matt-netkow

Head of Developer Relations

Matt Netkow

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

How to implement Auth0 authentication and authorization for AI running on Cloudflare's edge network. Secure your Workers AI with token-based security, offering a starter kit and step-by-step deployment instructions.

The AI wave is undeniably upon us, reshaping how we think about application development, deployment, and user interaction. We're no longer just building applications; we're crafting intelligent experiences. To bring this intelligence closer to your users for lightning-fast responses and truly global scale, Cloudflare Agents are stepping into the spotlight. They offer a brilliant way to deploy AI logic directly onto Cloudflare's massive global network, transforming how you can leverage Workers AI.

But as these powerful agents spring up at the edge, handling potentially sensitive operations or data, a critical question emerges: How do you secure them? How do you ensure that only authorized users, services, or other functions can interact with your sophisticated AI agents, without compromising that speed and agility?

That's where we come in. In this article, we're going to dive deep into how you can supercharge your Cloudflare Agents with robust, flexible, and developer-friendly authentication and authorization using Auth0. Get ready to build AI that's not just smart and fast, but also secure and trustworthy.

## What are Cloudflare Agents?

[Cloudflare Agents](https://agents.cloudflare.com/) enable you to run sophisticated AI workloads directly on Cloudflare's global edge network using [Cloudflare Workers](https://workers.cloudflare.com/) and [Workers AI](https://developers.cloudflare.com/workers-ai/). They move beyond traditional generative AI, enabling you to build agentic AI systems&mdash;applications that integrate autonomy, goal-directed reasoning, and adaptive decision-making.

This means Cloudflare Agents aren't just about passively responding to prompts. Instead, they allow you to create AI that actively:

1. Can capture user input from multiple sources such as emails, websockets, pages, and voice calls. 
2. Plan, reason, and action or generate content using LLM models running directly on Cloudflare or using an AI Gateway to connect to state-of-the-art models from popular providers. 
3. Execute the required steps thanks to an execution engine that combines state and compute to handle advanced and complex workflows. 
4. Take real-world action by giving your agent access to tools to complete the given tasks. These tools can extend the agents' functionality by invoking APIs, manipulating data, and integrating with external systems and databases.

## The Authentication Conundrum

So, Cloudflare Agents are incredibly powerful. They can ingest data from various sources, reason with advanced LLM capabilities, execute complex workflows, and even interact with external systems to take real-world action. This is all great for building next-generation AI applications\! However, with great power comes great responsibility. Thus, as developers, we need to address other significant challenges, including security, authentication, and authorization.

Therefore, when building these agents, we need to ask ourselves:

1. **Who (or what) is talking to my agent?** With agents potentially triggered from multiple sources, how do you reliably verify the identity of the requester? Is this a legitimate end-user? Another machine? Or is it a malicious attempt to impersonate someone? 
2. **Are they allowed to do that?** Once you establish the requester's identity, the next crucial step is determining what they are allowed to do. Should the user have access to all the tools? 
3. **Does the task require confirmation?** Some tasks performed by the agent may be critical steps, such as executing transactions or confirming holiday destinations, etc. Should any tool require a [human-in-the-loop interaction](https://auth0.com/blog/secure-human-in-the-loop-interactions-for-ai-agents/), such as approval step before execution? 
4. **Does the user have access to the information shared by the AI?** When the AI processes documents from other sources to generate responses, are we leaking any unauthorized information to the user? How can we [add robust authorization controls](https://auth0.com/blog/rag-and-access-control-where-do-you-start/) to guarantee that users only receive information according to their access level?

## Adding Authentication to your Cloudflare Agent

The challenges outlined above might seem daunting, but the good news is that you don’t have to solve them from scratch to properly secure your Agent. This is where a robust identity platform like [Auth0](https://auth0.com/signup) comes into play, providing a standardized, secure, scalable, and developer-friendly way to manage authentication and authorization.

At its core, we’ll be implementing [token-based authentication](https://auth0.com/learn/token-based-authentication-made-easy). Here’s the high-level flow:

1. **The client authenticates**: The user or service wanting to interact with your Cloudflare Agent first authenticates with Auth0. This could be through [Universal Login](https://auth0.com/features/universal-login) for a human user or [machine-to-machine (M2M)](https://auth0.com/features/machine-to-machine) flow for an automated service. The client application can be hosted using Cloudflare, but it can also be a totally separate application, hosted using another service provider, or running locally on a computer or server. 
2. **Auth0 issues a JWT token**: When the user successfully authenticates, Auth0 issues a JWT token that contains claims (information) about the authenticated entity, and is verifiable by a digital signature. The JWT is securely stored in the client application using one of the Auth0 SDKs. 
3. **The client sends the JWT to the agent on each request**: When the client needs to interact with the Agent, it sends an HTTP request or WebSocket connection request, passing the JWT token, for example, using the `Authentication` HTTP header. 
4. **The Cloudflare Agent verifies the JWT**: This part is crucial. When the agent receives a request, it must verify that a valid JWT is present and cryptographically verify its signature against Auth0's public keys. 
 
By implementing this pattern, your Cloudflare Agent can confidently identify who is making a request and then make informed decisions about whether to process it.

These four critical steps must be preformed properly, and this is where Auth0 shines by providing you with SDKs that help you cover each of these steps with ease.

In the next section, we’ll build a chatbot application that uses Auth0 authentication.

## Getting Started with Auth0 for Cloudflare Agents

Time for us to get hands-on by building a simple chat application that uses tool calling to fetch the time in different cities and allows the user to ask for weather information.

Here’s the application demo: 
![Application Demo](https://cdn.auth0.com/blog/auth0-clourflare-agents-demo.gif)

### Auth0 Cloudflare Agent starter kit

The easiest way to get you started is by using the Auth0 starter kit for Cloudflare Agents. You can clone the starter kit from GitHub:

```
git clone https://github.com/auth0-lab/cloudflare-agents-starter
```

This example provides you with both the client chat application, built with [Hono](https://hono.dev/) and deployed to Cloudflare Workers, and the AI Agent, built with Cloudflare Agents.

Before diving into the instructions on how to run and deploy the starter kit, let’s first understand its main components.

### The client

The client (`src/client`) application is a chat application built with Hono and React to provide a simple UI experience. The application uses the package [auth0-hono](https://github.com/auth0-lab/auth0-hono) to add authentication to the web application.

The package acts as a middleware for the server application, providing relevant user information and authentication methods.

Here’s a basic sample code to demonstrate the use of the library:

```javascript
import { Hono } from "hono";
import { auth } from "@auth0/auth0-hono";

const app = new Hono();

// Configure auth middleware with Auth0 options
app.use(
 auth({
 domain: process.env.AUTH0_DOMAIN,
 clientID: process.env.AUTH0_CLIENT_ID,
 clientSecret: process.env.AUTH0_CLIENT_SECRET,
 baseURL: process.env.BASE_URL,
 session: {
 secret: "password_at_least_32_characters_long",
 },
 }),
);

app.get("/", (c) => {
 const user = c.var.auth0Client?.getSession(c)?.user;
 return c.text(`Hello ${user?.name}!`);
});

export default app;
```

To use this library in your own project run:

```
npm install @auth0/auth0-hono
```

### The agent

The agent (`src/agent`) uses Cloudflare Agent SDKs to build a chat assistant agent with access to tools. As discussed, the agent is responsible for validating the incoming request and the JWT access token sent from the client. To do that, you can use the package [@auth0/auth0-cloudflare-agent-api](https://github.com/auth0-lab/auth0-cloudflare-agents-api).

Here’s a basic sample code to demonstrate how to protect an Agent endpoint using the library:

```javascript
import { AIChatAgent } from "agents/ai-chat-agent";
import { AuthAgent, OwnedAgent } from "@auth0/auth0-cloudflare-agents-api";

const SuperAgent = OwnedAgent(AuthAgent(AIChatAgent<Env>));

/**
 * Chat Agent implementation that handles real-time AI chat interactions
 */
export class Chat extends SuperAgent {
 ...
}
```

To use this library in your own project run:

```
npm install @auth0/auth0-cloudflare-agent-api
```

### Prerequisites for running the Starter Kit

To run the starter kit, you’ll need:

- A [Cloudflare account](https://www.cloudflare.com/) with Workers and Workers AI enabled. 
- An [OpenAI API key](https://platform.openai.com/api-keys). 
- An Auth0 account, if you don’t have one, you can [sign up now for free](https://auth0.com/signup).

### Configure your Auth0 tenant

1. Create an [Auth0 API](https://auth0.com/docs/get-started/auth0-overview/set-up-apis) and save the API identifier for later. 
2. Create an [Auth0 application](https://auth0.com/docs/get-started/auth0-overview/create-applications/regular-web-apps) of type “Regular Web Application”. 
3. Configure the Auth0 Application with the following settings: 
 1. Allowed Callback URLs: `http://localhost:3000/callback` (for development) and your production URL 
 2. Allowed Logout URLs: `http://localhost:3000` (for development) and your production URL 
4. Note your Domain, Client ID, and Client Secret for later use. 
 ![Example app](https://cdn2.auth0.com/docs/1.14382.0/media/articles/dashboard/client_settings.png)

### Running the starter kit

To run the starter kit locally, ensure you have already cloned the repository. If not, then run:

```
git clone https://github.com/auth0-lab/cloudflare-agents-starter.git
cd cloudflare-agents-starter
```

Next, install all dependencies using NPM or your favorite package manager.

```
npm install
```

Before you can run the demo, you’ll need to configure your environment variables. Create a `.dev.vars` file at the root of the project with the following information:

```
# OpenAI API key
OPENAI_API_KEY=sk-your-openai-api-key

SESSION_STORE=cloudflare-kv
SESSION_STORE_NAMESPACE=Session

#auth0
AUTH0_DOMAIN="YOUR-ACCOUNT.us.auth0.com"
AUTH0_CLIENT_ID="YOUR CLIENT ID"
AUTH0_CLIENT_SECRET="YOUR CLIENT SECRET"
AUTH0_SESSION_ENCRYPTION_KEY="RANDOM 32 CHARS KEY"
AUTH0_AUDIENCE="YOUR AUDIENCE"

BASE_URL="http://localhost:3000"
```

> Note: To generate a random key, you can use the following command: `openssl rand -hex 32`.

You are now ready to run the project locally with:

```
npm start
```

## Deploying Your Auth0 Powered Agent to Cloudflare

Running the application locally is great for development and testing, but the real magic happens when you deploy it to Cloudflare's global network. Let's walk through the steps to get your secured agent and client application live.

### Deployment prerequisites

Ensure you have the [Wrangler CLI](https://developers.cloudflare.com/workers/wrangler/install-and-update/) installed and updated, then log in to your Cloudflare account using Wrangler:

```
wrangler login
```

### Deploy the worker

Deploying to Cloudflare is as easy as building and deploying, and the starter kit simplifies those two steps in a single command with:

```
npm run deploy
```

Once that’s done, grab the worker’s URL from the response, you’ll need it next.

If you tried to access the website, you might have noticed that things aren’t working yet. This is because we haven’t set the environment variables in Cloudflare, let’s do that next.

### Configure secrets in Cloudflare

Your local `.dev.vars` file is not used in production. You need to set these environment variables as secrets in Cloudflare.

Run the following commands to set the environment variables in Cloudflare.

```
wrangler secret put OPENAI_API_KEY

wrangler secret put AUTH0_DOMAIN
wrangler secret put AUTH0_CLIENT_ID
wrangler secret put AUTH0_CLIENT_SECRET
wrangler secret put AUTH0_SESSION_ENCRYPTION_KEY
wrangler secret put AUTH0_AUDIENCE

wrangler secret put BASE_URL
```

### Testing your application

Once deployed and configured, visit the client application using the worker’s URL and have some fun chatting with your new AI agent.

## Conclusion

Cloudflare Agents offer a fantastic way to deploy powerful, agentic AI right to the edge, close to your users. As we've seen, this power demands robust security and that's where Auth0 steps in.

By integrating Auth0, you can easily add strong authentication and authorization to your Cloudflare Agents, ensuring only the right users and services can access them.

This guide, along with the provided starter kit, gives you a clear path to building AI applications that are not just intelligent and fast, but also secure.

But the journey to secure AI doesn’t end here. In this blog post, we didn’t discuss authorizing tool calling or how you can use Auth0 to allow your agents to interact with third parties on behalf of the user.

Auth for GenAI offers a new generation of tools and SDKs to help you build secure AI applications and services. Discover resources on building secure AI applications and services at [Auth for GenAI](http://a0.to/ai-content).

Thanks for reading\!

Securing Cloudflare Agents with Auth0

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

We released a new version of the .NET SDK for desktop and mobile applications. Learn what’s new.

We're thrilled to announce the newest release of the [Auth0 OIDC Client for .NET](https://github.com/auth0/auth0-oidc-client-net), bringing enhanced support and improvements to your desktop and mobile applications. This update focuses on future-proofing your applications by adding support for **.NET 9**, ensuring you're ready for the latest advancements in the .NET ecosystem.

## Key Highlights

Here are the main improvements provided by this release:

* **.NET 9 Support:** This release officially adds support for .NET 9 across WPF, WinForms, iOS, Android, and MAUI platforms.
* **MAUI issue fix**. With this release, we work around a [well-known issue with WebAuthenticator support in Windows](https://github.com/microsoft/WindowsAppSDK/issues/441).
* **Latest Dependencies:** Under the hood, this release includes the latest version of [Auth0.OidcClient.Core (version 4.1.0)](https://www.nuget.org/packages/Auth0.OidcClient.Core/4.1.0), which includes various underlying improvements and fixes.

What this means for you:

* **Future-Proofing:** By adopting this version, you're ensuring your authentication logic remains compatible as you migrate to .NET 9.
* **Continued Compatibility:** This release maintains compatibility with previous .NET versions, allowing for a smooth transition.
* **Enhanced Stability:** Leveraging the updated core library contributes to a more stable and reliable authentication process within your applications.

## Get Started Today!

Updating your Auth0 OIDC Client for .NET is straightforward. You can find the latest packages on NuGet, based on your UI framework:

* [Auth0.OidcClient.WPF - ver. 4.3.0](https://www.nuget.org/packages/Auth0.OidcClient.WPF/4.3.0)
* [Auth0.OidcClient.WinForms - ver. 4.3.0](https://www.nuget.org/packages/Auth0.OidcClient.WinForms/4.3.0)
* [Auth0.OidcClient.iOS - ver. 4.3.0](https://www.nuget.org/packages/Auth0.OidcClient.iOS/4.3.0)
* [Auth0.OidcClient.Android - ver. 4.1.0](https://www.nuget.org/packages/Auth0.OidcClient.Android/4.1.0)
* [Auth0.OidcClient.AndroidX - ver. 4.3.0](https://www.nuget.org/packages/Auth0.OidcClient.AndroidX/4.3.0)
* [Auth0.OidcClient.MAUI - ver. 1.3.0](https://www.nuget.org/packages/Auth0.OidcClient.MAUI/1.3.0)
* [Auth0.OidcClient.UWP - ver. 4.2.0](https://www.nuget.org/packages/Auth0.OidcClient.UWP/4.2.0)

Simply update your project dependencies to the latest version to take advantage of these improvements.

We're committed to providing you with the best possible authentication experience. This release is a step towards ensuring your .NET applications are ready for the future. Stay tuned for more updates and features!

Learn More:

* [Auth0 OIDC Client for .NET Documentation](https://auth0.github.io/auth0-oidc-client-net/)
* [GitHub Repository](https://github.com/auth0/auth0-oidc-client-net)

Thank you for being a part of the Auth0 community!

Announcing a New Release of the Auth0 OIDC Client for .NET

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Get started and ship fast with Auth0 and Netlify

**TL;DR:** [New Auth0 Extension](https://www.netlify.com/integrations/auth0/) for Netlify: Available Now. We’ll go over why we partnered with Netlify and share resources to help you build and deploy an app.

## Why Should I Choose Auth0?

A secure login experience and access management are at the core of any application with users. Auth0 is a comprehensive auth solution built for developers with evolving needs. With Auth0, you can get your app to market fast by quickly turning on core features, enabling a secure experience for your users, and customizing experiences when your app’s needs change. 

## What is Netlify, and Why Did We Choose to Partner Together? 

[Netlify’s](https://www.netlify.com/) platform allows you to build highly performant and dynamic websites, e-commerce stores, and web applications. It also unites an extensive ecosystem of technologies, services, and APIs into one workflow to unlock team productivity. Integrating with a third-party platform like Auth0 allows Netlify users to deploy any modern frontend stack safely and securely. 

We both share a commitment to an excellent developer experience, so this partnership is a great fit. This extension allows you to leverage Netlify to innovate, scale, and ship while relying on Auth0 to enhance security and a great user experience. 

## Let’s Start Building with Auth0 and Netlify

Challenge: You’re looking to add authentication to your Netlify site easily.

Solution: Use this new extension to add authentication to your Netlify site and connect your Auth0 tenants to your Netlify account dashboard. 

This [guide](https://developers.netlify.com/guides/getting-started-with-the-new-auth0-extension-on-netlify/) will include instructions on how to set up the following while using the web framework Astro:

* Authentication flows for login/logout
* An Auth0-protected serverless function for serving user information

> [Let’s dive in here](https://developers.netlify.com/guides/getting-started-with-the-new-auth0-extension-on-netlify/).

