, cover image, and excerpt in DatoCMS](https://images.ctfassets.net/23aumh6u8s0i/2JlsTnvqgWtGHmmRHGMYNU/2a464502f46937a8331da4e22eb5d235/editing-data-2)

Once we have updated all the things we want to, let's hit "Save" in the upper righthand corner of the page.

## Checking for Updates on Gatsby Cloud

Let's head on over to our [Gatsby Cloud dashboard](https://www.gatsbyjs.com/dashboard/sites), click on "jamstack-portfolio", and see how our site is doing. We are going to be double-checking that our changes were saved.

We should see our most recent deploy was run. If it's still running, make sure to let it finish deploying. There is a "Trigger build" button if needed, but we should not have to do that.

Once finished, click on the extremely long URL provided.

![Gatsby Cloud URL](https://images.ctfassets.net/23aumh6u8s0i/3EIgYLUq40xG6YmacWC4Ga/ad3908d16356d14431bf4fe353dda3d8/gatsby-url-2)

This URL shows a live version of our website! And we see that our content was updated in DatoCMS.

![Website homepage view](https://images.ctfassets.net/23aumh6u8s0i/4HICothDiKL3rp54ikmIDa/e72460f6ae47805f1914435a1356d8d3/previewing-site-2)
    
## Working on the Project Locally

Now that we have almost everything set up let's chat about adding other things to our website. If we wanted to do more than update the data we have set up through DatoCMS, we would clone the repo from GitHub, and open up our project in [VS Code](https://code.visualstudio.com/) or our editor of choice and do it there. Some of the things we could do are:

* Change the layout
* Change fonts or color
* Create a custom theme
* Create new types of pages
* Add in authentication
* Add more plug-ins for SEO purposes

We can find instructions in the `README.md` of the repo that was created for us. Once open in our editor of choice, run the following commands:

```bash
yarn install
```

> Be sure to have `yarn` installed. We can also use `npm` command instead.

We are going to want to create a `.env` file so we can store our token. This token is so we can get read-access from our DatoCMS project into Gatsby Cloud:

```bash
echo 'DATO_API_TOKEN=abc123' >> .env
```

To get that `DATO_API_TOKEN`, go to our [Gatsby Cloud dashboard](https://www.gatsbyjs.com/dashboard/sites), click into our project, and then click on "Site Settings". Once in there, click on "Environment variables" under "General" in the lefthand menu. There we will see "Build Environment variable" and a `DATO_API_TOKEN` that is starred out. If we click on "Edit" we will see the full token that we want in our `.env` file.

![Dato API Token view in Gatsby](https://images.ctfassets.net/23aumh6u8s0i/4kMwZW23Lt70AWu1Uj68yN/f5279cff29be6eef8a16367fb20a7315/dato-api-token-2)

To run the project locally in development mode, run the command:

```bash
yarn develop
```

To build the final static website, run the command:

```bash
yarn build
```

Again, all of this is in the `README.md` of our GitHub repo.

## Authentication with Auth0

Once inside VS Code or our editor of choice, we are going to be able to add authentication to our Gatsby site. There is an amazing blog post by [Sam Julien](https://auth0.com/blog/authors/sam-julien/) on [Securing Gatsby with Auth0](https://auth0.com/blog/securing-gatsby-with-auth0/).

This blog post will give you a step-by-step on how to secure a Gatsby site. We will need to <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account and we can do that here</a>. 

Auth0 will take care of the authentication process and give users a seamless experience.

## Deploy to Netlify

The URL that we were using earlier is extremely long and confusing; let's make it more readable. So to take care of that, let's deploy to Netlify.

Let's head back to our [project's dashboard in the Gatsby Cloud](https://www.gatsbyjs.com/dashboard/sites). Here we will see the URL that we clicked on earlier and above that is a banner that says, "Setup hosting". In that same banner, we see, "Do it now". Click on that.

We will see a list of different hosts that we can deploy to and we'll do the following steps:

1. Click on "Connect" that is next to Netlify. 
2. The "Netlify Integration" will appear, and we will want to click on "Connect". 
3. A Netlify login modal will popup, and we will want to log in here. 
4. We will then have to "Authorize" Gatsby Cloud for permission to our Netlify.
5. Our Netlify deployment site name will be auto-generated. We can change that if we want, but we'll just keep it that name for now. We will also want to select which Netlify team to add the site to. Then click on "Create":

![Create a new Netlify deployment site view](https://images.ctfassets.net/23aumh6u8s0i/354J3QxTRQ30re9eJGpHjz/8404ec39a4d838244259fdfb60e54140/deploy-netlify-2)

> Note: Remember that each Netlify Site name needs to be unique. Use the unique name that was used in your project.

Return to our [Gatsby Cloud dashboard](https://www.gatsbyjs.com/dashboard/sites) for the project and trigger a build. Once that is done, we can now visit our newly deployed website with our new URL, "unique-site-name.netlify.com.

![Final view of the deployed website homepage](https://images.ctfassets.net/23aumh6u8s0i/7bvVZtFySKmvBtjdnn0mS0/f79ca4059f9b350a4a42ebf5e324c234/deployed-site-2)

Yay!

<include src="asides/AboutAuth0" />

## Conclusion

Looking back, we can see the power of JAMstack, and how putting a couple of different resources together, it can create a dynamic site. By utilizing Gatsby Cloud, DatoCMS, and Netlify, we can create and deploy a website.

Feel free to make this your own and dive into the code and do custom styling or take that next step and authenticate the site. By having this foundation and understanding of JAMstack, we can create just about any website.

What is your favorite part of JAMstack? Which resources are your favorite? Let us know in the comments below!

---


Build a JAMstack App with Gatsby Cloud, DatoCMS, and Netlify

Leading professional services provider to integrate Auth0 for digital transformation initiatives



**BELLEVUE, Wash. – February 26, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that [Cognizant](https://www.cognizant.com/) (Nasdaq: CTSH) has joined its [Partner Program](https://auth0.com/partners) and will use Auth0 as one of its main authentication providers for any of its customers’ identity management needs. Ranked 193 on the Fortune 500 list with nearly 300,000 employees, Cognizant is an integral partner in transforming global enterprises’ business, operating, and technology models for the digital era.  

“Cognizant’s broad portfolio of consulting, professional, and managed security services are designed to help our clients around the globe to meet their security challenges,” said Ryan Parthasarathy, Vice President of Cognizant Security. “Given the complexity of identity management, we’re proud to partner with a global expert and game-changer in the CIAM space to enhance our security offerings and deliver only the best for our customers.”

