Passkeys in ASP.NET Core 10

Passkeys in ASP.NET Core 10
11 minutes by Adrian Bailador

ASP.NET Core Identity in .NET 10 ships built-in WebAuthn/FIDO2 passkey support. Here's how registration and sign-in actually work under the hood, what MakePasskeyCreationOptionsAsync and PasskeySignInAsync do for you, and where the implementation deliberately stops short of a full WebAuthn library.

Cut AI Coding Token Costs by up to 36% with Sonar Vortex
sponsored by Sonar

Sonar Vortex operates inside your AI coding agent’s inner reasoning loop, supplying deep architectural context before code is written, then verifying the output in real time. In testing, software defects dropped by 92% and token consumption decreased. Build safer code while spending less on LLM calls.

REST API security best practices in ASP.NET Core
19 minutes by Anton Martyniuk

Building secure ASP.NET Core APIs comes down to consistent habits across the whole codebase. Anton covers 18 practices, from enforcing HTTPS and validating JWT tokens properly to preventing SQL injection with EF Core and capping request sizes. Key themes include treating all input as hostile, using policies for authorization, storing secrets outside source control, and keeping dependencies patched. No single fix is enough, but starting with HTTPS, token validation, and input handling closes the biggest gaps fast.

Cache invalidation in .NET
5 minutes by Yohan Malshika

Caching speeds up apps but causes problems when data changes. Cache invalidation solves this by removing or updating stale cache entries after database changes. The Cache-Aside pattern handles this well: read from cache first, and after any update or delete, remove the related cache entry so the next request fetches fresh data. Adding a TTL gives extra protection, but explicit invalidation is still needed when accuracy matters.

The role of ActivitySource in OpenTelemetry for .NET
5 minutes by Bart Wullems

ActivitySource is the entry point into .NET's native tracing story, and OpenTelemetry is just one listener on top of it. The name is the contract; get that right, register it with AddSource, and you can create as many instances of it as your codebase's structure naturally calls for. Don't let the fear of "duplicate instances" push you into DI ceremony you don't need.

EF Core interceptors: The complete guide
16 minutes by Mukesh Murugan

EF Core interceptors act as middleware for database calls, letting you observe, modify, or cancel operations like saving changes or running SQL without touching the calling code. The two most useful types are ISaveChangesInterceptor for audit fields and soft deletes, and IDbCommandInterceptor for SQL-level work like logging slow queries. To inject a scoped service like the current user, register the interceptor as scoped and resolve it through the AddDbContext service provider overload.

And the most popular article from the last issue was:

• How to optimize SQL queries