Once complete, you will have built a static site and enabled the Auth0 extension. Congrats on successfully authenticating your new website! 🎉

## Have Questions?

If you want to learn more, check out the new [Netlify documentation](https://docs.netlify.com/integrations/auth0/). Share your thoughts on the guide [here](https://developers.netlify.com/guides/getting-started-with-the-new-auth0-extension-on-netlify/#guide-feedback-form).


Happy building!

_This blog may contain hyperlinks to non-Okta websites that are created and maintained by third parties who are solely responsible for the content on such websites._

New Auth0 Extension for Netlify: Available Now

Learn how to integrate CIBA authentication in your .NET applications to improve security and privacy.

There are scenarios where the user cannot interact directly with an application to use its functionality securely. In these scenarios, CIBA can guarantee security and usability at the same time.
This article will walk you through CIBA authentication and how to implement it in a .NET application.

## What Is CIBA?

CIBA stands for *Client-Initiated Backchannel Authentication*, and it's a [standard flow](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html) for decoupled authentication defined by the OpenID Foundation. Decoupled authentication occurs when the user is authenticated outside the context of an application. For example, consider a call center agent that is asked to modify a customer's order on the phone. Before executing that request, the agent needs to be sure that the user on the phone is actually the customer who placed that order. In this case, the call center agent sends an authentication request to the customer's phone. Once the customer confirms their identity, the operator can perform the requested action. Notice that the user authentication does not occur in the order management application, i.e., the application where the requested action needs to be performed, but on the user's device. This is why this type of authentication is called decoupled authentication.

Read [this article to learn more about CIBA use cases](https://auth0.com/blog/ciba-authenticate-customers-in-call-centers/).

## The CIBA Flow

Let's dig into the following diagram to understand how CIBA works:

![The Client-Initiated Backchannel Authentication (CIBA) flow](https://images.ctfassets.net/23aumh6u8s0i/3FccU3SUoWUH9TjY8zpSao/0dbdc84a573753cba9505edcf9237ee3/ciba-flow.png)

From this diagram, you see that the actors involved in the flow are:

- **The user**. This is the user who interacts with the application starting the authentication flow. In the use case described earlier, this is the call center agent.
- **The client application**. This is the application that initiates the CIBA authentication flow. In our previous example, it was the order management application. Notice that this application must be a [confidential client](https://auth0.com/docs/get-started/applications/confidential-and-public-applications), i.e., an application running in a controlled environment, such as a server environment. You cannot implement the CIBA flow directly in a SPA or desktop application; these applications must rely on a backend server.
- **The authorization server**. It's the server that authenticates the user and supports the CIBA flow, such as Auth0.
- **The end user**. This is the customer who needs to be authenticated to allow the user to perform actions on the client application. In the context of our example, this is the customer asking for a change to their order. The end user must have a mobile device with an application enrolled with the authorization server to receive push notifications.

> While in this diagram you have two distinct users, in some scenarios, the user and the end user can be the same person. Consider the case of a user accessing a kiosk in a retail shop or a device without a browser. Read [here](https://auth0.com/blog/ciba-authenticate-customers-in-call-centers/) for more use cases.

Following the numbered arrows in the diagram, we have:

1. The user interacts with the client application and requests the end user's authentication.
2. The client application submits an HTTP request to the authorization server's `/bc-authorize` endpoint and then start polling the `/token` endpoint to receive the response.
3. The authorization server sends a push notification to the end user's device.
4. The end user interacts with the push notification. The mobile application retrieves the data associated with the authentication request (consent details) and presents it to the end user. At this point, the end user sends their response, i.e., they can accept or deny the request.
5. The client application receives the end user's response. If the response is successful, it also receives the tokens to perform the requested action.


This is a high-level overview of the CIBA flow. For more details on the messages exchanged by the actors involved in the flow, check out [this document](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba).

## The Sample Application

Once you have a high-level understanding of CIBA flow, let's see how to implement it in a .NET application using Auth0.

Assume a call center scenario where an agent with a user on the phone needs to access that user's sensitive data managed by an application. This could be a hospital call center where users ask for information about their medical records. It could also be a tax center where users ask for information about their current tax situation. The agent needs to be sure that the user is who they say they are before giving this information.

You can imagine a screen like the following in front of the call center agent:

![User data screen to initiates the CIBA flow](https://images.ctfassets.net/23aumh6u8s0i/1Uq6DfvHijZcx1eJVkUXZz/156a145dd050bfbca9600255f3ea9371/user-data-screen-to-initiates-ciba-flow.png)

By clicking the "Load sensitive data" button, the agent initiates the CIBA flow to authenticate the user requesting access to their data.

From a technical perspective, the application is a .NET application running on a server. The screenshot above shows a Blazor Web App, but it could be an ASP.NET Core MVC or a Razor Page application. This application has to call a protected API to get the end user's sensitive data, and for this reason, it needs an access token with the appropriate scopes.

The backend application has a mobile counterpart capable of receiving push notifications, and the user must have this application installed on his device, typically a smartphone.

In the following sections, you will learn how to enable CIBA for this application using Auth0. You will start by enabling CIBA support on the backend application and then enable CIBA on the mobile device.

<div className="alert alert-info alert-icon">
 
 This article focuses on the backend application. It mentions how to deal with the mobile application at a high level but redirects you to the specific platform documentation for more details. 
</div>


## Add CIBA Support to the Backend App

To add CIBA support to your backend application, you need first to configure your Auth0 tenant and then configure and modify your application's code.

### Enable CIBA support on your Auth0 tenant

To configure your Auth0 tenant to support CIBA, follow these steps in your [Auth0 dashboard](https://manage.auth0.com/):

- Make sure that [your application is registered with Auth0](https://auth0.com/docs/get-started/auth0-overview/create-applications/regular-web-apps) and take note of the domain, client ID, and client secret.
- Scroll down in the application settings and [enable the CIBA flow](https://auth0.com/docs/get-started/applications/configure-client-initiated-backchannel-authentication#configure-ciba-for-your-application).
- Make sure that the API the application is going to call is [registered with Auth0](https://auth0.com/docs/get-started/auth0-overview/set-up-apis) and take note of its identifier, also known as audience.
- Enable [Auth0 Guardian push notifications for your tenant](https://auth0.com/docs/get-started/applications/configure-client-initiated-backchannel-authentication#enable-auth0-guardian-push-notifications-for-your-tenant) and [configure push notifications for MFA](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-push-notifications-for-mfa).
- The user must have [enrolled in MFA push notifications](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian#enroll-in-push-notifications) to receive them.

Once you have configured your Auth0 tenant, go to your application's source code and update the `appsettings.json` configuration file with the following settings:

```json
// appsettings.json

{
 "Logging": {
 "LogLevel": {
 "Default": "Information",
 "Microsoft.AspNetCore": "Warning"
 }
 },
 "AllowedHosts": "*",
 "Auth0": {
 "Domain": "YOUR_AUTH0_DOMAIN",
 "ClientId": "YOUR_CLIENT_ID",
 "ClientSecret": "YOUR_CLIENT_SECRET",
 "Audience": "YOUR_API_AUDIENCE"
 }
}
```

Replace the `YOUR_AUTH0_DOMAIN`, `YOUR_CLIENT_ID`, and `YOUR_CLIENT_SECRET` placeholders with the respective application setting values from the Auth0 dashboard. Replace the `YOUR_API_AUDIENCE` placeholder with the audience of the API you want to call.

### Initiate the CIBA flow

Now you are ready to implement the CIBA flow in your backend application.

As the first step, install the [Auth0 Authentication API SDK for .NET](https://github.com/auth0/auth0.net) by running the following command in the root folder of your project:

```bash
dotnet add package Auth0.AuthenticationApi
```

The Auth0 Authentication API SDK is a generic .NET client for the [Auth0 Authentication API](https://auth0.com/docs/api/authentication). It's a low-level library that targets .NET Standard 2.0 and can be used in the legacy .NET Framework as well as the most recent .NET versions. At the time of writing, only the Auth0 Authentication API SDK supports CIBA for .NET.

> Check out [this article to learn more about the various Auth0 SDKs for the .NET platform](https://auth0.com/blog/choose-the-right-dotnet-sdk-for-auth0/).

To initiate the CIBA flow, we assume that when the call center agent clicks the "Load sensitive data" button, the following C# method is called with the user ID as its parameter's value:

```csharp
private async void GetUserData(string userId)
{
 var authenticationApiClient = new AuthenticationApiClient(new Uri($"https://{Configuration["Auth0:Domain"]}"));

 var response = await authenticationApiClient.ClientInitiatedBackchannelAuthorization(
 new ClientInitiatedBackchannelAuthorizationRequest()
 {
 ClientId = Configuration["Auth0:ClientId"],
 ClientSecret = Configuration["Auth0:ClientSecret"],
 Audience = Configuration["Auth0:Audience"],
 Scope = "openid profile read:sensitivedata",
 BindingMessage = "Request to access your private data",
 LoginHint = new LoginHint()
 {
 Format = "iss_sub",
 Issuer = $"https://{Configuration["Auth0:Domain"]}/",
 Subject = userId
 }
 });

 var isAuthorized = false;
 var isPendingAuthorization = true;
 var cibaTokenResponse = new ClientInitiatedBackchannelAuthorizationTokenResponse();

 while (!isAuthorized && isPendingAuthorization)
 {
 try 
 {
 cibaTokenResponse = await authenticationApiClient.GetTokenAsync(
 new ClientInitiatedBackchannelAuthorizationTokenRequest()
 {
 AuthRequestId = response.AuthRequestId,
 ClientId = Configuration["Auth0:ClientId"],
 ClientSecret = Configuration["Auth0:ClientSecret"]
 });
 
 isAuthorized = true;
 isPendingAuthorization = false;
 } catch (ErrorApiException ex)
 {
 if (ex.ApiError.Error == "authorization_pending") 
 Thread.Sleep(5000);
 else
 isPendingAuthorization = false;
 }
 }

 if (isAuthorized)
 {
 await LoadSensitiveUserData(cibaTokenResponse..AccessToken);
 }
}
```

The `userId` parameter contains the ID value of the user in the context of Auth0. Typically, it's a string in the form of `auth0|3813a4b5e...`. Let's break down the code of the `GetUserData()` method into its main parts.

> Be aware that the code shown here is a simplified version of the code you should have in production. Its goal is to explain how to implement the CIBA flow, ignoring performance details and other optimizations.

### Send the CIBA request

Consider the first section of the method:

```csharp
private async void GetUserData(string userId)
{
 var authenticationApiClient = new AuthenticationApiClient(new Uri($"https://{Configuration["Auth0:Domain"]}"));

 var response = await authenticationApiClient.ClientInitiatedBackchannelAuthorization(
 new ClientInitiatedBackchannelAuthorizationRequest()
 {
 ClientId = Configuration["Auth0:ClientId"],
 ClientSecret = Configuration["Auth0:ClientSecret"],
 Audience = Configuration["Auth0:Audience"],
 Scope = "openid profile read:sensitive-data",
 BindingMessage = "Request to access your private data",
 LoginHint = new LoginHint()
 {
 Format = "iss_sub",
 Issuer = $"https://{Configuration["Auth0:Domain"]}/",
 Subject = userId
 }
 });

 //...other code...
}
```

In this part, you create an instance of the `AuthenticationApiClient` class by passing the URL of your Auth0 tenant. Then, you start the CIBA flow by calling the `ClientInitiatedBackchannelAuthorization()` method. This method is responsible for submitting the HTTP request to the `/bc-authorize` endpoint of Auth0. It needs the details of the authorization request, which is passed through an instance of the `ClientInitiatedBackchannelAuthorizationRequest` class.

Apart from the client ID, client secret, and audience, a few other values are passed in the request:

- **Scope**. This is the string containing the [scopes](https://auth0.com/docs/get-started/apis/scopes) requested by the application. In addition to `openid` and `profile`, which are OpenID Connect standard scopes to get the user profile data in an ID token, notice the `read:sensitive-data` scope, which is a specific permission request to access the user's sensitive data.
- **BindingMessage**. This is a message displayed on the user's device to let them know about the request. This ensures that the action taken on the authentication device (the user's phone) is related to the request sent by the application.
- **LoginHint**. It's an object containing information to identify the user who should authorize the requester to access their sensitive data.

### Wait for a CIBA response

After the CIBA request is submitted, the backend application waits for a response from Auth0. This response depends on the action taken by the user on their device, so you need to poll the Auth0's `/token` endpoint to get the needed tokens:

```csharp
private async void GetUserData(string userId)
{
 //...other code...
 var isAuthorized = false;
 var isPendingAuthorization = true;
 var cibaTokenResponse = new ClientInitiatedBackchannelAuthorizationTokenResponse();

 while (!isAuthorized && isPendingAuthorization)
 {
 try 
 {
 cibaTokenResponse = await authenticationApiClient.GetTokenAsync(
 new ClientInitiatedBackchannelAuthorizationTokenRequest()
 {
 AuthRequestId = response.AuthRequestId,
 ClientId = Configuration["Auth0:ClientId"],
 ClientSecret = Configuration["Auth0:ClientSecret"]
 });
 
 isAuthorized = true;
 isPendingAuthorization = false;
 } catch (ErrorApiException ex)
 {
 if (ex.ApiError.Error == "authorization_pending") 
 Thread.Sleep(5000);
 else
 isPendingAuthorization = false;
 }
 }
 
 //...other code...
}
```

You can see a few variables that help control the loop you are about to start.

Within this loop, you call the `GetTokenAsync()` method to get a response from Auth0. This method needs an object as its parameter, which includes the request ID and the application credentials.

Until a positive response is received from the user, you will get an `authorization_pending` exception. In this case, you should suspend the current thread and retry after a few seconds. In the example above, the thread waits 5 seconds. If the user denies authorization, you get an `access_denied` exception.

If the user authorizes the request, you get a response in the `cibaTokenResponse` object containing the ID and access tokens.

> You should catch opportunely the exceptions you get and give the user an appropriate message about why the CIBA flow was not completed.

### Use the tokens

Finally, you have the access token that allows you to call the API to get the user's sensitive data:

```csharp
private async void GetUserData(string userId)
{
 //...other code...
 
 if (isAuthorized)
 {
 await LoadSensitiveUserData(cibaTokenResponse..AccessToken);
 }
}
```

We don't go into the details of calling the protected API using the access token. If you need guidance on this, check out [this article](https://auth0.com/blog/call-protected-api-in-aspnet-core/#Use-Your-Access-Token).

> We have omitted the step of validating the tokens received for simplicity, but it is fundamental for the application's security. Read [this article to learn more about token validation in .NET](https://auth0.com/blog/how-to-validate-jwt-dotnet/). Specifically, read [this section](https://auth0.com/blog/how-to-validate-jwt-dotnet/#Validate-a-JWT--By-Hand-) to learn how to validate them without using a middleware, which applies in our case since we are using the Auth0 Authentication API SDK.

## Add CIBA Support to the Mobile App

While this article focuses on the implementation of the backend application, we can't help but provide some information on its mobile counterpart.

First, you should use the [Auth0 Guardian SDK](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian) to handle the communication with Auth0 on your mobile app.

While developing your mobile application, you should take care of the following steps in the CIBA flow:

- Your mobile app [receives the push notification](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba#step-4-mobile-application-receives-the-push-notification) from Auth0.
- Then it [retrieves the details of the CIBA request](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba#step-5-mobile-application-retrieves-the-consent-details), in particular, the binding message.
- The app [presents the binding message to the user](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba#step-6-mobile-application-presents-the-consent-details-to-the-user), asking them to accept or deny the request.
- Finally, it manages the user's response by [sending it back to Auth0](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba#step-7-mobile-application-sends-the-user-response-back-to-auth0).

## Summary

This article has given you a high-level idea of what CIBA is and in what scenarios you can use it.
Then, you learned how to configure your Auth0 tenant and application to support CIBA. So, you have seen how to integrate CIBA into a .NET application that runs on a server and what steps to consider when developing the mobile counterpart.

Stay tuned for future evolutions of CIBA support in Auth0.

Use CIBA Authentication with Auth0 and .NET

With .NET 9.0, some interesting authentication and authorization features have been added to the platform. Let’s take an overview of them.

.NET 9 introduces interesting new features, primarily focused on cloud-native development and performance. However, the [list of improvements](https://learn.microsoft.com/en-us/dotnet/core/whats-new/dotnet-9/overview) in other areas of the platform is long. This article will focus on the main innovations introduced by .NET 9.0 in authentication and authorization.

## Support for Pushed Authorization Requests (PAR)

One of the most interesting features brought by .NET 9.0 is support for [Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) (PAR), an OAuth 2.0 and OpenID Connect extension that strengthens the security profile of these protocols. PAR allows applications to not expose the parameters of an authorization request through the browser. Instead, it enables direct communication of these parameters between the application and the authorization server. This is very important when you implement applications in a high-security context, such as in the financial, healthcare, or other regulated sectors. If you want to learn the details of [how PAR works, read this article](https://auth0.com/blog/what-are-oauth-push-authorization-requests-par).