Known for its highly-scalable platform, Auth0 was recently ranked as a [Leader for CIAM](https://auth0.com/blog/auth0-named-a-leader-in-the-g2-winter-2020/) on G2, the world’s leading business solutions review website. With high-velocity growth and more than 9,000 customers worldwide, Auth0 is answering the demand for identity management with a simple, extensible, and powerful solution for any application, for any audience.

“We’re thrilled to partner with Cognizant, an experienced leader in complex identity projects, and combine our teams’ expertise with our extensible, flexible, and trusted platform to aid Cognizant customers in a successful and secure digital transformation journey,” said Bill Lapcevic, VP of business development of Auth0. “Identity management is a critical and complex step in any transformation process, and a strong CIAM system will help customers modernize their business in a quicker and more organized fashion to address identity and security needs.”

Learn more about the [Auth0 Partner Program here](https://auth0.com/partners) along with the recent [growth of Auth0’s global partner network](https://auth0.com/blog/auth0-partner-program-accelerates-global-growth/), now serving more than 60 partners worldwide.

For more information about Cognizant Security, please visit [www.cognizant.com/security](https://www.cognizant.com/security).

<include src="asides/AboutAuth0" />

### Media Contacts
Kaycie East<br>
Auth0 Global Communications<br>
[press@auth0.com](mailto:press@auth0.com)<br>
 
Ryan Schin<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)<br>


Auth0 Expands Global Partner Network with Cognizant

Learn how to add authentication and authorization to gRPC for microservices in .NET Core.

Securing gRPC-based Microservices in .NET Core

Learn how to build efficient microservices in .NET Core 3.1 by leveraging gRPC.

Implementing Microservices with gRPC and .NET Core 3.1

Auth0 selected for meeting criteria and providing demonstrated market fit for AWS customers



**BELLEVUE, Wash. - Dec. 4, 2019 -** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, announced today that it has joined the Amazon Web Services (AWS) Partner Network (APN) Global Startup Program. The APN Global Startup is a unique “white glove” support and go-to-market (GTM) Program for selected startup APN Partners so that they can build on their AWS expertise, better serve shared customers, and accelerate their growth. To be selected for the APN Global Startup Program, [Auth0](https://auth0.com/) has to meet pre-defined criteria, including a clear, demonstrated product-market fit for an innovative enterprise tech product, be backed and recommended by a top-tier venture capital firm, and have a strategic commitment to building their cloud expertise.

The APN Global Startup Program enables qualifying startups to gain product design wins, visibility, exposure, leads, and commercial opportunities made possible with exclusive APN resources and dedicated Startup Partner Development Managers (PDM) with deep AWS knowledge and startup business experience, that guide startups in their growth journey with AWS. By becoming an APN Global Startup Partner, [Auth0](https://auth0.com/) will receive benefits ranging from a tailor-made plan for mapping the startup needs and opportunities to a selection of AWS services and APN programs, promotion support to drive visibility and awareness around the startup offering, to resources for helping startups sell and deploy innovative solutions on behalf of AWS shared end-customers.

“Auth0 is honored to be part of the AWS Partner Network Global Startup Program. We look forward to taking advantage of the additional support and worldwide exposure they are providing as part of this program,” said Eric Snyder, senior director of partnerships at Auth0. “We are dedicated to being a valuable partner in the AWS network and providing the best identity management platform to all customers.”

Auth0’s universal platform provides out-of-the-box extensible identity management for customers of virtually any size, and any authentication or authorization needs. As a member of the AWS APN Global Startup Program, Auth0 will continue to help companies achieve their technology goals by leveraging the agility, breadth of services, and pace of innovation that AWS provides.

“[Working with Auth0](https://auth0.com/case-studies/chaossearch/) enabled us to deliver an SSO offering to the **CHAOS**SEARCH customers in a time frame that was impossible without them,” said Thomas Hazel, founder, and CTO, **CHAOS**SEARCH. “By choosing Auth0, we can meet our enterprise customer demand for federated identity in a simple and elegant deployment, allowing us to focus on the business value of our offering. The service was easy to implement and the team, from beginning to end, was exceptional.”

AWS is enabling scalable, flexible, and cost-effective solutions from startups to global enterprises. The APN is a global program helping partners build a successful AWS-based business, by helping organizations build, market, and sell their offerings. The APN provides valuable business, technical, and marketing support, to help startups achieve exponential growth. 

For more information on how AWS customers can have the quick, easily implemented identity solution they need for their specific application, please download the [Why Auth0 and AWS](https://auth0.com/resources/ebooks/aws-auth0-ebook) ebook.

<include src="asides/AboutAuth0" /> 

### Media Contacts <br>
Alex Plew<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com) <br>

Deepika Zafar<br>
Racepoint Global for Auth0, EMEA<br>
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com)<br>



Auth0 Joins the AWS Partner Network Global Startup Program

preston-lamb

Preston is a Software Developer at MotivHealth in Salt Lake City, UT, as well as a course author for Thinkster.io. His focus is mainly on Angular and JavaScript, and he loves to learn new things that help him to build better web applications. He also likes to share the things he learns through blog posts, video courses, and podcasts.

Software Developer at MotivHealth

Preston Lamb

Angular, Auth0, and Netlify are a perfect combination for creating, securing, and deploying your application.

Securing Angular Applications with Auth0 and Deploying to Netlify

ramiro

I am an internet guy who loves reading and asking questions—those are the two things that helped me the most as an autodidact 🤓. If I am not learning about the latest trends in digital marketing or listening to house music, you can probably find me watching a tennis tournament. And also, I manage Social Media at Auth0 ✌️

Manager, Social Media

Ramiro Nunez Dosio

Explore the complexities of authentication and how to solve them on this stream from .NET Conf 2019.



.NET Conf 2019 was an exciting and unique event that took place this year from September 23 — 25. It is a free, 3-day virtual conference co-organized by the .NET community and Microsoft. Anyone with an Internet connection was able to attend.

## .NET Conf 2019: A Virtual Conference

This year the conference saw the [launch of .NET Core 3.0](https://auth0.com/blog/exploring-dotnet-core-3-whats-new/), offered prizes to attendees such as free Xbox One X consoles, and hosted talks from a world-class lineup of speakers from Microsoft and the community.

Our own [Developer Advocate Engineer Bobby Johnson](https://auth0.com/blog/authors/bobby-johnson/) gave a talk focused on exploring how the username-password strategy got so complicated over time. Bobby shows you how overwhelming it can be to take your first step beyond username and password-based authentication strategies, which are the default authentication strategies offered by most full-stack web application frameworks.

