How to Secure ASP.NET Core SignalR Hubs with JWT Authentication

·2 views

SignalR enables real-time communication in .NET apps, but its hubs are open to all clients by default, posing security risks in production environments. Without authentication, there is no way to identify users, control access to hub methods, or prevent sensitive data from reaching unauthorized clients. JWT tokens are the preferred authentication method for SignalR, especially for SPAs, mobile apps, and cross-domain scenarios where cookies are less practical. Because browser APIs for WebSockets and Server-Sent Events do not support custom headers, JWT tokens must be passed via a query string parameter and extracted server-side using the OnMessageReceived event handler. Proper setup also includes role-based authorization on hub methods and secure token validation parameters such as issuer, audience, and signing key checks.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

F-Droid 2.0 Launches Days Before Google Enforces Android Sideloading Rules

F-Droid released version 2.0 on September 24, 2025, just six days before Google begins enforcing developer identity verification for app installations on certified Android devices starting September 30. The rebuilt client features a Kotlin and Jetpack Compose codebase, improved search, combinable filters, and default auto-updates, and underwent an independent security audit after over a year of development. Google's new rule requires all sideloaded apps on certified devices to be tied to a verified developer's signing key, with initial enforcement in Brazil, Indonesia, Singapore, and Thailand before a planned global rollout in 2027. The policy creates a structural challenge for F-Droid, which builds apps from source and signs roughly 85% of its catalog with its own key rather than the original developer's key. Reproducible builds are considered the clearest solution, as they would allow F-Droid to distribute developer-signed APKs, but coverage remains only partial today.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds 59 privacy-first browser tools in vanilla JS with zero dependencies

A developer has publicly launched Antigravity Tools, a collection of 59 free, browser-based utilities built entirely in vanilla JavaScript with no external dependencies, backend servers, or analytics. The project was motivated by privacy concerns with popular online tools, such as JWT decoders and regex testers, which can log user data on remote servers. All operations run locally in the user's browser using native APIs including Web Crypto, Canvas, Web Audio, and IndexedDB. The toolkit covers a wide range of developer needs, including JWT inspection, RSA key generation, JSON formatting, cURL conversion, regex testing, and AI prompt utilities. The tools are freely accessible at antigravitytools.app, with the developer sharing technical learnings from the build process.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why SaaS Businesses Should Re-Validate VAT Numbers at Every Subscription Renewal

A VAT ID verified at the time of purchase only confirms validity on that specific date, not on future invoice dates. Under EU VAT rules, each subscription renewal constitutes a new supply, meaning businesses must hold valid evidence of a customer's VAT status for each individual invoice. A customer's VAT registration can lapse, be suspended, or change between renewals without any notification to the supplier. Hooking into a billing provider's renewal event to re-check VAT IDs just before each invoice is generated helps close this compliance gap. While no EU regulation mandates a specific re-validation frequency, aligning checks with the billing cycle is a practical, low-cost approach recommended in consultation with a tax adviser.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Safety-Test an AI Agent's SAP Integration Before Going Live

Before connecting an AI agent to SAP via Model Context Protocol (MCP), security and access controls must be validated beyond simple connectivity checks. Developers are advised to test denied scenarios—such as out-of-scope data requests, expired sessions, and unauthorized operations—as formal acceptance criteria, not afterthoughts. Each test should change only one condition at a time and record the principal, target system, scope, and outcome to confirm that authorization decisions are enforced server-side, not just hidden from the interface. Write operations require additional scrutiny, including testing that post-approval changes invalidate prior approvals and that timeouts are reconciled against actual downstream outcomes. MCP authorization is explicitly noted as a complement to—not a replacement for—SAP's own roles and authorization objects.

0 comments Read more at DEV Community