ASP.NET Core adds support for PAR to the native [OpenID Connect middleware](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnecthandler). This is a typical configuration of the middleware if you are not using the [Auth0 SDK](https://github.com/auth0/auth0-aspnetcore-authentication):

```csharp
// Program.cs
...
  
builder.services.AddAuthentication(options =>
  {
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
  })
  .AddCookie()
  .AddOpenIdConnect("Auth0", options =>
  {
    options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";

    options.ClientId = builder.Configuration["Auth0:ClientId"];
    options.ClientSecret = builder.Configuration["Auth0:ClientSecret"];
    options.ResponseType = "code";
});

...
```

If the Identity provider you are using supports PAR, you don't need to do anything different from this. In fact, the OpenID Connect middleware transparently supports PAR by default. In other words, if the middleware detects PAR support by analyzing the standard `.well-known/openid-configuration` discovery document, it automatically leverages the PAR endpoint to pass the authorization request parameters. You can change the default behavior by modifying the value of the new option property `PushedAuthorizationBehavior`. For example, the following setting disables PAR support:

```csharp
// Program.cs
...
  
  .AddOpenIdConnect("Auth0", options =>
  {
    options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
    ...
    options.ResponseType = "code";
    
    options.PushedAuthorizationBehavior = PushedAuthorizationBehavior.Disable;
});

...
```

If you want to force your application to use PAR, you can set the value of `PushedAuthorizationBehavior` to `PushedAuthorizationBehavior.Require`. In this case, you get an error if the Identity provider does not support PAR.

Finally, to help customize PAR support, the [`OnPushAuthorization`](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnectevents.onpushauthorization?view=aspnetcore-9.0#microsoft-aspnetcore-authentication-openidconnect-openidconnectevents-onpushauthorization) event has been added to `OpenIdConnectEvents`.

## OAuth and OIDC Parameters Customization

Staying in the context of the OpenID Connect middleware, now you have a simplified way to add custom parameters to the authorization request. Up to .NET 8, if you wanted to add a custom parameter, such as `audience`, to the authorization request, you had to handle the `OnRedirectToIdentityProvider` event as shown in the following code snippet:

```csharp
// Program.cs
...

.AddOpenIdConnect(options =>
{
  options.Events.OnRedirectToIdentityProvider = context =>
  {
    context.ProtocolMessage.SetParameter("audience", "https://myapi.com");
    return Task.CompletedTask;
  };
});
...
```

> If you are using the [Auth0 SDK for ASP.NET Core](https://github.com/auth0/auth0-aspnetcore-authentication), you already have [an easier way to add the audience parameter](https://github.com/auth0/auth0-aspnetcore-authentication/blob/main/EXAMPLES.md#calling-an-api).

.NET 9 introduces the `AdditionalAuthorizationParameters` option to simplify this process. The previous code is equivalent to the following:

```csharp
// Program.cs
...
  
  .AddOpenIdConnect("Auth0", options =>
  {
    ...
    
    options.AdditionalAuthorizationParameters.Add("audience", "https://myapi.com");
});

...
```

## Configuration Flags for Windows Authentication

When using [HTTP.sys](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/httpsys) as a web server for ASP.NET Core applications on Windows systems, you can now configure [Windows Authentication](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth) by setting two new properties:

- `EnableKerberosCredentialCaching`. If this boolean value is `true`, the Kerberos authentication credentials are cached.
- `CaptureCredentials`. If this boolean value is `true`, the HTTP Server API captures the caller's credentials and uses them for Kerberos or Negotiate authentication.

The following code shows an example of usage of these properties:

```csharp
// Program.cs
...
builder.UseHttpSys(options =>
{
    options.Authentication.Schemes = AuthenticationSchemes.Negotiate;
    options.Authentication.EnableKerberosCredentialCaching = true;
    options.Authentication.CaptureCredentials = true;
});
...
```

## Authentication State Serialization for Blazor Web Apps

If you are a Blazor developer, you know how complicated authentication is since [render modes](https://www.telerik.com/blogs/getting-started-blazor-new-render-modes-net-8) have been introduced in .NET 8. You can get an idea by reading [this excerpt](https://auth0.com/blog/auth0-authentication-blazor-web-apps/#Why-Is-Blazor-Authentication-More-Complicated-Now) from my tutorial on adding authentication to Blazor Web Apps. Basically, in an application model where components can be rendered on the server side, on the client side, and on both sides dynamically, you need to keep the user authentication state in sync between the two sides of your Blazor application. This leads to writing a fair amount of code, as you can see by taking a look [here](https://auth0.com/blog/auth0-authentication-blazor-web-apps/#Syncing-the-Authentication-State). In practice, you need to serialize the user authentication state on the server, then send it to the WebAssembly client, which in turn needs to deserialize it. In addition, both authentication states must be kept in sync in order to reflect on the client side the actual authentication state on the server.

Fortunately, .NET 9 simplifies this approach by providing two new methods:

- `AddAuthenticationStateSerialization()`, which adds the services to serialize the authentication state on the server.
- `AddAuthenticationStateDeserialization()`, which adds the services to deserialize the authentication state in the WebAssembly client.

Instead of creating the serializing and deserializing classes yourself, you can now simply call the two methods respectively on the server and on the client to sync the authentication state.

On the server, you will have:

```csharp
// Program.cs
...
builder.Services.AddRazorComponents()
    .AddInteractiveWebAssemblyComponents()
    .AddAuthenticationStateSerialization();
...
```

On the client, you will write the following:

```csharp
// Program.cs
...
builder.Services.AddAuthorizationCore();
builder.Services.AddCascadingAuthenticationState();
builder.Services.AddAuthenticationStateDeserialization();
...
```

Read the [documentation](https://learn.microsoft.com/en-us/aspnet/core/blazor/security/server/?view=aspnetcore-9.0&tabs=visual-studio#manage-authentication-state-in-blazor-web-apps) to learn more.

## Conclusion

Although they are not revolutionary innovations in authentication and authorization, these new features are very convenient because they aim to simplify the work of .NET developers.
In particular, PAR support prevents developers from implementing the extension specifications themselves and encourages the adoption of increasingly advanced security. Also, simplifying the serialization and deserialization of the authentication state in Blazor relieves developers of the burden of implementing specific classes, resulting in potentially fewer bugs.

Authentication and Authorization Enhancements in .NET 9.0

Learn how to authenticate users of your .NET MAUI Blazor application using Auth0.

Add Auth0 Authentication to Blazor Hybrid Apps in .NET MAUI

Add Private Key JWT authentication to your .NET application to empower security in sensitive contexts.

Sensitive operations require increased security mechanisms, but at the same time, threat actors are on the rise, so it's crucial to raise the bar on application authentication security, such as using Private Key JWT authentication. Private Key JWT is a secure authentication method for applications to get security tokens from an authorization server. In this article, you will learn when you may need it, how it works, and how to implement it in a .NET application using Auth0.

## When a Client Secret Is Not Enough

In the OAuth 2.0 context, your application needs to authenticate in order to get an ID, access, and refresh token. This means that your application must provide its [credentials](https://auth0.com/docs/secure/application-credentials), typically a client ID and a secret, to the authorization server, such as Auth0.

Sensitive applications typically run in a server environment and are [confidential clients](https://auth0.com/docs/get-started/applications/confidential-and-public-applications#confidential-applications), i.e., applications capable of securely storing their credentials. Typically, these are server-rendered web applications or back-end services and applications that run in a protected environment. [Public clients](https://auth0.com/docs/get-started/applications/confidential-and-public-applications#public-applications), such as Single-Page Applications or mobile apps, can't securely store a secret. They must use [specific flows](https://auth0.com/docs/get-started/applications/confidential-and-public-applications#grant-types) that don't include client authentication, and their level of security is generally less reliable than that of a confidential client.

Although client authentication based on client secret provides a higher level of security for obtaining the access token than a public client flow, there are contexts in which it is considered insufficient. Think of banking or financial contexts, where the highest levels of transaction security must be ensured. Or in the healthcare context, where data confidentiality must be protected.

In these contexts, various regulations (e.g., [Open Banking](https://www.openbanking.org.uk/)) require the use of more secure mechanisms to protect transactions. Among these mechanisms, they require a more secure alternative to client authentication based on client ID and secret.

## Private Key JWT Authentication

[Private Key JWT authentication](https://auth0.com/docs/secure/application-credentials#private-key-jwt-authentication) is a secure alternative to client authentication based on a secret. It's a [standard mechanism](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-jwt-bearer) that relies on asymmetric cryptography to authenticate your application.

Basically, you generate a private and public key pair. Keep your private key securely stored and accessible to only your application. Don't even share it with Auth0. Share the corresponding public key with Auth0 instead. By nature, the public key is not sensitive data, so even if an attacker manages to catch it, they can't impersonate your application.

When your application needs an access token, it generates a specific JWT, called *assertion*, and signs it with its private key. Then, it sends this assertion to Auth0 in order to authenticate. The following is an example of an HTTP request to authenticate via an assertion:

```bash
curl --request POST \
 --url 'https://<YOUR-AUTH=-DOMAIN>/oauth/token' \
 --header 'content-type: application/x-www-form-urlencoded' \
 --data grant_type=client_credentials \
 --data client_id=<YOUR_CLIENT_ID> \
 --data client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOi... \
 --data client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer \
 --data audience=<YOUR_API_IDENTIFIER>
```

Auth0 validates the assertion using your application's public key and, if everything is ok, issues your access token.

If you want to learn more details about [how to authenticate with Private Key JWT, read the documentation](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authenticate-with-private-key-jwt). If you use one of the Auth0's SDKs, you don't need to build an assertion yourself, as you will see later in this article.

> Private Key JWT authentication is only available with the [Enterprise plan](https://auth0.com/pricing).



## Highly Regulated Identity and Private Key JWT Authentication

As mentioned, Private Key JWT authentication is a secure client authentication method required in business contexts where higher levels of security must be guaranteed, such as in finance, insurance, and healthcare.

To meet customers' needs in this area, Okta has released [Highly Regulated Identity (HRI)](https://auth0.com/docs/secure/highly-regulated-identity), a set of Auth0 features that enable high levels of security standards, such as [Financial Data Exchange](https://financialdataexchange.org/) and [Open Banking](https://www.openbanking.org.uk/), and compliance with widely adopted regulations, such as the [Payment Services Directive (PSD2)](https://www.europeanpaymentscouncil.eu/sites/default/files/infographic/2018-04/EPC%20Infographic_PSD2_April%202018.pdf).

> Highly Regulated Identity is an add-on for the Enterprise plan. For an overview of [Highly Regulated Identity, check out this article](https://auth0.com/blog/elevate-security-and-ux-with-highly-regulated-identity/).

Private Key JWT authentication is available in the Enterprise plan, so you don't need HRI to use it in your applications. However, if you need to use PS256 as the signing algorithm for your assertions, you need HRI on top of your Enterprise plan. HRI also supports [mutual TLS](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authenticate-with-mtls) as another secure mechanism for client authentication using a public-private key pair.

## The Sample Project

To see how to use Private Key JWT authentication in practice, you will use an ASP.NET Core web application that gets users' health data from a protected API. You can download the sample project by running the following command in a window terminal:

```bash
git clone -b starting-point --single-branch https://github.com/auth0-blog/dotnet-private-key-jwt-authentication
```

You will get two .NET projects:

- *HealthCkeckApi*, an ASP.NET Core Web API project that provides the user's health data through a protected endpoint.
- *HealthCheckWebApp*, an ASP.NET Core MVC application that implements the frontend used by the user to get their own health data.

You need an Auth0 account to configure and run the application. If you don't have one, you can <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for free now</a>. Follow the README document to configure and run the application.

Once your application is up and running and you have logged in, you will see a page like the following:

![HealthCheckWebApp home page](https://images.ctfassets.net/23aumh6u8s0i/6sAQuTcGWazJolzmaTzicI/08d8248e7dcec5cd978f11b633512823/healthcheckwebapp-home.png)

By clicking the *Show Health Checks* button, you will see a list of data like the following:

![HealthCheckWebApp checks data](https://images.ctfassets.net/23aumh6u8s0i/3hLebkfhp5Sn552D5tuppl/f2532b77a0f0577bda3d9cc04b3ddf45/healthcheckwebapp-data.png)

You will work on the *HealthCheckWebApp* application, which represents the OAuth confidential client that needs an access token to call the protected API. The current application implementation uses the [Auth0 ASP.NET Core Authentication SDK](https://github.com/auth0/auth0-aspnetcore-authentication) to authenticate the user and get the access token from Auth0 by using its client ID and secret.

You will modify this application to use Private Key JWT authentication instead of client ID and secret.

## Create and Register Your Public Key

Let's start by creating a private and public key pair. Go to the `HealthCheckWebApp` folder and generate your private and public key pair. For example, using [OpenSSL](https://www.openssl.org/) you can create the key pair with the following command:

```bash
openssl genrsa -out app_keys.pem 2048
```

This command generates an `app_keys.pem` file containing the private and public key pair you will use as a credential for your application.

Extract the public key from that file with the following command:

```bash
openssl rsa -in app_keys.pem -outform PEM -pubout -out pub_key.pem
```

You will get a `pub_key.pem` file containing only the public key. You will be sharing the public key with Auth0, while your private key must be kept safe and never shared with anyone.

Go to your [Auth0 dashboard](https://manage.auth0.com/) and open the *Credentials* tab of your application configuration page, as shown in the following image:

![Private Key JWT credentials in the Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/3jt9HLrTXYTOIwYFkPWSVE/d0c86d8b49331d22f461ea5482a78fac/auth0-private-key-jwt-credentials.png)

Select *Private Key JWT*, and a window like the following will show:

![Private Key JWT credential configuration](https://images.ctfassets.net/23aumh6u8s0i/5YiXuI8YceCxplwKghjmd2/0f8e8d8440e27795de4e6666a6f4ece9/auth0-private-key-jwt-configuration.png)

This window allows you to define a Private Key JWT credential for your application. Assign a name for the credential and upload the `pub_key.pem` file containing the public key. Optionally, select the signing algorithm and set an expiration date. Finally, click the *Add Credential* button to save your changes.

You will see your credential appearing below the *Application Authentication* section:

![Auth0 Private Key JWT authentication credential list](https://images.ctfassets.net/23aumh6u8s0i/0yhreNj2u7io7iTPnyRMB/844280997c40fc67565a27eb0b4fb3bb/auth0-private-key-jwt-authentication-credentials-list.png)

> You can add multiple credentials for your application, as you will learn in a moment.

## Get Your Access Token

Your application is now configured to use Private Key JWT authentication on the Auth0 side. Let's adjust the application code to use this authentication method instead of the client ID and secret.

Open the `appsettings.json` file in the `HealthCheckWebApp` folder and remove the `ClientSecret` key. You don't need it anymore. The file's content will be as follows:

```json
// HealthCheckWebApp/appsettings.json

{
 "Logging": {
 "LogLevel": {
 "Default": "Information",
 "Microsoft.AspNetCore": "Warning"
 }
 },
 "AllowedHosts": "*",
 "Auth0": {
 "Domain": "<YOUR-AUTH=-DOMAIN>",
 "ClientId": "<YOUR-CLIENT-ID>",
 "Audience": "https://myapi.com"
 },
 "HealthCheckApiBaseUrl": "https://localhost:7102"
}
```

Now, edit the `Program.cs` file in the `HealthCheckWebApp` folder by applying the changes highlighted in the following code snippet:

```csharp
// HealthCheckWebApp/Program.cs

// ...existing code...

// 👇 new code
var cryptoProvider = new RSACryptoServiceProvider();
cryptoProvider.ImportFromPem(File.ReadAllText("app_keys.pem"));
var securityKey = new RsaSecurityKey(cryptoProvider);
// 👆 new code

builder.Services
 .AddAuth0WebAppAuthentication(options => {
 options.Domain = builder.Configuration["Auth0:Domain"];
 options.ClientId = builder.Configuration["Auth0:ClientId"];
 // 👇 old code
 //options.ClientSecret = builder.Configuration["Auth0:ClientSecret"];
 options.ClientAssertionSecurityKey = securityKey;
 // 👆 new code
 options.Scope = "openid profile email";
 })
 .WithAccessToken(options =>
 {
 options.Audience = builder.Configuration["Auth0:Audience"];
 });

// ...existing code...
```

You load the key pair from the `app_keys.pem` file, generate an instance of the `RsaSecurityKey` class from the content of that file, and assign it to the `securityKey` variable. Then, you replace the assignment of the `ClientSecret` option with the `ClientAssertionSecurityKey` option and assign the value of the `securityKey` variable.

You are done! The Auth0 ASP.NET Core Authentication SDK will take care of creating the assertion and authenticate your application with Auth0 to get the access token. You will notice no difference in the behavior of the application, but under the hood your application uses a more secure authentication method to get the access token to call the protected API.

<include src="ebook-ads/dotnetIdentity" />

## Credential Rotation

When you configured your application to use Private Key JWT authentication, you should have noticed two things:

- You can set an expiration date.
- You can create multiple credentials for the application.

These two optional features allow you to further strengthen the security of Private Key JWT authentication.
In fact, setting an expiration date for a credential is always a good practice, even with secure mechanisms such as Private Key JWT.

However, setting an expiration date can cause some downtime when the old credential expires and the new one has not yet been activated. To avoid this downtime, you can add a new credential before the old one expires. This way, on the application side, you can replace the old credential with the new one before it expires, preventing the application from becoming inoperable.

For more information about credential rotation, see [the documentation](https://auth0.com/docs/get-started/applications/rotate-credentials).

## Summary

Throughout this article, you learned about Private Key JWT authentication and how it increases your application's level of security in obtaining tokens.