Social logins, Identity Providers, OAuth 2.0, LDAP, SAML, OpenId Connect; all can be confusing. What does it all mean? How did we get here? Watch Bobby's talk to find out:

<AmpContent>
  <amp-iframe width="480" height="270"
    sandbox="allow-scripts allow-same-origin"
    layout="responsive"
    frameborder="0"
    src="https://www.youtube.com/embed/ga3u_4B7_Bw?start=69">
  </amp-iframe>

</AmpContent>

<NonAmpContent>

  <iframe width="560" height="315" src="https://www.youtube.com/embed/ga3u_4B7_Bw?start=69" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/bobby-johnson.png" name="Bobby Johnson" title="Developer Advocate Engineer" team="Technical Experience" location="Washington, United States" body="Attending .NET Conf 2019 and collaborating with the Channel 9 team was an awesome experience. They were very professional and the event ran like clockwork."/>

The organizers have made all the sessions available [on-demand on YouTube](https://www.youtube.com/user/VisualStudio). Be sure to check them out.

## More Resources

- [.NET Conf 2019 Official Site](https://www.dotnetconf.net/)

- [Bobby's Twitch Channel](https://www.twitch.tv/iamnotmyself/): Streams three times per week!

- [The Live Coders' Twitch Channel](https://livecoders.dev/): Enthusiastic streaming developer community with members who participated in .NET Conf 2019 as organizers or attendees.

- [Exploring .NET Core 3.0. What's New?](https://auth0.com/blog/exploring-dotnet-core-3-whats-new/)

- [Building and Securing Web APIs with ASP.NET Core 3.0](https://auth0.com/blog/how-to-build-and-secure-web-apis-with-aspnet-core-3)

## Aside: Securing ASP.NET Core 3.0 with Auth0

Authentication and authorization are hard but securing ASP.NET Core 3.0 applications with Auth0 is easy and brings a lot of great features to the table. With [Auth0](https://auth0.com/), you only have to write a few lines of code to get solid [identity management solution](https://auth0.com/user-management), [single sign-on](https://auth0.com/docs/sso/single-sign-on), support for [social identity providers (like Facebook, GitHub, Twitter, etc.)](https://auth0.com/docs/identityproviders), and support for [enterprise identity providers (like Active Directory, LDAP, SAML, custom, etc.)](https://auth0.com/enterprise).

<AmpContent>
<amp-youtube
    data-videoid="U3NDciLTTgI"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/U3NDciLTTgI" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

On ASP.NET Core 3.0, you need [to create an API in your Auth0 Management Dashboard](https://auth0.com/docs/apis) and change two things on your code. To create an API, you need to <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>. After that, you need to go to [the API section of the dashboard](https://manage.auth0.com/#/apis) and click on "Create API". On the dialog shown, you can set the _Name_ of our API as "Books", the _Identifier_ as "http://books.mycompany.com", and leave the _Signing Algorithm_ as "RS256".

![Creating API on Auth0](https://images.ctfassets.net/23aumh6u8s0i/EqGkwFxCdRtjWblGcRHo8/4d14728749a8c8db52447c6a4f62713d/creating-api-on-auth0)

After that, you have to add the call to `services.AddAuthentication` in the `ConfigureServices` method of `Startup`:

```csharp
string domain = $"https://{Configuration["Auth0:Domain"]}/";
services.AddAuthentication(options =>
{
  options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
  options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddJwtBearer(options =>
{
  options.Authority = domain;
  options.Audience = Configuration["Auth0:Audience"];
});
```

You also need to add an invocation to `app.UseAuthentication()` in the body of `Configure()` method of `Startup`.

And add the following element to `appsettings.json`:

```json
{
  "Logging": {
    // ...
  },
  "Auth0": {
    "Domain": "bk-samples.auth0.com",
    "Audience": "http://books.mycompany.com"
  }
}
```

> **Note** that the domain, in this case, **has to be changed** to the domain that you specified when creating your Auth0 account.


How Usernames and Passwords Got so Complicated

725ee191354be8a85ea104735c7f9264

Software Engineer, Open Source Enthusiast, Tactical & Stealth Gamer, Sport Shooter, Motor Biker, interested in InfoSec, AppSec, Linux, Cyberpunk.

Enterprise Solutions Engineer

Mathias Conradt

Discover how to set up and use German identity provider netID and integrate it using Custom Connections



## Purpose

The purpose of this sample project is to demonstrate how a web developer, using Auth0, can add the identity provider netID as an option for their end users to signup and login to their web applications.

![netID and Auth0 identity and authentication integration](https://images.ctfassets.net/23aumh6u8s0i/2rCEM5yhY3xoh4uYavsT0x/928c2056500c7ab57e2eb496577290e3/netid_splash-02)

[Photo by Daria Nepriakhina on Unsplash](https://unsplash.com/photos/_XR5rkprHQU)

## About netID

_**netID**_ is a European identity provider.

The European netID Foundation was founded in March 2018 by Mediengruppe RTL Deutschland, ProSiebenSat.1 and United Internet. Its aim is to establish the netID single sign-on as a European alternative to US providers. With netID, users can organize their consent to the use of internet services (opt-ins) transparently and in compliance with data protection regulations. To this end, the foundation has developed an open standard that enables users from all sectors to access all internet services of partners of the European netID Foundation with the same log-in. Right from the start which focuses the initial core market Germany, 38 million accounts covering roughly about 60% of the Germany online population are ready to be used.

- [https://netid.de/](https://netid.de/)
- [https://enid.foundation/](https://enid.foundation/)

Auth0 customers can add netID as a custom social connection alongside other social logins. netID is primarily an identity provider (IdP) focused on frictionless and secure login, rather than on bundling several services into one platform. This has security benefits, and gives consumers more visibility over how and where their data is shared. For these reasons, netID is an especially great option for companies in the DACH region (Germany, Austria, Switzerland) where consumers demand greater control of their personal information online.

## Creating a netID Service

### Prerequisites

We assume that you already have registered an Auth0 account and set up a tenant. If not, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>.

Also, we assume that you already have a client app setup in Auth0. If not, you can refer to the steps and screenshots [further below](#auth0-backend).

Furthermore, we assume that you have already registered a service provider account at netID. If not, [register a netID account here](https://developer.netid.de/register).

### netID configuration

To start, log in into the [netID Developer Portal](https://developerzone.netid.de/developerportal/index.html). Create a **Dienst** (service) for which you want to leverage the netID single sign-on. Select **Dienst** in the menu, click **Dienst hinzufügen** (Add service) and fill in the required details in the following screen. [Read the detailed documentation here](https://developerzone.netid.de/developerportal/dienste/dienst-anlegen.html#indexlink_help_developerportal_dienste) if you need further information.

