Azure posts

Always check permissions in tokens in an Azure AD protected API

Posted on: 05-08-2019

Failing to check for permissions in Azure AD access tokens leads to your API being vulnerable

Why you should not put secrets in native applications

Posted on: 29-05-2019

The dangers of embedding secrets in native applications, and how to implement Azure AD authentication there without secrets

Keeping secrets out of version control in .NET applications

Posted on: 26-05-2019

Goes through methods of storing secrets in a way where they cannot end up in the shared code repository

Best practices for N-tenant Azure AD applications

Posted on: 21-05-2019

Some things to watch out for in your multi-tenant Azure AD applications that support a limited number of tenants

Resource Owner Password Credentials grant flow in Azure AD

Posted on: 05-05-2019

What is the OAuth ROPC flow, why it exists, and why you should not use it for most cases

Avoiding wildcard reply URLs with MSAL.js

Posted on: 02-05-2019

Some points on why using wildcards (asterisks) in Azure AD app reply URLs may be a bad idea, and how to do it better

Using groups vs using application roles for authorization in Azure AD apps

Posted on: 21-04-2019

Compares two approaches to high-level authorization in an application: groups and app roles

Using Azure Key Vault and Azure Storage to store Data Protection keys with ASP.NET Core

Posted on: 07-04-2019

A look at how ASP.NET Core's Data Protection can be setup in a good way using Azure services

Exploring the new .NET Cosmos DB SDK (v3)

Posted on: 25-01-2019

Since the new Azure Cosmos DB SDK for .NET is available, I thought I'd look into it and see what's changed.

Implementing Azure AD Single Sign-Out in ASP.NET Core

Posted on: 23-11-2018

Single Sign-Out enables you to clear the user's session immediately when they sign out from another app

Hi! My name is Joonas Westlin, I'm a software developer who blogs about ASP.NET, Azure, and Web development.

Azure MVP, Azure Solutions Architect Expert, Azure Developer Associate, MCSE: Cloud Platform and Infrastructure, MCSD: App Builder.