Together with other advanced features of Highly Regulated Identity, Private Key JWT helps achieve a high level of security and compliance required in areas such as finance, insurance, and health care.

You also saw how to implement Private Key JWT in a .NET application using the Auth0 SDK, which relieves you of the task of dealing with low-level details.

The final version of the example application code implementing Private Key JWT is available on [GitHub](https://github.com/auth0-blog/dotnet-private-key-jwt-authentication).

Use Private Key JWTs to Authenticate Your .NET Application

A new release of the package Auth0 Templates for .NET is out with new project templates and other improvements.

A new awesome version of the [Auth0 Templates for .NET package](https://www.nuget.org/packages/Auth0.Templates/) has been released! It brings you new templates and other improvements, which we will discover in a moment. Install now the latest release of the templates by running the following command in a terminal window:

```bash
dotnet new install Auth0.Templates
```

> ⚠️ Make sure you have uninstalled any previous version of the package from your machine before installing the new one.

Ready to learn what's new in the latest release? Let's go!

## New Project Templates

The first big news is that two new templates are now available: the Blazor Web App and the MAUI templates.

### The Blazor Web App template

The Blazor Web App template allows you to create a web application using the .NET 8 Blazor application model. As you may know, this new type of Blazor application has some complexities in properly supporting authentication. Take a look at [this article](https://auth0.com/blog/auth0-authentication-blazor-web-apps/) to learn more about it. Now you can have a starting point for your new Blazor application with Auth0 embedded in a snap by simply running the following command:

```bash
dotnet new auth0blazor -o MyNewBlazorApp
```

As usual, if you also have the [Auth0 CLI](https://github.com/auth0/auth0-cli) installed on your machine and logged in, you can automatically register your app with Auth0. Of course, you can still use the templates with Visual Studio:

![Auth0 Blazor Web App template in Visual Studio](https://images.ctfassets.net/23aumh6u8s0i/1fmXTCgaPVzvKGGiW0QPon/edd5f2a979472be788c9c6d448dc1ed0/auth0-blazor-web-app-vs.png)

Read [more about the Blazor Web App template here](https://github.com/auth0/auth0-dotnet-templates/blob/main/docs/auth0blazor.md).

### The MAUI template

With the MAUI template, you can build desktop and mobile applications with Auth0 authentication for Windows, macOS, iOS, and Android using a single code base. In this case, the command to use is as follows:

```bash
dotnet new auth0maui -o MyNewMauiApp
```

Building your new MAUI app using this template will save you a lot of time, as you can see from reading [this article](https://auth0.com/blog/add-authentication-to-dotnet-maui-apps-with-auth0/).

Check out [this document to learn more about the MAUI template](https://github.com/auth0/auth0-dotnet-templates/blob/main/docs/auth0maui.md).

## Other Improvements

In addition to the new templates, the new package brings you other internal and external improvements. To mention just a few of them:

- The Blazor WebAssembly template now supports .NET 8.
- The program that registers your application with Auth0 is no longer tied to .NET 7.0.
- A few issues with the auto-registration script have been fixed.

These improvements help provide a better experience when scaffolding and registering your application with Auth0.

<include src="ebook-ads/dotnetIdentity" />

## JetBrains Rider Support

Now you can use the Auth0 Templates with JetBrains Rider! Starting with [version 2024.1](https://www.jetbrains.com/rider/whatsnew/), Rider fully supports custom templates, so now you can choose your preferred IDE to build your .NET applications with Auth0 integrated, regardless of your operating system. This is especially important now that [Visual Studio for Mac is close to its retirement](https://learn.microsoft.com/en-us/visualstudio/mac/what-happened-to-vs-for-mac?view=vsmac-2022).

Previously, Rider [didn't support parameters for custom templates](https://youtrack.jetbrains.com/issue/RIDER-16759), which was a clear barrier to using the Auth0 Templates. Now you can use them just like in Visual Studio!

![Auth0 Blazor Web App Template in JetBrains Rider](https://images.ctfassets.net/23aumh6u8s0i/2wWfc13e4He4h6Ob3H7Eyu/d4fcd35aab3ae5a1ed41f6ec25fc486b/auth0-blazor-web-app-rider.png)

## A Look Back and a Glimpse Forward

The first version of the package was released one year ago. Since then, the project has grown with new templates and integration with the Auth0 CLI for automatic registration of your applications. During this year, the package has been downloaded over 8,000 times, and we have received suggestions and contributions.

We want to continue improving the current templates by adding features and improving the developer experience. Your feedback is very important. Share your thoughts by leaving a message below, or by opening a [new issue](https://github.com/auth0/auth0-dotnet-templates/issues/new/choose) to report problems and request new features.
If you like the project, don't forget [to star it on GitHub](https://github.com/auth0/auth0-dotnet-templates).

New Templates for Building .NET Apps with Auth0 Authentication

Calling a protected API from a .NET 8 Blazor Web App can be a bit tricky. Let's see what the problems are and how to solve them.

Call Protected APIs from a Blazor Web App

Learn the best practices for securing ID, access, and refresh tokens in your .NET MAUI applications and keeping a consistent user experience.

Managing Tokens in .NET MAUI

Support for .NET MAUI is now available in the Auth0 SDK for .NET Desktop and Mobile Applications. Let's have a quick overview.

The [.NET MAUI framework](https://dotnet.microsoft.com/en-us/apps/maui) allows developers to build desktop and mobile applications running on Windows, macOS, iOS, and Android. You can do it using a single programming language (C#) and a single codebase. Now, you can easily integrate these applications with Auth0 using the [Auth0 SDK for .NET Desktop and Mobile Applications](https://github.com/auth0/auth0-oidc-client-net).

## Meet the .NET MAUI Package

If you have already used the Auth0 SDK for .NET Desktop and Mobile Applications, you may know its internal architecture. The SDK relies on a core library, [Auth0.OidcClient.Core](https://github.com/auth0/auth0-oidc-client-net/tree/master/src/Auth0.OidcClient.Core), which implements the fundamental functionality of the authentication SDK, and a set of packages that make this functionality available to the several native UI frameworks supported by .NET: WPF, WinForms, UWP, Xamarin. Now the SDK also supports [MAUI](https://github.com/auth0/auth0-oidc-client-net/tree/master/src/Auth0.OidcClient.MAUI), completing the full range of UI options natively supported by .NET.

The addition of MAUI support to the SDK significantly simplifies the integration of Auth0 authentication and authorization services with your applications.

## Install the SDK

To use the .NET MAUI SDK, you have to install it by running the following command in a terminal window:

```bash
dotnet add package Auth0.OidcClient.MAUI
```

If you use Visual Studio, you can install it through the NuGet Package Manager, as shown in the following picture:

![Auth0 MAUI SDK in NuGet package manager](https://images.ctfassets.net/23aumh6u8s0i/3J75iPqg5IdQdiVPVqXt2Z/7103d1d6b52a7d14ab4020665234de26/autho0-MAUI-SDK-nuget-manager.png)

## Use the SDK

Using the SDK is pretty straightforward. The first thing to do is to register your application in the [Auth0 dashboard](https://manage.auth0.com/). If you don't have an Auth0 account, you can <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for free</a>.


In your MAUI project, create an instance of the `Auth0Client` class by providing the configuration parameters taken from the Auth0 dashboard, as shown in the following code snippet:

```csharp
var client = new Auth0Client(new Auth0ClientOptions()
{
 Domain = "<YOUR_AUTH0_DOMAIN>",
 ClientId = "<YOUR_AUTH0_CLIENT_ID>",
 RedirectUri = "myapp://callback",
 PostLogoutRedirectUri = "myapp://callback",
 Scope = "openid"
});
```

Then, you can invoke the `LoginAsync()` method of the client instance to let the user log in:

```csharp
var loginResult = await client.LoginAsync();
```

On the other side, you can let the user log out by calling the `LogoutAsync()` method:

```csharp
await client.LogoutAsync();
```

## Learn More

Of course, the code shown above represents the very basic usage of the SDK, just to give you a high-level idea of how simple it is to use. In a concrete MAUI application, you must configure it to support the different target platforms and write additional code to handle more complex use cases.

For an example of how to use the MAUI SDK, look at our [.NET MAUI Quickstart](https://auth0.com/docs/quickstart/native/maui).

For a more elaborated tutorial, read [Add Authentication to .NET MAUI Apps with Auth0](https://auth0.com/blog/add-authentication-to-dotnet-maui-apps-with-auth0/). Finally, to learn how to use the MAUI SDK to get access tokens and call an API, check out [Call a Protected API from a .NET MAUI App](https://auth0.com/blog/call-protected-api-from-dotnet-maui-application/).

If you have any questions or comments about the MAUI SDK, leave a comment below.

Auth0 SDK for .NET Desktop and Mobile Applications Supports MAUI

Learn how to authenticate users of your .NET MAUI application using Auth0.

Add Authentication to .NET MAUI Apps with Auth0

Let’s find out how to add Auth0 authentication to the new Blazor application model introduced in .NET 8.

Add Auth0 Authentication to Blazor Web Apps

A new version of the Auth0 Templates for .NET package has been released: discover the new powerful features.

In May, we [announced the release of Auth0 Templates for .NET](https://auth0.com/blog/introducing-auth0-templates-for-dotnet/), a NuGet package that allows .NET developers to scaffold a new project with Auth0 embedded. Today, we are announcing the release of a new powerful version of the package: [Auth0 Templates for .NET 2.1](https://www.nuget.org/packages/Auth0.Templates). 🎉

Go to your terminal window and install the new package by running the following command:

```bash
dotnet new install Auth0.Templates
```

> ⚠️ If you already have a previous version of the package installed on your machine, please uninstall it using the following command before installing the new package:
>
> ```bash
> dotnet new uninstall Auth0.Templates
> ```
>
> 

Let's explore what's new and how you can now create **a working application with Auth0 authentication in less than a minute!**

## Auth0 CLI integration

The most prominent feature introduced in this new release is the integration with the [Auth0 CLI](https://github.com/auth0/auth0-cli), the command line tool that allows you to manage your Auth0 tenants and your application registration from your terminal window.

> 📖 If you are new to the Auth0 CLI, take a look at [the Auth0 CLI Basics Lab](https://developer.auth0.com/resources/labs/tools/auth0-cli-basics) to learn how to use it.

If you have the Auth0 CLI installed on your machine and are already logged in to your Auth0 tenant, you can have your new application automatically registered. Let's do an example to better explain.

### Self-Registration in .NET CLI

Suppose you want to create a Blazor Server application with Auth0 authentication embedded. You can start by running the following command in a terminal window:

```bash
dotnet new auth0blazorserver -o MyBlazorServerApp
```

This command uses the `auth0blazorserver` template to create a Blazor Server application in the `MyBlazorServerApp` folder.

After launching the command, you will see a message similar to the following:

```bash
The template "Auth0 Blazor Server App" was created successfully.

Processing post-creation actions...

Template is configured to run the following action:
Actual command: register-with-auth0.cmd 
Do you want to run this action [Y(yes)|N(no)]?
```

With this message, the template engine asks if you want to register the newly created application with Auth0.

Once you confirm, the new Blazor application will be registered on your current Auth0 tenant. You will see the registration data onscreen for documentation purposes only, as you don't need to configure it manually. In fact, your new application will be automatically configured. All you need to do is run your Blazor application with `dotnet run`!

As you can see, using the integration with the Auth0 CLI allows you to have **an application up and running in less than a minute!**

Of course, you can still pass the configuration options on the command line in case you don't have the Auth0 CLI installed or if you have already registered the application with Auth0. See the [specific options for each template](https://github.com/auth0/auth0-dotnet-templates#usage) for more details.

### Auth0 registration in Visual Studio

If you are using the templates with Visual Studio, you can't leverage the self-registering feature. This is not a limitation of the template, but a restriction imposed by Visual Studio (see [this issue](https://github.com/dotnet/templating/issues/4575) for context).

However, you can run the registration action manually. So, assuming you want to create your Blazor Server application with Visual Studio, select the Auth0 Blazor Server App template as shown in the following picture:

![Auth0 Blazor Server template in Visual Studio](https://images.ctfassets.net/23aumh6u8s0i/4vIKOhrrozhmSDMkYPsEUr/5bd66766af25db726fb3aca5c4d731ab/auth0-blazorserver-app-vs.png)

Then, accept the default values proposed by the template configuration window and create the project.

After the project is created, go to the newly created application and run the following command:

```bash
./register-with-auth0.cmd
```

This command will automatically register your Blazor Server application with Auth0 and configure your application.

> Note: On MacOS you must enable the script to execute. Run the following command before launching the automatic registration:
>
> ```bash
> chmod +x register-with-auth0.cmd
> ```

## .NET 8 Support

The new release of Auth0 Templates for .NET supports .NET 8 by default for most templates. When you use the `dotnet new` command without specifying a framework version, you will get a .NET project with .NET 8 as the target framework. This is also the default .NET version when you are using Visual Studio, as shown below:

![Auth0 Template for ASP.NET Core MVC targeting .NET 8](https://images.ctfassets.net/23aumh6u8s0i/1mnYGKi2t006MED0sC2raQ/902bd9cb7b94be9e4b0d4c6c14b9d3ea/auth0-mvc-app-vs-options.png)

Blazor templates do not currently support .NET 8, but they still target .NET 7. The reason for this choice depends on the new .NET 8 Blazor model, which provides a more fluid approach between the Server and the WebAssembly hosting models. Currently, there are no official guidelines on how to integrate OpenID Connect with the new Blazor model. If you are interested in this topic, you can follow [this thread in the Auth0 Community forum](https://community.auth0.com/t/net-8-0-blazor/119691) to stay updated.

<include src="ebook-ads/dotnetIdentity" />

## Minimal API Template

The [Auth0 Templates for .NET package](https://www.nuget.org/packages/Auth0.Templates/) contains four templates since its first release:

- ASP.NET Core MVC
- ASP.NET Core Web API
- Blazor Server
- Blazor WebAssembly (ASP.NET Core hosted)

This new release adds a new template for [ASP.NET Core minimal API](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis). To use this template, add the `--minimal` option to the `dotnet new auth0webapi` command, as shown in the following example:

```bash
dotnet new auth0webapi -o MyWebAPI --minimal
```

This command creates a minimal API project in the `MyWebAPI` folder, and if you have the .NET CLI installed on your machine, it also registers it with Auth0.

In Visual Studio, you can simply select the *Use minimal API* checkbox as shown in the following picture:

![Options for the Auth0 ASP.NET Core Web API template in Visual Studio](https://images.ctfassets.net/23aumh6u8s0i/30Wl7yaOdnuWBhmdbRZa3v/259aa7ca9bb215da9fba8e62bfee8d87/auth0-webapi-app-vs-options.png)

## Looking Ahead

We hope that these new features will help .NET developers set up their new applications with Auth0 more easily than before. Our goal for the next release is to include a template for the missing Blazor model and add templates for other .NET application types.

Your feedback is valuable. If you experience a problem or have a request, please [open an issue](https://github.com/auth0/auth0-dotnet-templates/issues/new/choose) on the project's GitHub repository.

Remember that [Auth0 Templates for .NET](https://github.com/auth0/auth0-dotnet-templates) is an open source project, so your contribution is welcome! If you think you can help, check out [our contribution policy](https://github.com/auth0/auth0-dotnet-templates/tree/main#contributing) and get involved.

Auth0 Templates for .NET: A New Powerful Version Released

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

A quickly implemented Auth0 Action can enhance security by requiring users to log in from trusted IP addresses or blocks.

Ensure Users Log in from Trusted Networks with Auth0 Actions

Let’s explore the new features brought by .NET 8 to support authentication and authorization in your applications.

The release of **.NET 8** is just around the corner. Among the amazing features it brings to developers, it offers a minor revolution in support for authentication and authorization: moving ASP.NET Core Identity from a page-oriented approach to an API-oriented approach.

Let's explore what's going on.

## ASP.NET Core Identity and Token-based Authentication

ASP.NET Core developers have the built-in [ASP.NET Core Identity](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity) framework to add support for local authentication and authorization. The identity framework includes everything that developers typically need to authenticate and authorize users against a local user store. By default, a SQL Server database is created on Windows and a SQLite database is created on macOS, but you can change it to the DBMS of your choice.

The ASP.NET Core Identity framework is designed for server-rendered web applications, such as ASP.NET Core MVC or Razor Pages applications, and has challenges with SPAs, where token-based authentication seems more appropriate. To address this problem, Microsoft has provided built-in project templates for SPAs based on Angular and React with Identity Server support since .NET Core 3.1. However, the .NET community [has not been totally happy with this approach](https://github.com/dotnet/aspnetcore/issues/42158). To [meet the community's demands](https://github.com/dotnet/aspnetcore/issues/42158#issuecomment-1481742187), Microsoft removed the default support for Identity Server in .NET 8 and redesigned the internal architecture of ASP.NET Core Identity to be more suitable for SPAs and native apps. .NET 8 introduces a new set of Identity API endpoints and support for token-based authentication. But let's go in order.

## Bearer Token Authentication Handler

The first building block of this new infrastructure is the new [bearer token authentication handler](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.bearertokenextensions.addbearertoken). This handler is similar to the classic [cookie authentication handler](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.cookieextensions.addcookie) that ASP.NET Core Identity uses by default. The cookie authentication handler is responsible for two things:

- Creating a new session cookie after the user authenticates.
- Building a `ClaimsPrincipal` user object based on a valid session cookie received in the incoming HTTP request.