A sample service could look like this, where the service domain (**Dienst Domain**) is the domain of your customer facing website. Also, links to data privacy information (**URL Datenrichtlinien**) and terms of usage (**URL AGB / Benutzungsbedingungen**) should be supplied:

![Creating a new netID service](https://images.ctfassets.net/23aumh6u8s0i/613X7O0cY0b684t0TopGDl/b2d30ff2f515fbb826ab06cb96437687/netid_create-service-00)

> Note: for testing purposes, you can actually enter any domain and URL values into this form, as they are not technically relevant in order to get the netID integration in Auth0 running

In the end, it should look similar to this:

![Reviewing the details in the netID developer](https://images.ctfassets.net/23aumh6u8s0i/2i1Ql13ESYhb8ZuNHHSTD8/f7625c39badb7588defa49a7ad65dfc7/netid_create-service-01)

Create a **Client** for this service by clicking on **Client hinzufügen** (Add client). [Detailed documation on how to do this](https://developerzone.netid.de/developerportal/clients/client-anlegen.html#indexlink_help_developerportal_clients) is available in the [netID Developer Portal](https://developerzone.netid.de/developerportal/index.html). It's critical to set the proper Auth0 callback URL for your tenant. The Auth0 Callback URL is `https://<tenant>.auth0.com/login/callback` where `<tenant>` needs to be replaced with your Auth0 tenant name.

Sample configuration:

![Sample configuration for a netID client](https://images.ctfassets.net/23aumh6u8s0i/4gDaCj5Acfwb2lrLi0PhVP/97d9dd32937d8247b16d0c80d5bd7abb/netid_create-client-sample)

> Note: the values here should be adjusted to your needs, especially "Callback URL", which needs to point to your Auth0 tenant and region

In the end, it should look similar to this:

![Creating a new netID client](https://images.ctfassets.net/23aumh6u8s0i/7J55Z734Wk0pArNqPALqPF/7129e9937cef20e4614fe972bc962406/netid_create-client-02-new)

Once the client is created it will initially run in a sandboxed mode, which means it can only be used with whitelisted netID-Accounts (email addresses).

In order to successfully run through the initial integration add a test user (email address) to the whitelist by selecting **Testnutzer hinzufügen** (Add Test-Account), outlined [on the developer portal](https://developerzone.netid.de/developerportal/testnutzer/testnutzer-anlegen.html). Up to 10 accounts can be whitelisted per sandboxed client.

Finally, find the **Client ID** and **netID Token - Sandbox** (later referred to as **client secret**) for the Auth0 configuration by expanding the client details, as shown in the following image:

![Viewing the client details of the netID app](https://images.ctfassets.net/23aumh6u8s0i/5yvbhrEWwtzyJFNnIQJlRk/5b8a29361be8247ef3f3e49618c6e765/netid_client-details-01-new)

## Creating a Custom Social Connection in Auth0

To configure Auth0, start by logging in to the [Auth0 Dashboard](https://manage.auth0.com/dashboard). Then, go to **Connections > Social** in the Auth0 Dashboard, scroll to the bottom, and click **Create Custom**.

Next, enter the following values into the configuration screen that appears:

**Connection Name**: `netID`

**Authorization URL**:

```
https://broker.netid.de/authorize?claims={"userinfo":{"birthdate":{"essential":true},"gender":{"essential":true},"email": {"essential":true},"email_verified": {"essential":true},"given_name": {"essential":true},"family_name":{"essential":true}}}
```

> Note: In this URL, you notice the explicit parameter `claims`. This parameter tells Auth0 which claims to ask for from netID. **Please note** &mdash; netID will ignore any data requested via standard scopes (_name, address, ..._) as well as optional/voluntary claims.

netID supports the following claims:

- `gender` &mdash; the gender of the end user
- `given_name` &mdash; first name(s) of the end user
- `family_name` &mdash; Last name(s) of the end user
- `birthdate` &mdash; Date of birth of the end user
- `email` &mdash; email address of the end user
- `email_verified` &mdash; verification status of the email address of the end user
- `address` &mdash; the end user's address
- `country` &mdash; country of the end user's address

You can adjust the claims parameter according to your needs.

**Token URL**: `https://broker.netid.de/token`

**Scope**: `openid`

**Client ID**: `<enter the ClientID you retrieved from netID>`

**Client Secret**: `<enter the Client Secret you retrieved from netID>` (previously referred to as **netID Token - sandbox**)

Copy the following JavaScript snippet into the **Fetch User Profile Script** box:

```javascript
function(accessToken, ctx, cb) {
  request.get('https://broker.netid.de/userinfo', {
    headers: {
      'Authorization': 'Bearer ' + accessToken
    }
  }, function(e, r, b) {
    if (e) return cb(e);
    if (r.statusCode !== 200) return cb(new Error('StatusCode: ' + r.statusCode));
    var profile = JSON.parse(b);
    cb(null, {
      name: profile.given_name + ' ' + profile.family_name,
      family_name: profile.family_name,
      given_name: profile.given_name,
      email: profile.email,
      email_verified: profile.email_verified,
      birthdate: profile.birthdate,
      gender: profile.gender,
      user_id: profile.sub
    });
  });
}
```

### Authorization header

Since netID requires _Basic Authentication_ for authentication, but custom social connections submit the credentials via post body per default, we need to create a custom header for the Authorization and add it to the configuration.

The hash is created by base64-encoding the `clientID` and `clientSecret` concatenated with a `:`. So the pseudo code to generate this would be:

`base64encode(clientId + ":" + clientSecret)`

An [online base64 encoding tool](https://www.base64encode.org/) can also be used to construct this value.

The full header is then constructed as per the [standard authorization header format](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization), setting the type to `Bearer`:

```
{
  "Authorization": "Basic <your base64-encoded token string>"
}
```

You can try out the connection by pressing the **Try Connection** button and, upon success, get a screen like this:

![Testing out the custom social connection](https://images.ctfassets.net/23aumh6u8s0i/2al4mPP0I9ZPMCwdJfSXRP/a82ea4c443fb069b2c4abe18aa57e3b4/netid_config-02)

Under the **Applications** tab, make sure that your client/application is enabled for this custom social connection.

