Protecting an ASP.NET Core API with Microsoft Entra ID: JWT Validation and Scope Policies

·1 views

A developer built entra-id-api-dotnet, a small ASP.NET Core 8 API that demonstrates JWT validation and separate scope and role authorization policies. The project requires a tenant ID and audience, builds the authority from the tenant, and validates issuer, audience, signature, and lifetime, accepting only RS256 tokens. Its 14 integration tests pass in GitHub Actions using locally signed tokens, though they do not connect to a live Microsoft Entra tenant. Authorization policies check the scp claim for api.read by splitting space-separated values and comparing them exactly, avoiding substring matches. The article emphasizes keeping authentication failures distinct from authorization failures in both implementation and HTTP responses.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Game Wiki Hub Design: Why the Content Model Is the Hard Part

Ludy, who runs the independent game reference site chuppa.gg, describes the engineering challenge of organizing interconnected game content such as references, guides, builds, tier lists, and codes. They propose a conceptual model that separates describing an entity from recommending a configuration, since the same character can appear in several page types without those pages being interchangeable. The post argues for validation checks like broken internal references, missing source URLs, duplicate identifiers, and mismatched game attribution, regardless of the underlying storage. It also stresses that a recent edit does not mean a page was recently verified, so editorial changes should be tracked separately from verification events. Ludy invites developers to weigh in on modeling builds as structured data versus prose and on how to show uncertainty without cluttering pages with warnings.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Echoes AI: Open-Source, Local-First App Preserves Family Memories and Stories

Echoes AI is an open-source memory journal built for the Hacktoberfest Week 4 challenge, designed to keep family stories from fading. Its creator approached the "Ghost in the Machine" theme not through impersonating deceased relatives but by preserving authentic human recollections. The app turns rough notes into narratives in three selectable voices while keeping the user's original text alongside them and avoiding invented details. It also offers gentle interview questions to help expand memories, a searchable library, memorial pages, and Markdown, text, and JSON exports. All data stays local, with no cloud calls, telemetry, or model training on user content.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Android AI Agent Uses Dual Checks Before Risky Actions Like Payments and Deletions

The StareBrain Android agent applies two independent safeguards before any risky action is sent to the user for approval. The first is the language model's own requires_confirmation flag, while the second is a client-side keyword guard that scans button labels and action text for patterns such as send, pay, or delete. Either signal alone is enough to trigger a confirmation dialog, so a miss by the model does not let a destructive action slip through. The developers log which layer triggered each prompt, which helps reveal categories the model systematically overlooks. The keyword list is treated as a living safety net that is expanded as new risky cases surface.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SillyTavern remote access: 11 CVEs in 2026 and an unpatched Node Brotli bug

A developer who runs SillyTavern remotely outlines a security checklist for users who reach the self-hosted LLM frontend from other devices. They note that the Node.js bug CVE-2026-111497 was added to CISA's list of actively exploited vulnerabilities on 2026-10-27, and that the official Docker image still shipped an unpatched Node as of 2026-10-28. The author recommends checking the SillyTavern version, confirming the Node.js security patch is installed, and reviewing the privateAddressWhitelist setting in config.yaml. Their survey counted 11 SillyTavern CVEs published in 2026, with versions before 1.18.0 exposed to at least six of them. The most severe listed issue is CVE-2026-44650, a critical path traversal flaw scoring 9.1 that requires no login.

0 comments Read more at DEV Community