Similarly, the bearer token authentication handler is responsible for:

- Creating a new token after the user authenticates.
- Building a `ClaimsPrincipal` user object based on a valid token received in the incoming HTTP request.

In other words, the bearer token handler mimics the behavior of the cookie handler to manage authenticated sessions based on a token instead of a cookie.

> Note that the tokens generated by the bearer token handler are not in JWT format. Also, they don't follow any specific standard. While the documentation mentions [access tokens](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.bearertoken.accesstokenresponse.accesstoken?view=aspnetcore-8.0) and [refresh tokens](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.bearertoken.accesstokenresponse.refreshtoken?view=aspnetcore-8.0), they do not implement the [OAuth 2.0 authorization framework](https://oauth.net/2/).

How can this bearer token handler be used in practice?

Consider the following code:

```csharp
// Program.cs

using Microsoft.AspNetCore.Authentication.BearerToken; //👈
using System.Security.Claims;
 
var builder = WebApplication.CreateBuilder(args);
 
builder.Services
 .AddAuthentication()
 .AddBearerToken(); //👈
builder.Services.AddAuthorization();
 
var app = builder.Build();
 
app.MapGet("/login", (string username) =>
 {
 var claimsPrincipal = new ClaimsPrincipal(
 new ClaimsIdentity(
 new[] { new Claim(ClaimTypes.Name, username)},
 BearerTokenDefaults.AuthenticationScheme //👈
 )
 );

 return Results.SignIn(claimsPrincipal);
 });
 
app.MapGet("/user", (ClaimsPrincipal user) =>
 {
 return Results.Ok($"Welcome {user.Identity.Name}!");
 })
 .RequireAuthorization();
 
app.Run();
```

This application defines two API endpoints:

- The `/login` endpoint creates a `ClaimsPrincipal` user object based on the username sent in the HTTP request and returns the result of signing in.
- The `/user` endpoint returns the username of the authenticated user.

Note the highlighted lines in the code. You have a reference to the new `Microsoft.AspNetCore.Authentication.BearerToken` namespace, which gives you access to the `BearerTokenDefaults.AuthenticationScheme` value. You also configure the bearer token middleware by using the `AddBearerToken()` extension method.

Now, assume you call the `login` endpoint with curl, as shown below:

```bash
curl 'https://<YOUR_HOST>/login?username=joe'
```

You will see a result like the following:

```json
{
 "token_type": "Bearer",
 "access_token": "CfDJ8Ha5YkqG...omitted content...",
 "expires_in": 3600,
 "refresh_token": "CfDJ8Ha5YkqG...omitted content..."
}
```

This JSON contains an access token and a refresh token that you can use to make your calls to the protected APIs exposed by your application. For example, you can now call the protected `/user` endpoint as follows:

```bash
curl -i https://<YOUR_HOST>/user \
-H 'Authorization: Bearer CfDJ8Ha5YkqG...omitted content...'
```

And you will get the following response:

```json
Welcome joe!
```

In summary, the bearer token authentication handler makes it very easy to set up token-based authentication. This is the building block of the whole ASP.NET Core Identity transition to token-based authentication.

## Identity API Endpoints

The second step in adding token-based authentication to ASP.NET Core Identity is to introduce the Identity API endpoints. Basically, this is an API version of the actions that you can perform with ASP.NET Core Identity through the classic web UI. Once you enable the [Identity API endpoints](https://github.com/dotnet/aspnetcore/blob/main/src/Identity/Core/src/IdentityApiEndpointRouteBuilderExtensions.cs), you will get endpoints like `/register`, `/login`, `/forgotPassword`, `confirmEmail`, etc.

The Identity API endpoints solve two of the most complained problems:

- You can build your own UI for user authentication and account management while maintaining the overall UI style of your application.
- After authentication, your app can get access tokens instead of cookies, so it's a more suitable approach for SPAs and native applications.

> Keep in mind that the Identity API endpoints do not implement [OpenID Connect (OIDC)](https://auth0.com/docs/authenticate/protocols/openid-connect-protocol). They simply expose the standard functionality provided by the ASP.NET Core Identity UI through a custom API. They are intended for first-party authentication.

Adding the Identity API endpoints to an ASP.NET Core application relies on two new methods:

- `AddIdentityApiEndpoints()`, which configures the token-based authentication using the bearer token handler in addition to the cookie authentication, and adds a set of identity services.
- `MapIdentityApi()`, which actually adds the Identity endpoints to your application.

The code in your `Program.cs` file will look like the following:

```csharp
// Program.cs

using System.Security.Claims;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthorization();

builder.Services.AddDbContext<ApplicationDbContext>(
 options => options.UseSqlite(builder.Configuration["ConnectionString"]));

builder.Services.AddIdentityApiEndpoints<IdentityUser>()
 .AddEntityFrameworkStores<ApplicationDbContext>();

var app = builder.Build();

app.MapIdentityApi<IdentityUser>();

app.MapGet("/user", (ClaimsPrincipal user) =>
 {
 return Results.Ok($"Welcome {user.Identity.Name}!");
 })
 .RequireAuthorization();

app.Run();
```

Your client will be able to register a user by calling the `/register` endpoint, authenticate the user through the `/login` endpoint, and so on.

While the Identity API endpoints seem to solve the two main complaints about the classic ASP.NET Core Identity, there are [some concerns about using them in a production context](https://andrewlock.net/should-you-use-the-dotnet-8-identity-api-endpoints/), mainly on the security and scalability side.

## Blazor Identity UI

In addition to the changes to ASP.NET Core Identity, .NET 8 integrates the authentication framework into the Blazor project template. You can create a new .NET 8 Blazor application with identity support by running the following command:

```bash
dotnet new blazor -au Individual
```

You will get a Blazor application with everything you need to manage users and authentication locally. You will get a SQLite database to store the user accounts. You will get a SQL Server database if you use Visual Studio to scaffold the application instead of the .NET CLI. You also will get all the pages that allow users to register, authenticate, and manage their account.

The following image shows the built-in login page of a Blazor app:

![Blazor login page](https://images.ctfassets.net/23aumh6u8s0i/3J8DlVMk9qsHw9tLIAwpue/cd94d62d51ce5dc6627bda3c75d14a42/blazor-identity-ui-login.png)

The user authentication and management pages that implement the Blazor Identity UI are not Razor pages as it happens with the classic ASP.NET Core Identity, but [Razor components](https://learn.microsoft.com/en-us/aspnet/core/blazor/components). The template provides you with the source code for all of the UI components in the `Pages/Account` folder of the project. This allows you to customize them according to your application design.

<include src="ebook-ads/dotnetIdentity" />

## Custom Authorization Policies Simplification

Apart from the new features related to ASP.NET Core Identity, .NET 8 introduces a simplification to the definition of custom authorization policies. Previously, you had to write a lot of code to define a parameterized authorization policy to apply to an API endpoint.

For example, suppose you want to define a policy for an endpoint that only authorizes users over the age of 18 and that can be used as shown below:

```csharp
[ApiController]
[Route("api/[controller]")]
public class DrinkController : Controller
{
 [MinimumAgeAuthorize(18)]
 [HttpGet("beer")]
 public string BeerDispenser(ClaimsPrincipal user) => $"Here is your beer, {user.Identity?.Name}!";
}
```

With previous .NET versions, to implement your custom authorization policy, you must write the code outlined in the following code snippet:

```csharp
class MinimumAgeAuthorizeAttribute : AuthorizeAttribute
{
 ...
}

class MinimumAgePolicyProvider : IAuthorizationPolicyProvider
{
 ...
}

class MinimumAgeRequirement : IAuthorizationRequirement
{
 ...
}

class MinimumAgeAuthorizationHandler : AuthorizationHandler<MinimumAgeRequirement>
{
 ...
}
```

You must define an `AuthorizeAttribute`. Then you need to implement an `IAuthorizationPolicyProvider` to handle your custom policy and an `IAuthorizationRequirement` to define the requirement. Finally, you have to implement the `AuthorizationHandler`.

The code snippet shown above outlines the classes you need to implement. To see an example of the actual implementation, take a look at this [code sample](https://gist.github.com/captainsafia/309e408cb5e2c2e5acd44d2e19f7f88e).

Using the new `IAuthorizationRequirementData` interface, your implementation code becomes as follows:

```csharp
class MinimumAgeAuthorizeAttribute : AuthorizeAttribute, IAuthorizationRequirement, IAuthorizationRequirementData
{
 public MinimumAgeAuthorizeAttribute(int age) => Age =age;
 public int Age { get; }

 public IEnumerable<IAuthorizationRequirement> GetRequirements()
 {
 yield return this;
 }
}

class MinimumAgeAuthorizationHandler : AuthorizationHandler<MinimumAgeAuthorizeAttribute>
{
 protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, MinimumAgeAuthorizeAttribute requirement) 
 {
 ...
 }
}
```

You only need to implement two classes instead of four as in the previous example. See [here](https://gist.github.com/captainsafia/7c54e92d12df695ff0908e989fb8531f) for the complete code.

## Summary

Throughout this article, you have learned about the new features that .NET 8 brings to support authentication and authorization. Most of these features are related to the extension of the ASP.NET Core Identity framework to support token-based authentication, which paves the way for authentication in SPAs and native applications.

As a side effect, you get access to the bearer token authentication handler, which allows you to issue access tokens, and to the Identity API endpoints, which allow you to embed authentication support in your Web API.

In addition, the Blazor project template now supports authentication through the Identity API endpoints and a rich set of Razor components designed for user authentication and management.

Finally, the new `IAuthorizationRequirementData` interface allows you to create custom authorization policies with less code.

.NET 8: What's New for Authentication and Authorization

Learn how to validate a JSON Web Token (JWT) in different contexts using C# in .NET.

**JSON Web Tokens (JWTs)** have become very popular. Many developers use them in their applications for authentication and authorization purposes, but not all of them really know why and how to validate their JWTs.

This article will explain why you need to validate a JWT, what it means in general, and give you an overview of the many ways you can do it in the .NET platform.

## What Are JWTs?

If you landed on this article, you probably know what a JSON Web Token is. If not, [here is a great introduction to JWTs](https://jwt.io/introduction) and [a tool to decode them](https://jwt.io/#debugger-io).

Simply put, JSON Web Token is an [open standard](https://datatracker.ietf.org/doc/html/rfc7519) that defines how to share information between parties using the [JSON format](https://datatracker.ietf.org/doc/html/rfc8259). The [JWT structure](https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-token-structure) consists of three concatenated Base64 url-encoded strings, separated by dots: the header, the payload, and the signature The information carried by a JWT is **digitally signed so you can verify its origin and trust it**. The digital signature also guarantees the integrity of the information, but it doesn't guarantee privacy unless explicitly encrypted.

Besides this, the JWT specification doesn't define the specific purpose of a token. While most developers think of authentication when dealing with JWTs, this is not an intrinsic property of tokens in the JWT format. JWT is just a format. The meaning of the token depends on the specific context or application.

For example, in the [OpenID Connect](https://openid.net/developers/how-connect-works/) (OIDC) context, the JWT format is used for the ID token, which is the token that proves a user is authenticated. In the [OAuth 2.0](https://auth0.com/docs/authenticate/protocols/oauth) context, the [JWT format can optionally be used for the access token](https://datatracker.ietf.org/doc/html/rfc9068), which is the token that allows a client application to access a specific resource on behalf of the user.

> To learn more about ID and access tokens and their differences, you can read [this blog post](https://auth0.com/blog/id-token-access-token-what-is-the-difference/) or watch [this video](https://www.youtube.com/watch?v=vVM1Tpu9QB4) instead.

<include src="ebook-ads/JwtHandbook" />

## What Does Token Validation Mean?

The main purpose of a JWT is to carry information that the recipient can trust. So, the first thing your application needs to do when it receives a JWT is to ensure that the information it carries is trustworthy. This is where validation comes in.

In short, validating a JSON Web Token means ensuring that the token has the structure defined in the standard specification and that you can trust the information it carries.

The JWT validation is based on the following five criteria:

- **Token structure**. The first check is about the token's structure. Does the token match the structure of a JSON Web Token? If the token doesn't follow the standard guidelines, it's not valid.

- **Token integrity**. The next check is for the token's integrity. Has the token been tampered with? You can verify this by checking the signature. If you verify that the token's signature is valid, then it has not been altered in any way.
- **Token expiration**. JWTs have an expiration time defined in the `exp` claim. Is the token expired when it has been received? If a token has expired, you should no longer trust its contents.
- **Expected authority**. The next check is to verify that the token was issued and signed by the expected sender (authority). There are two steps to this check:
 - Verify that the authority is the one expected by your application by comparing it to the `iss` claim (issuer).
 - Verify that the key used to sign the JWT actually belongs to the expected authority.
- **Expected audience**. Finally, verify that the token is intended for your application. In other words, you should check that the `aud` claim matches with the value that identifies your application. For example, in an ID token, the value for the audience is the client ID; in an access token in JWT format, the value for the audience is the [API identifier](https://auth0.com/docs/get-started/apis/api-settings#general-settings).

> To learn more about [digital signatures, read this article](https://auth0.com/blog/how-to-explain-public-key-cryptography-digital-signatures-to-anyone/). Check out [this article](https://auth0.com/blog/rs256-vs-hs256-whats-the-difference/) for the differences between the signing algorithms used in a JWT.

Token validation doesn't involve the custom information carried by the token. This is an application-specific logic, which is out of the scope of token validation. For example, validating an ID token does not include verifying that the user's email address in the `email` claim exists.

## Validate a JWT Using an Auth0 SDK

Now that you know what validating a JWT means, you are ready to learn how to validate your tokens in .NET.

Before jumping into the validation code, you should evaluate whether you really need to explicitly validate the JWTs you receive from an issuer like Auth0. Depending on the specific application, you may want to use an Auth0 SDK, which will take care of all the validation steps for you. For example, if you are developing an ASP.NET Core MVC application or a Blazor Server application, you can use the [Auth0 ASP.NET Core Authentication SDK](https://github.com/auth0/auth0-aspnetcore-authentication). This SDK will take care of the entire process of obtaining the JWT tokens for your application, including token validation. Check out [this article](https://auth0.com/blog/exploring-auth0-aspnet-core-authentication-sdk/) for an overview of this specific SDK.

So, if your application can benefit from an SDK, the best move is to write less code and get the JWT validation for free. Take a look at [this article to learn which Auth0 SDK is right for your .NET application type](https://auth0.com/blog/choose-the-right-dotnet-sdk-for-auth0/). 

## Using the ASP.NET Core Middleware

If, for some reason, you can't use an Auth0 SDK, you can configure your ASP.NET Core application by using two middleware:

- The [OpenIdConnect middleware](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.OpenIdConnect), which allows your ASP.NET Core web applications to authenticate users and get ID and access tokens via [OpenId Connect](https://openid.net/developers/how-connect-works/).
- The [JwtBearer middleware](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.JwtBearer), which enables your ASP.NET Core web API to handle access tokens.

Both middleware provide you with a convenient way to obtain and validate JWT tokens. The following code snippet shows an example of how to configure OpenIdConnect middleware:

```csharp
// Program.cs

var builder = WebApplication.CreateBuilder(args);


builder.Services.AddAuthentication(options => {
 options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
 options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
 options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
 })
 .AddCookie()
 .AddOpenIdConnect("Auth0", options => {
 options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
 options.ClientId = builder.Configuration["Auth0:ClientId"];
 options.CallbackPath = new PathString("/callback");
 });

// ...other code...
```

The next example shows how to use the JwtBearer middleware:

```csharp
// Program.cs

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
 .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
 {
 options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
 options.Audience = builder.Configuration["Auth0:Audience"];
 });

// ...other code...
```

In both cases, by configuring the `Authority` option, you implicitly ask the middleware to validate your tokens. The middleware will use this value to retrieve the issuer's signing key, which is needed to validate the token's signature. All the other required validation steps are performed automatically. There is nothing else you need to do.

### Simplified configuration for the JwtBearer middleware

Starting with .NET 7, you can [use the JwtBearer middleware in a simplified way](https://auth0.com/blog/whats-new-in-dotnet-7-for-authentication-and-authorization/#Simplified-Configuration). You define your validation values in the `appsettings.json` file, as in the following example:

```json
// appsettings.json

{
 "Logging": {
 "LogLevel": {
 "Default": "Information",
 "Microsoft.AspNetCore": "Warning"
 }
 },
 "AllowedHosts": "*",
 "Authentication": {
 "Schemes": {
 "Bearer": {
 "Authority": "https://{DOMAIN}",
 "ValidAudiences": [ "{AUDIENCE}" ],
 "ValidIssuer": "{DOMAIN}"
 }
 }
 }
}
```

Then you can simply add the middleware to your ASP.NET Core application, as follows:

```csharp
// Program.cs

// ...existing code...

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication().AddJwtBearer();

// ...existing code...
```

The behavior is exactly the same as before but with much less code.