Finally, adjust the **Universal Login Page** configuration and add a few lines of custom CSS to make the netID button appear with the respective logo and coloring. To do this, navigate to the [**Universal Login Page > Login Page** configuration](https://manage.auth0.com/#/login_page) and enable the **Customize Login Page** checkbox. Adjust the source code of the login page replacing the `theme` section in the JSON object with the following lines:

```js
theme: {
  logo:            config.icon,
  primaryColor:    colors.primary ? colors.primary : 'green',
  authButtons: {
    "netID": {
      displayName: "netID",
      primaryColor: "#74b82b",
      foregroundColor: "#fff",
      icon: "https://raw.githubusercontent.com/auth0-blog/auth0-netid-sample/master/img/favicon_trans.png"
    }
  }
},
```

Before:

![The code for the custom login page, before the change is made](https://images.ctfassets.net/23aumh6u8s0i/4fAXiCwgsRc8AdCzv5zd8u/5da7ab28832578872f1002b2877df832/netid_login-page-before)

After:

![The code for the custom login page, after the change is made](https://images.ctfassets.net/23aumh6u8s0i/4uEXHaZk1nO2mQUJ70TytY/6f0baed1947dbb2f54d3df46fdad68d3/netid_login-page-after)

## The Authentication Flow

### Screencast

For more context, you can view the following screencast of the authentication flow to get a better idea of how the integration with netID works:

<iframe width="560" height="315" src="https://www.youtube.com/embed/kY5Wu9FNQ8Y" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

### Authentication

When pressing the login button within the client application, Auth0 provides a login/signup widget with options to login/signup via username and password or via social logins, such as netID.

![Auth0 login screen with netID as a custom social connection](https://images.ctfassets.net/23aumh6u8s0i/69Cyef57ukleYtPp26FrjK/1281c86c93ee9548640695c354c5a037/netid_auth-01)

When choosing netID (we're assuming the end user already has an account at netID), the user will be asked to log in at netID, providing an email address.

> Note: if your client is running in sandboxed mode, as described here, it will only function with the whitelisted email addresses

![The netID login screen](https://images.ctfassets.net/23aumh6u8s0i/7bIMhHWXIhALpVi6cmO5Gl/4340eab10878885b503439f1c11efa37/netid_auth-02)

They will also need to provide their password:

![The netID password entry screen](https://images.ctfassets.net/23aumh6u8s0i/6jS5kZLe5rByfns4J11Ua2/f3f46538668e11338ce89e64792524be/netid_auth-03)

Upon successful login, they will be asked to give consent to netID to grant Auth0 access to their personal information:

![The netID personal information consent screen](https://images.ctfassets.net/23aumh6u8s0i/6qpyibpxShK5AYj03M9p6W/5dbdb7de076d3e8c35e37756dfc9dd60/netid_auth-04)

Furthermore, the demo client asks for consent to access the Auth0 tenant:

![The Auth0 consent screen](https://images.ctfassets.net/23aumh6u8s0i/48oJiahShr5bVO2fTNZ093/1694a5b2c38d2813393be6158efcda25/netid_auth-05)

After consent is given, the browser redirects to the application, having received an ID token and information about the user:

![Logged into a demo app using netID](https://images.ctfassets.net/23aumh6u8s0i/7k0wipMlKPaMB8wXYaZn36/be3ae0e27ac33ad6b9a4993d4ee24a71/netid_auth-06)

## Client App Creation in Auth0

In our example, we chose a **Single Page Application (SPA)** based on **Angular** delivered from a Node.js web server. You can choose any other technology stack as well though. In our case, the client application is created and configured as follows in the Auth0 backend:

1. Create the application by going to the **Applications** section in the dashboard and click the **+ Create Application** button.
   ![Creating a new Auth0 application](https://images.ctfassets.net/23aumh6u8s0i/1axrPu0RywAPmw2XW1zvEn/cee0b91b909cb19d95e62c9f97e8af65/netid_applications-create)
2. Next, give the application any name you like and choose **Single Page Web Application** as the type.
   ![Choosing an Auth0 application type](https://images.ctfassets.net/23aumh6u8s0i/i4uUaBNPyAx2QMlQ8TNhy/b611109b1917096e704310d3a0f4fd2a/netid_app-quickstart-01)
3. Next, choose **Angular** as the technology.
   ![Choosing a technology type](https://images.ctfassets.net/23aumh6u8s0i/1aeo8vqDfCu4JXWYN4q5DL/0a5705bc7ea5c5a772b874b46775af16/netid_app-quickstart-02)
4. Afterwards, you're given the choice to either integrate Auth0 into an existing app, or download a complete sample. Choose the latter and download the ZIP file.
   ![Angular quickstart page](https://images.ctfassets.net/23aumh6u8s0i/4kWcfmuXfKbJNiolIwRlf8/6faae6c438a390dc2fd5c6424ac709d7/netid_app-quickstart-03)
5. Download and unzip the file anywhere on your computer. Then, enter a local terminal window and switch to the folder where you extracted the project into.

To build and run the project, enter:

`npm install`

followed by

`npm start`

This should spin up a local Node.js web server, making the application available at [`http://localhost:3000`](http://localhost:3000).

Returning to the Auth0 dashboard, click the **Settings** tab of the app.

In the application settings:

- set **Application Type** to "Single Page Application".
- set **Allowed Callback URLs** to `http://localhost:3000/callback`
- set **Allowed Logout URLs** to `http://localhost:3000`

![Configuring the Auth0 application](https://images.ctfassets.net/23aumh6u8s0i/6WcPdXxzG1gT067PmKFR6p/f463cd808e252fd69991c5a1a353abe7/netid_auth0-app-settings)

As for the connections, click the **Connections** tab at the top of this page to enable any (other) connections that you want enabled besides **netID**. Note that custom social connections don't show on this screen, they are configured and within the **Custom Social Connections** extension itself. In our example, we chose to also offer authentication via **Username-Password-Authentication**, **facebook** and **google-oauth2**, besides **netID**, thus the respective switches are enabled.

![Configuring app connections](https://images.ctfassets.net/23aumh6u8s0i/3G3jKZ5VPR0n51YZjjQtGo/2e51513ac148e30f1b6e26f4aad9786c/netid_auth0-app-connections)

In the end, the application is listed in the **Applications** overview:

![The Auth0 application registered in the dashboard](https://images.ctfassets.net/23aumh6u8s0i/6J44Uf75tIp0ZE5UQdLUnZ/03232fb39dfeaf774eee2ca9cb59c711/netid_auth-07)

Once a user has gone through the process of logging into their app using Auth0 and netID, the user information can be inspected within the Auth0 dashboard by expanding the **Users & Roles** menu item on the left, and then choosing **Users**:

![The users that have registered with the sample app](https://images.ctfassets.net/23aumh6u8s0i/6GrJ1shfzzbpKC0W08NrWn/0740be76057ce5f10f68b2397fffa321/netid_users-01)

The user's primary identity provider is shown as `oauth2`:

![Viewing detailed information about the registered user](https://images.ctfassets.net/23aumh6u8s0i/4zCj9DeRH9QOM5fjKyg2hQ/b6f66034b30ae57d7ba7a6f2326dafb8/netid_users-02)

and the raw JSON of this user contains the netID identity of the user:

![Viewing raw JSON information about the registered user](https://images.ctfassets.net/23aumh6u8s0i/1LGS9ZCwgbvyIynjppoEun/652a08cfe203d9c80791aba0e459f495/netid_users-03)

### netID backend

The **Meine Daten** (My Data) section for the user within the netID backend:

![The netID "My Data" page](https://images.ctfassets.net/23aumh6u8s0i/4hDziEEJ8yVEk4ZmVfeqlV/5c5b2a949b0d99be1eab946efad11708/netid_my-data)

The user can see an overview of the approved applications/services under **Meine Dienste** (My Services):

![The netID "My Services" page](https://images.ctfassets.net/23aumh6u8s0i/7Ltkxj0vykjZ8PSxvSLVdV/6ecf9bba29b7a901611bb643f836b935/netid_my-services)

The user can always review and revoke their consent that grants the service access to their personal information:

![Revoking consent for the service to access personal information](https://images.ctfassets.net/23aumh6u8s0i/1PJXEAhS2ZOiIKvLOX3L2k/1a4c0e65c7adba9859df446496bd55ea/netid_revoke-service)

## Recap

In this post, you learned how Auth0 can help you add the German identity provider netID as an option for your end users to sign up and login to your web application. You saw how to configure netID as an Auth0 Custom Social Connection and supply all the necessary details to integrate with a netID application. Finally, we showed you a sample login process, and how user data can be inspected both on the Auth0 side, and within the netID portal.


netID Integration Using Custom Connections

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Constantly test new technologies, monitor user behavior, and maintain secure networks to reap the full rewards.



While humans traditionally have staffed assembly lines, prepped and served food, and entered data into spreadsheets — more and more, machines are taking over these tasks. Although we're far from seeing robots at work that dominate entire professions, organizations are beginning to realize value from integrating intelligent machines into day-to-day operations. Small fixes like allowing machines to [prep tax forms](https://www.teampay.co/insights/finance-jobs-taken-by-robots/) or support with [revenue recognition](https://www.zuora.com/2018/05/31/the-art-and-science-of-revenue-automation-practical-lessons-for-automating-revenue-under-asc-606/) can speed things up during crunch time and allow employees to do more creative and complex work.

With advances in workplace automation come a new set of security concerns. Interconnected devices and systems mean that an attack in one location can have ripple effects across an entire company. A [data breach](https://auth0.com/blog/what-is-a-data-breach/) in one factory, for example, could halt processes across several plants. If cyberthieves illegally access patient records, they have the power to tamper with patients' medical devices and buy prescription drugs in their name.

This piece highlights three major examples of workplace automation and the ways team leaders can enhance the security of these systems to mitigate their risks.

## Warehouses: Peeking Under the Hood of Amazon

When people think of robots, they don't often think of warehouses and inventory turnover. Amazon is changing this. In 2014, Amazon began rolling out robots at work to automate and speed up processes in its warehouse facilities.

The company has more than [700 distribution facilities worldwide](http://www.mwpvl.com/html/amazon_com.html). At the height of last year's holiday season, Bisnow reports that some of Amazon's warehouses delivered [more than 1 million](https://www.bisnow.com/national/news/industrial/how-amazon-prepares-for-the-holiday-delivery-rush-81726) items per day.

![Amazon's RoboStow](https://images.ctfassets.net/23aumh6u8s0i/2IYft6NC5lAjSqy0JCkNQ8/8f702a74fe3b41e6ac4341f7789c191a/automated)

[Amazon's RoboStow](https://press.aboutamazon.com/images-videos)

RoboStow, one of Amazon's most powerful robots, weighs a whopping six tons and can move pallets of products over twenty feet high across a warehouse floor. This drastically reduces the physical labor and risk for Amazon's human employees. With its enormous capacity, RoboStow has helped Amazon store [50% more inventory](https://money.cnn.com/2016/10/06/technology/amazon-warehouse-robots/index.html) over the last five years and reduce the human labor portion of shipping to just [one minute](https://money.cnn.com/2016/10/06/technology/amazon-warehouse-robots/index.html) per package.

The results have also corresponded with a boost to Amazon's finances. According to a Slice Intelligence report, cited in The Wall Street Journal, in 2017 the company [retained 42 cents of every dollar spent online](https://www.wsj.com/articles/how-amazon-can-make-or-break-holiday-retail-1511265601), up from 38 cents in 2016. This highlights improvements in the company's ability to cut costs and overall operational efficiency.

Despite the hype around RoboStow, the machine isn’t 100% secure. While new robots may appear like they’re bulletproof, in reality they’re subject to many of the same flaws as other devices connected to the internet.

One [recent study](https://ioactive.com/robots-want-bitcoins-too/) by IOActive highlighted how their research team was able to steer several of Softbank’s robots meant for telecommunications to curse at people instead. They did this by injecting ransomware into the robot’s system through a public Wi-Fi network. Since many robots store valuable data (even if they’re simply transmitting it to a different endpoint), the team also revealed how hackers might access a robot’s software remotely, freeze it, and force the robot’s handlers to deliver something of value (e.g., money or other sensitive data) before unlocking it again.

In 2017 IOActive found nearly [50 vulnerabilities](https://ioactive.com/robots-want-bitcoins-too/) through which hackers could command popular commercial robots remotely. For Amazon and other companies that employ robots for physical labor in their warehouses, the dangers to human employees if a robot is hijacked or malfunctions could be severe.

While there is no single solution for fully securing machines like RoboStow, applying the same techniques used to [secure other mobile devices](https://auth0.com/blog/ten-mobile-security-threats-and-what-you-can-do-to-fight-back/), such as unique and complex passwords, employee education, and keeping systems updated goes a long way towards deterring dishonest users.

## Factory Robots Exposed via Routers

The epitome of monotonous (and often hazardous) labor — factory work is a popular target for workplace automation.

Today, Japan-based FANUC is leading the way with a factory that builds industrial robots for sectors as diverse as transportation and big pharma.

![Industrial Robots](https://images.ctfassets.net/23aumh6u8s0i/5u8tKWzuaPWA28wWLBfM1L/40a3a017f2895841b7f0ff1a1f632ac1/automated)

Source: [FANUC](https://www.fanuc.eu/fr/en/robots)

[Nearly 80%](https://www.bloomberg.com/news/features/2017-10-18/this-company-s-robots-are-making-everything-and-reshaping-the-world) of FANUC's assembly work is automated. [According to the company](https://www.bloomberg.com/news/features/2017-10-18/this-company-s-robots-are-making-everything-and-reshaping-the-world), human engineers complete only the wiring portion of the finished robots. That helps cut the costs of production dramatically and expands FANUC's margins.