### Custom validation with the ASP.NET Core middleware

If you have specific needs, you can customize the JWT validation using the `TokenValidationParameters` option. For example, if you already have the issuer's public key stored on your file system, you can configure your middleware as shown in the following example:

```csharp
// Program.cs

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
 .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
 {
 options.Audience = builder.Configuration["Auth0:Audience"];
 options.TokenValidationParameters = 
 new Microsoft.IdentityModel.Tokens.TokenValidationParameters
 {
 ValidateIssuer = true,
 ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}",
 ValidateIssuerSigningKey = true,
 IssuerSigningKey = new X509SecurityKey(new X509Certificate2(certificateFilePath)),
 ValidateLifetime = true
 };
 });

// ...other code...
```

You can see that the `Audience` option is still there while the `Authority` option is missing. Instead of the `Authority` option, you find the `TokenValidationParameters` option, which is assigned an instance of the `TokenValidationParameters` class. The properties of this instance define what to check in order to complete the JWT validation. Specifically, you ask to validate the issuer (`ValidateIssuer`) and provide the value to match with (`ValidIssuer`). You ask to validate the issuer's signature (`ValidateIssuerSigningKey`) and provide the issuer's public signing key (`IssuerSigningKey`) embedded in a certificate stored in the file system. And finally, you ask to check the expiration time (`ValidateLifetime`).

You can see how removing the `Authority` option from the middleware configuration forces you to manually specify what to check in order to validate the token.

## Validate a JWT “By Hand”

In case you can't use the ASP.NET Core middleware, for example, when you are not developing a web application, don't get desperate. .NET gives you what you need, although this requires some effort on your side.

### Validate your token

First, you need to install the `Microsoft.IdentityModel.Tokens` package from NuGet:

```bash
dotnet add package Microsoft.IdentityModel.Tokens
```

This package provides everything you need for token manipulation, including validation, of course.

Have a look at the following function:

```csharp
public bool ValidateToken(
 string token, 
 string issuer, 
 string audience, 
 ICollection<SecurityKey> signingKeys,
 out JwtSecurityToken jwt
)
{
 var validationParameters = new TokenValidationParameters {
 ValidateIssuer = true,
 ValidIssuer = issuer,
 ValidateAudience = true,
 ValidAudience = audience
 ValidateIssuerSigningKey = true,
 IssuerSigningKeys = signingKeys,
 ValidateLifetime = true
 };

 try
 {
 var tokenHandler = new JwtSecurityTokenHandler();
 tokenHandler.ValidateToken(token, validationParameters, out SecurityToken validatedToken);
 jwt = (JwtSecurityToken)validatedToken;
 
 return true;
 } catch (SecurityTokenValidationException ex) {
 // Log the reason why the token is not valid
 return false
 }
}
```

This function takes a token and validates it by using the other parameters: the issuer, the audience, and the signing keys. If the token is valid, it returns `true` and provides a `JwtSecurityToken` instance representing the token as the `jwt` output parameter.

Once again, you see the `TokenValidationParameters` class, which allows you to define the validation criteria. This time there is no implicit validation. You need to specify all the required validation criteria and the valid values. Then you create a token handler (`JwtSecurityTokenHandler`) and use it to validate the token against the validation parameters. If the validation succeeds, you get an object representing the token, which you assign to the output parameter after casting to `JwtSecurityToken`. Finally, the function returns `true`.

If the validation fails, it should log the reason for the failed validation and return `false`.

### Get the signing keys

The `ValidateToken()` function expects you to pass the basic information for the token validation: the token issuer identifier, the audience, and the issuer's signing keys. You may have all this information on hand or need to retrieve some of it. For example, you can obtain the signing key of the issuer online. According to the [OIDC standard](https://openid.net/specs/openid-connect-discovery-1_0.html), you can find the set of keys (*JSON Web Key Sets*) to verify the issuer's signatures at a public and well-defined URL: `https://{DOMAIN}/.well-known/openid-configuration`.

Read [this document to learn more about the JSON Web Key Sets](https://auth0.com/docs/secure/tokens/json-web-tokens/locate-json-web-key-sets).

To validate a JWT using the `ValidateToken()` function, you must first retrieve the signing key from this URL. As you can see, things start to get complex. This is why I suggest using an Auth0 SDK in the first place, or at least the ASP.NET Core middleware, if possible.

However, if using one of these tools is not feasible in your specific case, here is what you need to do to get the issuer's signing keys.

First, you need to install another package from NuGet: the `Microsoft.IdentityModel.Protocols.OpenIdConnect` package:

```bash
dotnet add package Microsoft.IdentityModel.Protocols.OpenIdConnect
```

This package provides you with the `ConfigurationManager` class, which helps you retrieve the JSON Web Key Sets. The following code shows you how to obtain the signing key of your JWT issuer:

```csharp
var configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(
 $"https://{builder.Configuration["Auth0:Domain"]/.well-known/openid-configuration}",
 new OpenIdConnectConfigurationRetriever(),
 new HttpDocumentRetriever());

 var discoveryDocument = await configurationManager.GetConfigurationAsync();
 var signingKeys = discoveryDocument.SigningKeys;
```

Once you have the signing keys, you are ready to use the `ValidateToken()` function.

## Recap

Throughout this article, you have learned what JWT validation is and why you need to do it. You also learned that as a .NET developer, you have many options for validating the JWTs your application receives: from a zero-code approach to an almost manual validation.

With the Auth0 SDKs, you get the JWT validation for free. No specific code is required. The SDKs validate tokens for you.

Using the ASP.NET Core middleware, OpenIdConnect and JwtBearer, you get implicit token validation in the default cases. However, you can customize your validation criteria if you are dealing with special cases.

In case you need full control over the validation process, you can rely on the `Microsoft.IdentityModel.Tokens` package for the JWT manipulation and validation and on the `Microsoft.IdentityModel.Protocols.OpenIdConnect` package for retrieving the issuer's signing keys.

Of course, the suggestion is to delegate as much as possible to the SDKs and middleware because the less code you write, the fewer bugs you may create 🙂.

How to Validate JWTs in .NET

Create your .NET applications secured with Auth0 in less than a minute with Auth0 Templates for .NET.

<div class="alert alert-info alert-icon">
 
 A new version of Auth0 Templates for .NET is available! 
Check out <a href="/blog/auth0-templates-for-dotnet-powerful-version/">Auth0 Templates for .NET: A New Powerful Version Released</a> to learn what new features it brings to you.
 
 </div>

Project templates are a handy way to scaffold an application in minutes, if not seconds. .NET developers are used to templates since Microsoft provides several built-in project templates for .NET through the [.NET SDK](https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-new-sdk-templates) or [Visual Studio](https://learn.microsoft.com/en-us/visualstudio/ide/creating-project-and-item-templates).

Now you have .NET templates with Auth0 embedded, including the right Auth0 SDK and best practices for a given type of application! You can build your .NET projects integrated with Auth0 in seconds using the .NET CLI or the IDE you prefer: Visual Studio or Visual Studio Code.

## What Is Auth0 Templates for .NET?

[Auth0 Templates for .NET](https://github.com/auth0/auth0-dotnet-templates) is a project that provides you with a set of project templates to help you scaffold your application with Auth0 support for authentication and authorization. Currently, the project offers templates for the following application types:

- ASP.NET Core MVC
- ASP.NET Core Web API
- Blazor Server
- Blazor WebAssembly (ASP.NET Core hosted)

More templates will be added in the near future. The templates target .NET 7 and allow you to create your applications by using the typical approach you are accustomed to using the built-in templates.

## Install the Package

The Auth0 Templates for .NET project uses the [modern template approach](https://learn.microsoft.com/en-us/dotnet/core/tools/custom-templates), which guarantees high compatibility across different development environments and operating systems. This means that you can use the templates with your preferred development environment: .NET CLI, Visual Studio for Windows and Mac, or Visual Studio Code.

Even JetBrains Rider is supported, but at the time of writing, there is still an [issue with parameter support](https://youtrack.jetbrains.com/issue/RIDER-16759) that prevents the full power of the templates from being used.

To install the [Auth0 Templates for .NET NuGet package](https://www.nuget.org/packages/Auth0.Templates/), run the following command in a terminal window:

```bash
dotnet new install Auth0.Templates::2.0.1
```

Once the package is installed, use your preferred IDE to create your application.

## Create Your .NET Project

Let's see how you can use the templates to create a new .NET application. First, there are some preliminary steps to take. The templates assume that you have already registered your application with Auth0 and have all the necessary configuration settings at hand.

To integrate your application with Auth0, you need an Auth0 account. You can <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free one now</a>. Then you need to [register your application](https://auth0.com/docs/get-started/auth0-overview/create-applications) or [your API](https://auth0.com/docs/get-started/auth0-overview/set-up-apis) in the Auth0 dashboard. The registration step will return some data that you will use to set up your app through the templates. Basically, this data is a subset of the following:

- the Auth0 domain, 
- the client ID, 
- the client secret, 
- the API identifier or audience.

Once you have this data from the Auth0 dashboard, you are ready to use the Auth0 templates for building your app.

### Use the templates in .NET CLI

You can leverage the `dotnet new` command to list the available templates. For example, you can run the following command to get the list of available Auth0 templates:

```bash
dotnet new list auth0
```

As a result of this command, you should see the following list:

```bash
Template Name Short Name Language Tags 
---------------------------- ----------------- -------- ----------------------------
Auth0 ASP.NET Core Web API auth0webapi [C#] Web/WebAPI/Auth0 
Auth0 ASP.NET Core Web App auth0webapp [C#] Web/MVC/Razor Pages/Auth0 
Auth0 Blazor Server App auth0blazorserver [C#] Web/Blazor/Auth0 
Auth0 Blazor WebAssembly App auth0blazorwasm [C#] Web/Blazor/WebAssembly/Auth0
```

Suppose you want to learn the CLI syntax for using the Blazor Server template. You run the following command in your terminal:

```bash
dotnet new auth0blazorserver --help
```

This command will show you all the options you can provide to build an already configured Blazor Server application.

To create a new Blazor Server app through the Auth0 template, use the following command:

```bash
dotnet new auth0blazorserver \
 --domain <YOUR_AUTH0_DOMAIN> \
 --client-id <YOUR_CLIENT_ID> \
 -o MyBrandNewApp
```

> The line continuation character (`\`) shown above is just for presentation purposes. Use the appropriate character for your command line shell if you want to use it in your operating system.

Replace the placeholders `<YOUR_AUTH0_DOMAIN>` and `<YOUR_CLIENT_ID>` with the actual values you got when registering your app in the Auth0 dashboard. This command will create your Blazor Server application in the `MyBrandNewApp` folder.

After creating the app, you can run it and test authentication support in a minute!

> Read [this document to learn how to use the available Auth0 templates](https://github.com/auth0/auth0-dotnet-templates/tree/main#usage).

### Use the templates in Visual Studio

The templates installed with the above command are also available in Visual Studio. Select the Auth0 template for the app you want to create, as shown in the following picture for Visual Studio for Windows:

![Auth0 templates in Visual Studio for Windows](https://images.ctfassets.net/23aumh6u8s0i/5A53ehX7663L0HxkB65Aos/2cbbbb09f3ad4c4979e052f4f02b2ac2/auth0-blazorserver-app-vs.png)

The following picture comes from Visual Studio for Mac:

![Auth0 templates in Visual Studio for Mac](https://images.ctfassets.net/23aumh6u8s0i/7nyet9ozGX1bk4Kf4AFipb/00d4a3fbb394bde20e132526244161ce/auth0-blazorserver-app-vs-mac.png)

You will then be prompted for the registration information, as shown in the following picture (Visual Studio for Windows):

![Auth0 template options in Visual Studio for Windows](https://images.ctfassets.net/23aumh6u8s0i/3YMXIB1UY58WD2iFCeydyX/8e03f036e38cc6a6a5136328c3077947/auth0-blazorserver-app-vs-options.png)

This is the corresponding screen on Visual Studio for Mac:

![Auth0 template options in Visual Studio for Mac](https://images.ctfassets.net/23aumh6u8s0i/2rctCGwBn68ACigGj6wf2L/98b0805b10d53e76d49014f53c9123f9/auth0-blazorserver-app-vs-mac-options.png)

Next, you specify the project's name and where you want to save it, as you would with standard templates. That's it! Once the application is created, you can run it and test authentication.

> Read [this document to learn how to use the available Auth0 templates](https://github.com/auth0/auth0-dotnet-templates/tree/main#usage).

<include src="ebook-ads/dotnetIdentity" />

## Looking Forward

This is the first release of the [Auth0 Templates for .NET](https://www.nuget.org/packages/Auth0.Templates/) package, but we want to add new templates and improve the developer experience as well. Your feedback is highly appreciated, so please leave your comments below and let us know what you think about this project.

The [Auth0 Templates for .NET project](https://github.com/auth0/auth0-dotnet-templates) is open source, so your contribution is also welcome! If you think you can help with this project, check out [our contribution policy](https://github.com/auth0/auth0-dotnet-templates/tree/main#contributing) and get involved.

Introducing Auth0 Templates for .NET

arthur-bellore

I’m a tech content creator. I enjoy breaking up seemingly complicated topics into easy-to-understand pieces for people to read. When I’m not in front of a computer, you’ll usually find me reading books.

Cybersec Writer

Arthur Bellore

Transport Layer Security (TLS) is the cryptographic protocol behind pretty much any computer network used today: from web browsing to email, APIs, and VoIP. But how exactly does it work?

## SSL vs. TLS

SSL, or Secure Sockets Layer, is the predecessor to TLS. It was a cryptographic protocol developed by Netscape in 1994, but since it had serious flaws, it was never released to the public. SSL 2.0 was released publicly one year later, in 1995, but it, too, was found to have serious flaws. Finally, SSL 3.0 was rebuilt from the ground up and released in 1996.

Microsoft, who had its own version of the protocol, and Netscape agreed to hand over the project to the Internet Engineering Task Force (IETF) and make it an open standard. As part of the deal, the name was changed to TLS, Transport Layer Security, to signify that it no longer had ties with Netscape.

The first upgrade to SSL 3.0 was published in 1999 in [RFC 2246](https://datatracker.ietf.org/doc/html/rfc2246) as TLS 1.0. Tim Dierks, the editor of RFC 2246, has said [in his blog](https://tim.dierks.org/2014/05/security-standards-and-name-changes-in.html) that TLS 1.0 was really SSL 3.1, but they changed the name “so it wouldn’t look the IETF was just rubberstamping Netscape’s protocol.” Indeed, if you look at RFC 2246, it says:

This document describes TLS Version 1.0, which uses version { 3, 1 }. Version value 3.1 is historical: TLS version 1.0 is a minor modification to the SSL 3.0 protocol, which bears the version value 3.0.

TLS became the standard of encryption and authentication over computer networks, and it’s still being used today. The most recent version of the protocol is TLS 1.3, which was released in August 2018.

### What is the difference between SSL and TLS?

SSL hasn’t been updated since its release in 1996, and it was deprecated in 2015 in [RFC 7568](https://datatracker.ietf.org/doc/html/rfc7568). Most [modern browsers disable it by default](https://en.wikipedia.org/wiki/Version_history_for_TLS/SSL_support_in_web_browsers) or don’t support it outright anymore.

Despite this, because of the association between the two, many people still use the term SSL when they really mean to say TLS. Vendors typically use the same terms their target customers use to facilitate messaging, so their marketing collateral generally contains terms such as “SSL/TLS” or “SSL,” even though SSL is deprecated.

We now know that SSL and TLS are different things, but for the remainder of this article, SSL will be used interchangeably with TLS to match its everyday usage.

## Why SSL/TLS Was Created

For two computers to communicate with each other, they must perform a set of agreed-upon operations in a specific order. A **protocol** is what dictates those operations. The HTTP protocol is the protocol that web servers and clients use to establish a connection and communicate with each other through the Internet.

It works roughly as follows:

1. The server listens for new connections on port 80
2. The client connects to the server, and this starts a chain of operations as set forth by the HTTP protocol
3. The client sends a GET request to the server; the server receives the request, processes it, then sends back a response: headers and index.html, plus other content it might need to serve (CSS files, JavaScript files, cookies, etc.) for the client to render the content correctly.

This works to distribute content between two remote computers, but there is a problem: HTTP was intended to expand the local knowledge management tools throughout the multiple computers at CERN in the late 1980s, so it was designed as a clear text protocol.

Because it’s clear text, a malicious actor could insert themselves between client and server and potentially read sensitive information, such as credit card numbers or passwords, or they could intercept the client’s requests and serve back malicious files pretending to be server.

As the Internet evolved and the number of sensitive information flying around increased exponentially, an encryption layer sitting below HTTP was necessary. However, this is a bit tricky: if a bad actor can “listen in” the conversation between client and server while the connection is unencrypted, how can they exchange encryption keys securely?

One option would be for the two parties to create a public-private key pair and send over the public key pair to the other party, so they can use that to encrypt their packet before sending them over the wire.

The problem with this is that asymmetric (public-key) cryptography is _much slower_ than symmetric cryptography.

The "strength" of asymmetrical cryptography relies on modular arithmetic, mathematical operations that are very hard to do in the opposite direction. The numbers used in these operations need to be big enough to provide the necessary security, but performing arithmetic with very large numbers can be taxing on a CPU.

Symmetric cryptography, on the other hand, works differently and does not suffer from this problem. On top of that, most devices have AES instruction sets integrated into their CPUs to speed up AES operations, making AES encryption have almost zero overhead on modern devices.

The TLS protocol gets around this issue by using asymmetric cryptography to exchange keys at the beginning and then switch to symmetric keys (“sessions keys”) from then on in a process known as the TLS handshake.


## TLS handshakes

The exact steps of the TLS handshake will depend on which TLS version is supported by the client and server, as well as which parameters they are set to use.