Yet even this cutting-edge team isn't safe from cybercrime. Last year, researchers found that [over 80,000 industrial routers were exposed](https://www.darkreading.com/vulnerabilities---threats/researchers-hack-industrial-robot-/d/d-id/1328790) on the public internet, including those of FANUC. Industrial routers underlie remote networks and devices and support automation at many levels, yet despite their outsized importance, this research found that several of these devices didn't even require authentication.

[Authentication](https://auth0.com/docs/getting-started/overview) is critical to building a secure company foundation. Without it, organizations aren't able to verify the identities of its users —including employees, consultants, and customers. Without authentication, it's a cinch for a dishonest user to sneak in and steal company secrets.

At FANUC or another manufacturer with connected devices, a breach in one location could have widespread consequences across operations. As a company decision-maker, it's critical to constantly test for holes and patch and upgrade your systems to ensure that they're able to withstand increasingly numerous and complex threats.

## The Automated Workplace of McDonald's

Restaurants and food service have some of the more visible examples of automation. A robot barista Cafe X, for example, recently opened up shop in San Francisco.

![Robot Barista CafeX](https://images.ctfassets.net/23aumh6u8s0i/3VC1VT1WQ9iDbmtXwdTj4I/b20c9a7437703161633051e9b7b99ec5/automated)

[Image Source](https://www.youtube.com/watch?v=t4r6nAkav9o)

Robots have also been spotted [flipping burgers](https://www.usatoday.com/story/tech/talkingtech/2018/05/28/hamburger-making-robot-flippy-back-serving-300-burgers-day/649370002/) and [delivering meals](https://www.npr.org/sections/alltechconsidered/2017/03/23/520848983/hungry-call-your-neighborhood-delivery-robot).

On a large scale, McDonald’s has boosted workplace automation by installing thousands of ordering kiosks. The company is aiming to install kiosks in [_1,000 stores_](https://www.cnbc.com/2018/06/04/mcdonalds-to-add-self-order-kiosks-to-1000-stores-each-quarter.html) each quarter until its entire network is complete.

![McDonald's Ordering Kiosk](https://images.ctfassets.net/23aumh6u8s0i/1Ia8lLIiQuLScjPcHK4IIy/a0d5e23154170cbc02f03bf9a6f49276/automated)

[Source](https://www.businessinsider.com/mcdonalds-kiosk-vs-cashiers-photos-2018-3#the-beauty-of-the-kiosk-really-is-customization-making-your-order-the-way-you-want-it-on-here-is-much-easier-than-repeating-what-you-want-to-a-cashier-several-times-just-hit-the-customize-button-after-youve-chosen-the-item-you-want-and-go-from-there-9)

At the kiosk, customers can customize their meal — easily adding toppings and viewing nutritional information, such as calories. This reduces lag time in speaking with an employee at the cash register. McDonald's has also figured out how to present menu options on these digital screens in a more tantalizing format. They noted that customers spend an average of [_30%_](https://www.pymnts.com/restaurant-technology/2018/mcdonalds-kiosk-strategy/) more when using automated kiosks.

These kiosks certainly aren't immune to hacks. Last year, someone breached a McDonald's kiosk in Australia and removed [$4.70 from their order.](https://www.kioskmarketplace.com/articles/how-vulnerable-are-kiosks-to-hacking/) This might seem like a fun prank; however, the implications for customers and for the company's operations are more dire. If a hacker can access order histories, it’s likely they can also view customer names and credit card information.

Even in common products like ordering kiosks, being able to control users' navigation and access historical behaviors on the platforms are critical to figuring out where there might be holes.

## New machines, similar security problems.

Despite their allure, robots at work have many of the same vulnerabilities as other pieces of hardware — and workplace automation falls prey to holes in unsecured networks. In the worst case scenario with robots, cybercriminals could exploit weak points to control their movements and cause harm to human employees or a company's operations. At the other end of the spectrum, stealing a few dollars by breaching ordering kiosks still underscores larger risks of personal data theft.

An interconnected workplace —with systems that help ease time-consuming, costly, and low-value work —can be an enormous asset. Learning from leaders in the field is a great place to begin. Understanding where they've fallen short will help your organization go one step further and create an even stronger foundation on which to grow.

<include src="asides/AboutAuth0" />

---


Staying Safe in the Automated Workplace

a8912bdc06ed413351524360cc642cf2_400x400 avatar

a8912bdc06ed413351524360cc642cf2_400x400

Guest Author

Peter Shaw

Learn about Nancy, an open-source and lightweight alternative to the ASP.NET MVC framework.

Meet Nancy, a Lightweight Web Framework for .NET

Auth0 CISO Joan Pepin to speak Women Who Code Portland’s Networking Night + leadership advice video.



Want to know what it takes to be a successful woman in infosec?

Join us at [Women Who Code Portland’s Networking Night](https://www.meetup.com/Women-Who-Code-Portland/events/253324140/) on Thursday, Aug. 16 from 5 - 8:30 p.m. to hear what this group of notable women have to say about how they got into InfoSec, what their roles are like, and advice for someone breaking into the field. (Special thanks to sponsor [Mozilla](https://www.mozilla.org/en-US/).) The panel will include:

- **Joan Pepin** , Chief Information Security Officer (CISO) and VP Operations, Auth0
- **LJ Johnson** , Sr. Director, Information Security, Nike
- **Miki Demeter** , Security Researcher, Intel
- **Moderator:** Ann Wallace, Technical Cloud Consultant, Google

Recently, Joan expanded her Auth0 CISO role, adding VP of Operations to her title. As a preview, we asked her to offer some leadership advice for people stretching into new roles:

<AmpContent>
<amp-video controls
  layout="responsive"
  width="480" height="270">
  <source src="https://cdn.auth0.com/blog/videos/joan-pepin-leadership-advice.mp4"
    type="video/webm" />
</amp-video>

</AmpContent>

<NonAmpContent>

<video controls="controls">
  <source src="https://cdn.auth0.com/blog/videos/joan-pepin-leadership-advice.mp4">
   Your browser doesn't support HTML5 video. Here is a <a href="https://cdn.auth0.com/blog/videos/joan-pepin-leadership-advice.mp4">link to Joan Pepin Leadership video</a> instead.
</video>

</NonAmpContent>

<include src="TweetQuote" quoteText="Stretching into a new role? Here’s some advice from @CloudCISO_Joan — and an opp to hear her in person in Portland this week! #WWCode"/>



Auth0 CISO Joan Pepin to Speak at WWC Portland Networking Night

krti_XnE_400x400

At Auth0 we ❤️ developers. Serving & giving back to the community is one of the most rewarding things we do. We want to empower others to join the mission!

Auth0 Ambassador

ngVikings brought the European Angular communities to Espoo, Finland for two days of networking and learning.



A big part of being an [Auth0 Ambassador](https://auth0.com/ambassador-program) and Evangelist is attending and speaking at conferences all over the world. Our ambassadors attend a very diverse set of events ranging from technology-specific conferences, like [Oracle Code](https://developer.oracle.com/code), to technology agnostic conferences like [CodeMash](http://www.codemash.org/), and everything in between.

The **Conference Recap** series will summarize our experiences at the various conferences we attend, sharing the big news, things we learned, things we liked, and more. We’ll kick the series off with [ngVikings](https://ngvikings.org/).

<AmpContent>

[Watch "ngVikings 2018 &mdash; Highlights"](https://www.youtube.com/watch?v=-wVodWS-9OU)


</AmpContent>

<NonAmpContent>


<iframe width="560" height="315" src="https://www.youtube.com/embed/-wVodWS-9OU" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>


</NonAmpContent>

## ngVikings 2018

![ngVikings Venue](https://images.ctfassets.net/23aumh6u8s0i/39jPAKVqu8vOejBL7XQTh2/b36446505b50304cdbb11d97532c8903/ng-vikings-2018-stage)

Dubbed as the "main Angular event in the Nordics — and the only traveling Angular conference in the world", ngVikings was a unique two-day conference organized by a coalition of Angular and GDG Meetups from the Nordic countries of Norway, Sweden, Finland, and Denmark. This year, the traveling conference was scheduled to be in Helsinki but found itself in close-by Espoo, Finland and was held at [Aalto University](http://www.aalto.fi/en/).

The conference brought together over 300 developers and speakers from all over the world.

The keynote address was delivered by a core member of the Angular team [Matias Niemelä](https://twitter.com/yearofmoo/) and focused on his journey to Angular, how Angular has evolved over the last five years, and where it’s headed next. [Angular Elements](https://github.com/angular/angular/issues/20891) and the new ngIvy renderer seem really promising additions to the already excellent framework. Watch the keynote here:

<AmpContent>
<amp-youtube
    data-videoid="WahpV6zn8lQ"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/WahpV6zn8lQ" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

After the keynote, the conference was split into two tracks with each speaker giving a 30-minute presentation. The talks featured at ngVikings focused mainly on Angular 2+ showing best practices, sharing lessons learned, and focusing on the future of the framework. You can view all of the talks [here](https://www.youtube.com/watch?v=WahpV6zn8lQ&index=1&list=PLVI0Ut22uwY4UC1v5fUvi2RIU4R4jPkba), and while all of the talks were great and worth checking out, a few that really stood out for me where:

### Deploying Angular and Node to the Cloud

<AmpContent>
<amp-youtube
    data-videoid="XmpEZN5TCjw"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/XmpEZN5TCjw" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

by [John Papa](https://twitter.com/John_Papa)

> Your Angular app is complete! Now it's time to deploy it to the cloud. But how? One key ingredient is determining our goals. Do you want to publish directly from your laptop or through source control and CI/CD? Do you worry that it may work differently on your machine than the cloud? What about locking down versions of node, packages, and OS? Is your head about to explode? We'll explore several good options as we discuss the pros and cons of each including direct deployments, GitHub hooks with CI, and docker. We'll demonstrate how to code, debug, and run docker locally to have confidence that what works locally will work in the cloud. The good news is that tooling has improved to make all of these deployment options within your reach to guide you to successfully deploy your Angular app to the cloud.

### Advanced Angular DI

<AmpContent>
<amp-youtube
    data-videoid="PRRgo6F0cjs"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/PRRgo6F0cjs" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

by [Ward Bell](https://twitter.com/wardbell?lang=en)

> You Don’t Know DI? Go beyond Dependency Injection basics. Learn about the two parallel DI hierarchies and which one wins, what happens when you provide the same token twice … when multi is true, what’s the effect of lazy loading, what’s going on in forRoot and forFeature, what’s in a component’s injector, and how to talk to the components in content children when you don’t know their types. It’ll be fast, code-frontal, fun.

### 6 Apps One Codebase with Ionic

<AmpContent>
<amp-youtube
    data-videoid="4bGMXuPM_FI"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/4bGMXuPM_FI" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

by [Sani Yusuf](https://twitter.com/saniyusuf)

> You and your team have this great Idea and you have your users using different devices and operating systems to access the same application. Some users are on the Web, some on Mobile some of their Desktop and you also have to worry about what operating system they are on and also have to consider how your application is presented on each device & operating system. What if there was a way to code your app without worrying too much about operating systems/devices/screen sizes and just focusing on getting your idea across to your users regardless. Join me on a journey where I show you how to use Angular, Ionic & the PWA standard to build apps for IOS, Android, Windows, Web, Mac & PC with the same code all using just HTML5.

A big shout out to the organizers including [Maxim Salnikov](https://twitter.com/webmaxru), [Shahrzad (Sherry) Aziminia](https://twitter.com/sherrrylst), [Chris Noring](https://twitter.com/chris_noring), [Jussi Kinnula](https://twitter.com/jussikinnula), and the [rest of the team](https://2018.ngvikings.org/team/) for putting together such a great conference.

## Auth0 at ngVikings 2018

[Ado Kukic](https://ado.xyz), Developer Evangelist at Auth0, was the only Auth0 representative at ngVikings and gave a talk titled “A Token Walks Into a SPA…”, which focused on token-based authentication for single page applications and Angular in specific. You can watch the talk here:

<AmpContent>
<amp-youtube
    data-videoid="EoEOjQhSHNo"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/EoEOjQhSHNo" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

The talk covered topics ranging from why you should consider token-based authentication, how JSON Web Tokens actually work, SPA architectures and security considerations they bring with them, and finally how to incorporate token based authentication using various Angular specific features like HTTP Interceptors, Route Guards, and more.

## ngVikings 2019

I am very hopeful that ngVikings makes a return next year, and the official conference website implies it will. Check out the [official site](https://ngvikings.org/) for updates on where the traveling conference is sailing to next!

![Over 300 developers attended ngVikings](https://images.ctfassets.net/23aumh6u8s0i/5ysl15Y4PNwYquLgpU7r3E/0a5ed58058f87f7c08effe5b1057022a/attendees)

If you are interested in learning more about or joining the Auth0 Ambassador program, check out the [Ambassador page on our website](https://auth0.com/ambassador-program).

<include src="asides/AboutAuth0" />


"net"