Since most modern browsers still support TLS 1.2 and a lot of websites still use TLS 1.2 (according to a [paper published by Syed-Winkler](https://www.grin.com/document/1037281), as of February 2021, TLS 1.3 is supported by 42.9% of surveyed websites, while TLS 1.2 is supported by 99.3%), we will talk about TLS 1.2 first and then discuss how TLS 1.3 differs from 1.2.


### The TLS 1.2 handshake

TLS 1.2 can be configured to use many key exchange algorithms, and among them, the most well-known and widely used is the RSA key exchange algorithm. Let’s go over how the RSA algorithm works in TLS 1.2, then talk about how the process differs in TLS 1.3 with the [Diffie-Hellman](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange) (DH) key exchange algorithm.

The RSA key exchange works roughly as follows in TLS 1.2:

1. **Server listens for new connections on port 443.**
2. **Client connects to port 443 and initiates the handshake process with a ClientHello message to the server.** This message contains the TLS versions and cipher suites the client supports and a 32-byte random number known as Client Random.
3. **Server says “hello” back with a ServerHello message.** The server selects a cipher and the TLS version from the list provided by the client, then generates a different 32-byte random number known as Server Random and sends it all back along with the server’s own SSL certificate.
4. **Client uses the SSL certificate to verify the server’s identity.** SSL certificates contain a public key generated by the server and a digital signature signed with the private key of a trusted third party known as a certificate authority (CA). Most web browsers and operating systems come bundled with public keys from trusted CAs, which are used to verify that the CA issued the certificate.
5. **The client verifies the server has the matching private key to the certificate through ClientKeyExchange.** The client generates the pre-master secret (a 48-byte random number) and encrypts it with the server’s public key obtained from the certificate. If the server is the true owner of the certificate, it must be able to decrypt the message and obtain the original pre-master secret.
6. **Server decrypts the pre-master secret.** Now both the server and client have the pre-master secret, the Server Random, and the Client Random. They can use that to derive the master secret using the previously agreed cipher and arrive at the same (symmetric) key, which will become the session key once both parties verify their keys match.
7. **Client sends a ChangeCipherSpec message.** This indicates that the client is ready to create the session key and start communicating through an encrypted tunnel using that key.
8. **Client proves to server it has the correct keys.** The client hashes all handshake records up to that point, encrypts them with the session key, and sends them to the server. If the server generates the correct key, it will be able to decrypt that message and verify the record hashes (which the server can independently generate).
9. **Server proves to the client that it has the correct keys.** The server does the same thing and sends it to the client.
10. **A secure connection is established.** If both keys match, the TLS handshake is complete.

 
#### Problems with TLS 1.2

TLS 1.2 left a lot of its configuration parameters up to the users, which often resulted in bad choices (the old security adage of “among too many options, the worst one will be chosen”).

Additionally, in the name of backward compatibility, TLS 1.2 also allowed old, insecure ciphers to be used. (TLS 1.2 itself was released in 2008.) As time passed, it became more prone to attacks as vulnerabilities in older cipher or versions of TLS were discovered.

On top of all that, the RSA key exchange has a few weaknesses:

* **The same public-private key pair is used both to authenticate the server and to encrypt the pre-master secret (item #5 above).** If an attacker obtains the private key, they will be able to re-generate the session keys and be to decrypt the entire session.
* **There is no Perfect Forward Secrecy (PFS).** Since the server’s private key doesn’t change, an attacker might record and store encrypted data for years, hoping to decrypt it years down the line if the server’s private key is ever leaked or compromised.
* **Performance.** It’s necessary to make two round trips between the client and server until the session key is established.

To address these problems, the IETF began developing TLS 1.3 in 2013 and finally released it to the public in August 2018.

### What changed in TLS 1.3

In practice, the main differences between TLS 1.3 and 1.2 are:

* Shorter handshake
* Only supports key exchange algorithms with perfect forward secrecy (PFS), such as ephemeral Diffie-Hellman
* Support for 0-RTT (Zero Round Trip Time) resumption

This represents a bit of a paradigm change in TLS 1.3: shifting the focus from user configurability and backward compatibility to security by being more opinionated.

This allowed the designers to create a shorter handshake (by restraining DH as the only key exchange algorithm) but also prevented developers from choosing insecure options by restricting the number of options available in the first place.

For example, while it was technically possible to use DH as the key exchange method in TLS 1.2, the participants were responsible for setting the DH parameters. Picking the right parameters is crucial to make sure the DH exchange is secure, as some parameters can be trivially broken.

In 2015, security researchers [published a paper](https://weakdh.org/) describing how the WeakDH attack, which affected 8.4% of the top 1 million domains at the time, could trick servers into using small (insecure) DH parameters, enabling adversaries to decrypt data transmitted between client and server.

TLS 1.3 makes it impossible to use anything but a set of DH parameters that are believed to be secure.

### The TLS 1.3 handshake

Because there are significantly fewer options for the client and server to agree on, the TLS 1.3 handshake is much simpler:

1. **Server listens for new connections on port 443.**
2. **Client connects to port 443 and initiates the handshake process with a ClientHello message to the server.** Since the list of cipher suites was vastly reduced in TLS 1.3 (from 37 to 5), the client assumes the server is going to use one of the five. It proactively calculates a key pair for each of the cipher suites and sends it to the server along with the protocol version.
3. **Server calculates the key session.** With the client’s key share, the server is able to generate the session key.
4. **Server says “hello” back with a ServerHello message.** The server generates its own key share and sends it over to the client, so it also can generate the session key, along with the server’s encrypted SSL certificate (using the session key created on #3).
5. **Client generates master secret and a secure connection is established.** The client receives the server’s key share and calculates the session key. It decrypts and verifies the server’s certificates, and if everything is good, the handshake is complete.

Note that there are two different public-private key pairs on an ephemeral DH exchange: the first is the ephemeral pair, created every time client and server establish a connection, which guarantees forward secrecy. The second pair, embedded on the SSL certificate, is used for authentication and doesn’t change.

Given that a new key is generated for every session, this feature guarantees PFS. If the encryption keys are compromised at a later date, the leaked key will only be able to decrypt the specific session to which it corresponds; all the prior sessions are still safe. As a result, large-scale storage of data transmitted between server and client is rendered worthless.

## How Auth0 Can Help

The temptation to intercept, undermine, and circumvent encryption has never been stronger. Cybercriminals are working to find ways to get around the issues that strong encryption presents due to the volume of valuable information that is sent between computers today.

While this rarely results in direct assaults against cryptographic algorithms or protocols, it frequently prompts attackers to devise novel methods of intercepting or capturing information. With these threats ever present, it is more crucial than ever to focus on maintaining strong and up-to-date implementations of effective encryption protocols.

Some applications are still running TLS versions older than 1.2, and others are still running the original SSL protocol. If yours is one of them, you should consider upgrading it immediately. Auth0 [supports both TLS 1.2 and TLS 1.3](https://auth0.com/docs/customize/custom-domains/self-managed-certificates/tls-ssl) and can help you keep your applications secure.

The TLS Handshake Explained

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Auth0 at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community.

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [**Products That Count**](https://productsthatcount.com/) and [**Aiven.io**](http://Aiven.io).


President, Auth0

Shiven Ramji

New partnerships aim to bring secure customer identity to the platforms developers use every day in one click, or less

Almost a decade ago, _The New Kingmakers_ made reference to the rise of a developer class that would fundamentally reshape technology decision-making. Today, two-thirds of professional developers have a voice when their organizations are purchasing new technologies, according to [Stack Overflow](https://survey.stackoverflow.co/2022/#technology-most-loved-dreaded-and-wanted). Product-led growth is official “a thing,” and companies that make life easier for developers have been crowned with success again and again.

The acquisition of Auth0 accelerated Okta’s own journey with developers. Over 2.8 million unique developers look to [Auth0, now the Okta Customer Identity Cloud](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/) each month for expertise on how to implement customer identity, across in-person events, the Auth0 Ambassador program, and digital channels like docs, technical blogs, and JWT.io.

Today, at [Oktane22](https://www.okta.com/oktane22/), we announced the next giant leap in our journey toward making identity easier for developers: New partnerships with three of the leading developer platforms: DigitalOcean, Netlify, and Vercel. These are like-minded platforms that put developers at the heart of their missions. Together, we intend to bring expert advice and easy integrations to where developers already spend their time–with the ultimate vision of providing secure customer identity in one click or less within each platform environment.

“Creating compelling experiences is hard enough without having to be an identity expert, too. And the stakes are too high to get it wrong,” said Shiven Ramji, Chief Product Officer, Customer Identity at Okta. “Okta Customer Identity Cloud powered by Auth0 can be called by your app and hosted in your cloud of choice, but we don’t want to stop there. This is the first step in a multi-year journey to fully integrate secure identity capabilities where developers are building the future. We are honored to have DigitalOcean, Netlify, and Vercel join us on this quest.”

## Abstracting Away Complexity

Developers are facing all kinds of application complexity and maintenance work that takes them away from innovation. The Covid-19 pandemic only amplified the need to be hyper-focused on shipping differentiated, user-centric products. Security has become a cat-and-mouse game as attackers shift their tactics and new privacy laws are established. Developers need to balance all of these priorities while dealing with resourcing and talent pressures.

Customer identity stands at the intersection of these forces: security, privacy, and user experience. Getting it right enables everyone to safely access any technology and developers to integrate customer identities across the stack. But according to a [Gartner](https://www.gartner.com/en/documents/4009255)® report, “The cost of maintaining a homegrown CIAM toolset has grown, compared with commercial offerings. There is a growing preference for buying versus building, which is enabling the business to refocus development resources.”

## Empowering Developers for a Safer Internet

Together, we believe Okta, DigitalOcean, Netlify, and Vercel can streamline the education, implementation, and activation of customer identity for developers across the globe. Today, we’re starting with improving education and awareness around the complexity of identity, followed by improving discoverability for our integrations along the developer journey, with the ultimate vision of one-click integrations.

Democratizing access to enterprise-grade customer identity for developers will have a massive impact on the security of end-consumers and empower developers to focus on innovation. As part of Okta Customer Identity Cloud, we can put adaptive multi-factor authentication (MFA), bot detection, passkeys, and more in the hands of developers with the literal flip of a switch. Meeting developers where they are is a key part of our strategy, and we couldn’t be more excited to welcome DigitalOcean, Netlify, and Vercel to our network.

“We’re very excited to be working with Okta to better equip developers and small businesses to add customer identity into their Apps built on DigitalOcean,” said Tyler Healy, Vice President of Security at [DigitalOcean](https://www.digitalocean.com/). “When it comes to developers and digital entrepreneurs, simplicity is vital. This partnership will only further DigitalOcean’s ability to simplify innovation on our platform and enable builders to spend more time creating software that changes the world.”

“Developers are moving to a decoupled, composable web architecture because they want more flexibility to use any tool or framework to build faster, better-performing web experiences. At the same time, they need a great developer experience in a simple workflow. That’s where Netlify plays a key role as the platform connecting all developer’s tools, including Auth0 by Okta, and APIs in one place to build and run web apps. Working with Okta, we look forward to making identity and authentication as easy and simple as possible for millions of developers,” said Matt Biilmann, CEO and co-founder [Netlify](https://www.netlify.com/)

“As a leading cloud platform for frontend developers, Vercel provides innovators with the speed and reliability they need to create at the moment of inspiration. Security and identity are at the core of building delightful digital experiences,” said Malte Ubl, CTO at [Vercel](https://vercel.com/). “By joining forces with Okta, we’re not only simplifying the role that identity plays on the web but also making a commitment to enhancing the speed and breadth of developer-friendly cybersecurity in an increasingly digital world.” 

## Neutrality to Build Your App, Your Way

Developers want the freedom and power to choose the best solutions for their digital ecosystem. Okta’s commitment to neutrality means not being restricted to a specific technology stack and having the ability to control and customize identity now and in the future. We are designing easy-to-integrate solutions that free developers to use any technology, regardless of platform, device, or infrastructure. We are 100% focused on identity, so developers can focus on innovation.

## Availability and Signup

Developers can learn more about Okta’s new developer platform partnerships and get started with Okta Customer Identity Cloud [on our Developer Center](https://developer.auth0.com/resources/get-started/cloud?utm_source=blog&utm_medium=website&utm_campaign=partnerships). We will release more information about the DigitalOcean, Netlify, and Vercel integrations as they become available.

If you’re a developer platform interested in joining our quest to make identity easier for developers, [please reach out to our tech partnerships team](https://docs.google.com/forms/d/e/1FAIpQLSfGzaE5a6-OSy1D1N8PMeSE8pXCfsr4UkzDqUpW-vUGq2rYHg/viewform).

## About Okta

Okta is the World’s Identity Company. As the leading independent Identity partner, we free everyone to safely use any technology—anywhere, on any device or app. The most trusted brands trust Okta to enable secure access, authentication, and automation. With flexibility and neutrality at the core of our Okta Workforce Identity and Customer Identity Clouds, business leaders and developers can focus on innovation and accelerate digital transformation thanks to customizable solutions and more than 7,000 pre-built integrations. We’re building a world where Identity belongs to you. Learn more at [okta.com](http://okta.com/).

Okta Partners with DigitalOcean, Netlify, and Vercel to Simplify Identity for Developer

Let’s explore the new .NET 7 features for improving and simplifying authentication and authorization support in .NET applications.

The release of .NET 7 continues the simplification effort that began with .NET 5. Following this line, the new release provides .NET developers with a few features related to authentication and authorization that make .NET developers' lives a bit easier. Let's take a quick look at those features, which range from simplifications in authentication configuration to the addition of new authorization test tools, to improvements to Blazor's authentication support.

## Default Authentication Scheme

When you configure authentication for your application, you need to register the authentication service through `AddAuthentication()`. For example, the following is the code needed to configure `JwtBearer` as the authentication scheme in an ASP.NET Core Web API:

```csharp
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
 .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
 {
 options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
 options.TokenValidationParameters = 
 new Microsoft.IdentityModel.Tokens.TokenValidationParameters
 {
 ValidAudience = builder.Configuration["Auth0:Audience"],
 ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
 };
 });
```

Although you are defining just one authentication scheme (`JwtBearerDefaults.AuthenticationScheme`), the `AddAuthentication()` method requires that you specify the default scheme to use when it is not specified in your API endpoints (see [this document for more details on multiple authentication schemes in ASP.NET Core](https://learn.microsoft.com/en-us/aspnet/core/security/authorization/limitingidentitybyscheme?view=aspnetcore-6.0#use-multiple-authentication-schemes)).

Starting with .NET 7, the default scheme is no longer required when you define just one authentication scheme. It is automatically inferred by the framework. In practice, you can write the previous code as follows:

```csharp
builder.Services.AddAuthentication() //👈 no default scheme specified
 .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
 {
 options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
 options.TokenValidationParameters = 
 new Microsoft.IdentityModel.Tokens.TokenValidationParameters
 {
 ValidAudience = builder.Configuration["Auth0:Audience"],
 ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
 };
 });
```

In case you need to restore the old behavior for any reason, you can disable the new feature using the following statement:

```csharp
AppContext.SetSwitch("Microsoft.AspNetCore.Authentication.SuppressAutoDefaultScheme", true);
```

## Simplified Configuration

One of the recurrent critiques of .NET authentication and authorization is its complexity (see [this thread](https://www.reddit.com/r/dotnet/comments/vttrib/is_auth_way_too_hard_in_net/) and [this one](https://social.msdn.microsoft.com/Forums/en-US/4d3844d5-9175-49ba-8c2f-8257f2c67639/authentication-and-authorization-is-too-complicated-too-abstract?forum=aspdotnetcore), for example). Actually, .NET provides developers with an articulate system for managing authentication and authorization. This system is great for the flexibility it offers, but it may be hard for a beginner to digest all the details. It may be hard even for a more experienced developer who is not used to dealing with the identity features every day.

To overcome this issue, the .NET team started an initiative aiming at simplifying the authentication and authorization configuration. The .NET 7 release introduces the first step in this direction, bringing you a simplified approach to configure ASP.NET Core Web APIs authorization based on access tokens in JWT format.

> Check out [this article to learn how to protect your ASP.NET Core Web API](https://auth0.com/blog/aspnet-web-api-authorization/).

If you ever had secured an ASP.NET Core Web API with Auth0, the following code should look familiar to you:

```csharp
using Microsoft.AspNetCore.Authentication.JwtBearer;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
 .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
 {
 options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
 options.TokenValidationParameters = 
 new Microsoft.IdentityModel.Tokens.TokenValidationParameters
 {
 ValidAudience = builder.Configuration["Auth0:Audience"],
 ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
 };
 });

builder.Services.AddAuthorization();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();
```

Now, you can directly rely on the built-in configuration system to define your Web API's authorization options. In fact, in addition to default authentication schemes, .NET 7 automatically loads the options to configure the authentication service from the new `Authentication` section of the `appsettings.json` configuration file. With this new feature, the code shown earlier becomes as follows:

```csharp
using Microsoft.AspNetCore.Authentication.JwtBearer;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication().AddJwtBearer(); //👈 new feature

builder.Services.AddAuthorization();

var app = builder.Build();
```

All the configuration settings are moved to the `appsetting.json` file as follows:

```json
{
 "Logging": {
 "LogLevel": {
 "Default": "Information",
 "Microsoft.AspNetCore": "Warning"
 }
 },
 "AllowedHosts": "*",
 //👇 new section
 "Authentication": {
 "Schemes": {
 "Bearer": {
 "Authority": "https://YOUR_AUTH0_DOMAIN",
 "ValidAudiences": [ "YOUR_AUDIENCE" ],
 "ValidIssuer": "YOUR_AUTH0_DOMAIN"
 }
 }
 }
 //👆 new section
}
```

The new `Authentication` section keeps the configuration settings for any authentication scheme supported by your application, although currently only the `JwtBearer` scheme is supported.

Notice that now you don't need anymore to call `UseAuthentication()` and `UseAuthorization()`. The framework takes care of automatically adding the required middleware to the request pipeline.

## Authorization Policies for Specific Endpoints

ASP.NET Core allows you to specify policies to make more accurate authorization decisions based on the access token content or other advanced criteria. Usually, these policies are defined globally at the application level and attached to the endpoint definitions the policy applies to.

> Take a look at [this article to learn how to use policies to protect ASP.NET Core Web APIs](https://auth0.com/blog/permission-based-security-aspnet-webapi/), for example.

Defining policies globally is pretty good for reuse. However, sometimes you may need just a specific policy for one endpoint. In this case, you can specify your policy directly on the endpoint definition.

The following is an example of how you can use this new feature:

```csharp
app.MapGet("/api/special-endpoint", () => "A special endpoint!")
 .RequireAuthorization(p => p.RequireClaim("scope", "api:special"));
```

## The `user-jwts` Tool

Testing a token-protected Web API could be complex. You can easily use tools like curl or Postman, but you need to pass a valid access token along with your HTTP request. To get a valid access token, you usually need a working identity and access management system at your disposal, such as [Auth0](https://auth0.com/). You need to configure your API with this system and log in by providing valid credentials.

Auth0 allows you to test your registered API using a token issued directly in the [Auth0 dashboard](https://manage.auth0.com/), but you still need to register your application with Auth0.

.NET 7 brings a new CLI tool that helps simplify protected Web API testing: `user-jwts`. This tool is integrated with the .NET CLI and allows you to generate access tokens in JWT format. The tool is based on the same infrastructure as the [secret manager](https://auth0.com/blog/secret-management-in-dotnet-applications/) and enables your application to validate the generated access token. Basically, the following command allows you to generate a new access token:

```bash
dotnet user-jwts create
```

You can use this token with curl, Postman, or any other HTTP client to make your call to the protected endpoints of your Web API without the need to register your application with an actual identity and access management system.

Beyond the basic usage, the `user-jwts` tool allows you to customize your access token by specifying the scopes, custom claims, and other properties so that you can also test endpoints with access policies. See the [official documentation](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/jwt-authn) to learn more.

<include src="ebook-ads/dotnetIdentity" />

## Dynamic Authentication Requests in Blazor WASM

Blazor WebAssembly uses the `Microsoft.AspNetCore.Components.WebAssembly.Authentication` package to handle OpenID Connect authentication. This package allows you to statically define at the startup time how authentication will occur. However, there are scenarios where you may need to authenticate users at runtime with a different configuration. For example, you may need to perform [step-up authentication](https://auth0.com/docs/secure/multi-factor-authentication/step-up-authentication) or may want the user to change their account.

In .NET 7, Blazor WebAssembly supports the creation of dynamic authentication requests using the new `InteractiveRequestOptions` class and the `NavigateToLogin()` method of the `NavigationManager` object.

The following example shows the basic use of these new features:

```csharp
InteractiveRequestOptions requestOptions = new()
{
 Interaction = InteractionType.SignIn,
 ReturnUrl = NavigationManager.Uri,
};
NavigationManager.NavigateToLogin("authentication/login", requestOptions);
```

The `InteractiveRequestOptions` class also provides a way to add custom parameters to the authentication request. For example, consider [Auth0's `screen_hint` parameter](https://auth0.com/docs/authenticate/login/auth0-universal-login/new-experience#signup) that allows you to show the signup form instead of the default login form. You can send this parameter to Auth0 as shown below:

```csharp
InteractiveRequestOptions requestOptions = new()
{
 Interaction = InteractionType.SignIn,
 ReturnUrl = NavigationManager.Uri,
};
requestOptions.TryAddAdditionalParameter("screen_hint", "signup");
NavigationManager.NavigateToLogin("authentication/login", requestOptions);
```

## Blazor WASM Authentication Diagnostics

Detecting authentication issues is not easy, especially if you are running a WebAssembly code, as it happens with Blazor WebAssembly applications. The .NET 7 release tries to improve its support for authentication diagnostics by introducing the debug level for the `Microsoft.AspNetCore.Components.WebAssembly.Authentication` library. After [enabling logging for Blazor WebAssembly](https://learn.microsoft.com/en-us/aspnet/core/blazor/fundamentals/configuration?view=aspnetcore-7.0#logging-configuration), you can add the following setting in the `wwwroot/appsettings.json` configuration file to get detailed information about the authentication process:

```json
"Logging": {
 "LogLevel": {
 "Microsoft.AspNetCore.Components.WebAssembly.Authentication": "Debug"
 }
}
```

<include src="SignupCTA" text="Try out Auth0 authentication for free." linkText="Get started →" />

## Conclusion

Probably the new features introduced by .NET 7 to mitigate the complexity of authentication and authorization support will not drastically change your life as a developer. However, they confirm the effort Microsoft is making to simplify the use of its development platform. In the area of authentication and authorization, the commitment to reduce configuration complexity with an [initiative](https://github.com/dotnet/aspnetcore/issues/34545) that will continue in subsequent .NET releases looks pretty promising.

I hope that the combination of these and future simplifications will go in the right direction of making authentication and authorization integration into .NET applications less and less challenging.

What's New in .NET 7 for Authentication and Authorization

Learn how to call a protected API from your .NET MAUI application.

Call a Protected API from a .NET MAUI App

pablo-cibraro

Pablo is an internationally recognized expert and entrepreneur with more than 22 years of experience in designing and implementing large distributed systems with Microsoft technologies and a Connected System MVP. 
For the last few years, Pablo has helped numerous Microsoft teams develop tools and frameworks for building service-oriented and web applications with .NET. 
Pablo now focuses on technologies that enable developers to build large-scale systems and web applications on the cloud, such as HTML5, Node.js, ASP.NET, Windows Azure and Amazon AWS.

Agilesight Cofounder

Pablo Cibraro

Learn about the new ASP.NET minimal Web APIs introduced in .NET 6.0 and how to secure them with Auth0.

Securing ASP.NET Minimal Web APIs with Auth0

A map to choose the right SDK to integrate Auth0 in your .NET application.

The .NET ecosystem has become quite complex. On the one hand, developers can create different types of applications for different platforms. On the other hand, in its 20-year history, .NET has generated different versions of the development platform, some incompatible with each other or compatible under specific criteria.

Auth0 provides developers with a few SDKs for different application types and different versions of the platform. Which one is right for your application? Let's find out together!

> If you want to find out directly what is the SDK or package to use in your .NET application to integrate with Auth0 without sitting through the rationale behind it, jump to the section [The Matrix of Solutions](#The-Matrix-of-Solutions).

## The Dimensions of the Problem

Let's start by exploring the dimensions of the problem, that is, the factors that influence the choice: the application type, the .NET target, and the role of Auth0.

### The application type

As the first dimension, you need to consider your **application type**. As a .NET developer, you know that the development platform allows you to create applications of several types: from Web to desktop apps, from Web APIs to mobile apps. You can also use different frameworks to build your app. For example, you leverage ASP.NET or ASP.NET Core to build a Web application, but you can use ASP.NET Core MVC or Razor Pages or Blazor as the frameworks that support your UI and application architecture. Something similar happens for desktop app UIs: you can use WinForms, Windows Presentation Foundation (WPF), Universal Windows Platform (UWP), Multiplatform Applcation UI (MAUI), etc.

Identifying your application type and the technology you use or you are going to use is the first step to determining which SDK you must use.

### The .NET target

The second dimension is the .NET version your application runs on, which in the .NET lingo is called **your application's target**. The .NET platform has evolved over the past two decades and has undergone several transformations. From the initial multi-language framework for Windows programming, it has now become a cross-platform development environment that enables the creation of Web, desktop, and mobile applications. You can take into account the following targets:

- *.NET Framework*. This was the initial Windows framework, which will be deprecated, but on which many applications still run.
- *.NET Core*. The initial cross-platform version of .NET, which is not fully compatible with the .NET Framework. The last .NET Core version was 3.1.
- *.NET Standard*. Actually, this is not a true .NET version. It is a specification that aims at defining a common set of APIs between .NET Framework and .NET Core to ensure a degree of compatibility between the two versions. Auth0 SDKs follow .NET Standard 2.0 specifications to keep this compatibility.
- *.NET*. This is the current and universal version of the development platform that aims to replace all the previous ones. From the Auth0 point of view, it can be seen as the evolution of .NET Core.

To learn more about [the differences between the .NET targets, check out this article](https://auth0.com/blog/navigating-dotnet-maze).

### The role of Auth0

The third dimension is **the purpose of using the Auth0 platform** in your application. Your application can use Auth0 for three main reasons:

- To add *authentication* so that your users can log in using the [Auth0 Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login) page, Single Sign-On (SSO), Passwordless, Social Login, and the [other approaches available with Auth0](https://auth0.com/docs/authenticate).
- To *control access* so that only authorized users can use your application's functionality.
- To *manage users and other features* provided by your [Auth0 tenant](https://auth0.com/docs/get-started/auth0-overview/create-tenants).

Clarifying the purpose of Auth0 in your application is also important to determine which SDK you must use.

## The Auth0 SDKs and Packages

After analyzing the dimensions of the problem, let's see what Auth0 offers to meet the needs of .NET developers. You can use a few SDKs to integrate Auth0's authentication, authorization, and management features into your .NET applications. Each SDK includes one or more packages that you can install from [NuGet](https://www.nuget.org/profiles/auth0).

Let's take a look at these SDKs and their packages.

### Auth0 ASP.NET Core Authentication SDK

The [Auth0 SDK for ASP.NET Core Authentication](https://github.com/auth0/auth0-aspnetcore-authentication) is designed for adding authentication support to your Web application built with server-side frameworks: ASP.NET Core MVC, Blazor Server, and Razor Pages. It provides you with one package &mdash; [**Auth0.AspNetCore.Authentication**](https://www.nuget.org/packages/Auth0.AspNetCore.Authentication), which hides most of the complexity of the authentication and authorization process.

Check out [this article for a quick introduction to the Auth0 ASP.NET Core Authentication SDK's main features](https://auth0.com/blog/exploring-auth0-aspnet-core-authentication-sdk/).

### Auth0 OIDC Client for .NET

The [Auth0 OIDC Client for .NET](https://github.com/auth0/auth0-oidc-client-net) supports [OpenID Connect](https://auth0.com/docs/authenticate/protocols/openid-connect-protocol)-based authentication in your .NET desktop application as well as in your mobile application based on Xamarin and MAUI. The SDK provides multiple packages depending on the framework used for your application's UI:

- [**Auth0.OidcClient.UWP**](https://www.nuget.org/packages/Auth0.OidcClient.UWP). This package supports Universal Windows Platform (UWP). Check out [this document to learn how to use it](https://auth0.com/docs/quickstart/native/windows-uwp-csharp).
- [**Auth0.OidcClient.WPF**](https://www.nuget.org/packages/Auth0.OidcClient.WPF). This package supports authentication for desktop apps using Windows Presentation Foundation (WPF). Take a look at [this document to learn how to use this package](https://auth0.com/docs/quickstart/native/wpf-winforms).
- [**Auth0.OidcClient.WinForms**](https://www.nuget.org/packages/Auth0.OidcClient.WinForms). With this package, you can add authentication to your WinForms-based desktop application. [This document](https://auth0.com/docs/quickstart/native/wpf-winforms) will guide you on how to use it.
- [**Auth0.OidcClient.Android**](https://www.nuget.org/packages/Auth0.OidcClient.Android). This package adds authentication to Xamarin-based mobile apps for Android. Read [this document](https://auth0.com/docs/quickstart/native/xamarin) to learn how to start.
- [**Auth0.OidcClient.iOS**](https://www.nuget.org/packages/Auth0.OidcClient.iOS). This package adds authentication to Xamarin-based mobile apps for iOS. Check out [this document](https://auth0.com/docs/quickstart/native/xamarin) to learn how to use it.
- [**Auth0.OidcClient.MAUI**](https://www.nuget.org/packages/Auth0.OidcClient.MAUI). With this package, you can add authentication to your MAUI applications. Get started with [this document](https://auth0.com/docs/quickstart/native/maui).

### Auth0 .NET SDK

The [Auth0 .NET SDK](https://github.com/auth0/auth0.net) enables your .NET Framework and .NET Standard application to authenticate users and manage your Auth0 tenant. It implements two packages:

- [**Auth0.AuthenticationApi**](https://www.nuget.org/packages/Auth0.AuthenticationApi). This package is a wrapper around the [Auth0 Authentication API](https://auth0.com/docs/api/authentication), which allows you to add login, logout, signup, and other functionality to your application. This is not a high-level authentication library, since you need to handle the steps of the [authentication and authorization process](https://auth0.com/docs/get-started/authentication-and-authorization-flow). It assists you in building authorization URLs through a few [URL Builders](https://auth0.github.io/auth0.net/#using-url-builders), but it's up to you to [run validation](https://github.com/auth0/auth0.net#authentication).
 Check out [this document for an introduction to how to use the *Auth0.AuthenticationApi* package](https://auth0.github.io/auth0.net/#using-the-authentication-api).
- [**Auth0.ManagementApi**](https://www.nuget.org/packages/Auth0.ManagementApi). This package allows you to interact with your Auth0 tenant programmatically. It is a wrapper around the [Auth0 Management API](https://auth0.com/docs/api/management/v2) and basically allows you to do with your .NET application what you can do with your [Auth0 dashboard](https://manage.auth0.com/): you can manage users and roles, create and get application settings, manage your Auth0 Actions, control your branding, and so on.
 Check out [this document for a quick introduction to how to use the *Auth0.ManagementApi* package](https://auth0.github.io/auth0.net/#using-the-management-api).

<include src="ebook-ads/dotnetIdentity" />

## The Matrix of Solutions

Now that you've reviewed the dimensions of the problem and the available Auth0 packages let's create a map that allows you to find on the fly which package to use for a given application type.
In the following, you will see three sections, one for each Auth0 role in your application. Within each section, you will find a matrix that matches the application type with the .NET target and proposes the appropriate package.
Note that a specific SDK may not be available for some combinations because native .NET support is sufficient or because there are viable third-party alternatives.

### Authentication

If your application uses Auth0 to add authentication support, check out this matrix to choose the right package:

<style>
 table {
 width: 100%;
 border-collapse: collapse;
 font-size: 15px;
 }
 table, td, th {
 border: 1px solid;
 }
 table th {
 background-color:#eeeee4;
 }
 table tr td:first-child {
 background-color:#eeeee4;
 }
 table a:link {
 inline-size: 250px;
 /* overflow-wrap: break-word; */
 word-break: break-all;
 font-size: 15px;
 }
 td {
 padding: 5px;
 }
</style>

| | .NET Framework | .NET (Core)|
| ------------------ | ------------------------------------------------------------ | ------------------------------------------------------------ |
| **ASP.NET MVC** | [Microsoft.Owin.Security.OpenIdConnect](https://www.nuget.org/packages/Microsoft.Owin.Security.OpenIdConnect) | |
| **ASP.NET Core MVC** | | [Auth0.AspNetCore.Authentication](https://www.nuget.org/packages/Auth0.AspNetCore.Authentication) |
| **Razor Pages** | | [Auth0.AspNetCore.Authentication](https://www.nuget.org/packages/Auth0.AspNetCore.Authentication) |
| **Blazor Server** **Blazor WebApps** | | [Auth0.AspNetCore.Authentication](https://www.nuget.org/packages/Auth0.AspNetCore.Authentication) |
| **Blazor WebAssembly** | | [Microsoft.AspNetCore.Components.WebAssembly.Authentication](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Authentication/) |
| **Xamarin** | [Auth0.OidcClient.Android](https://www.nuget.org/packages/Auth0.OidcClient.Android) [Auth0.OidcClient.iOS](https://www.nuget.org/packages/Auth0.OidcClient.iOS) | [Auth0.OidcClient.Android](https://www.nuget.org/packages/Auth0.OidcClient.Android) [Auth0.OidcClient.iOS](https://www.nuget.org/packages/Auth0.OidcClient.iOS) |
| **WPF** | [Auth0.OidcClient.WPF](https://www.nuget.org/packages/Auth0.OidcClient.WPF) | |
| **WinForms** | [Auth0.OidcClient.WinForms](https://www.nuget.org/packages/Auth0.OidcClient.WinForms) | |
| **UWP** | [Auth0.OidcClient.UWP](https://www.nuget.org/packages/Auth0.OidcClient.UWP) | |
| **MAUI** | | [Auth0.OidcClient.MAUI](https://www.nuget.org/packages/Auth0.OidcClient.MAUI) |
| **Console** | [Auth0.AuthenticationApi](https://www.nuget.org/packages/Auth0.AuthenticationApi) | [Auth0.AuthenticationApi](https://www.nuget.org/packages/Auth0.AuthenticationApi) |

 

Notice that for ASP.NET MVC, we suggest using [Microsoft's standard OWIN library](https://learn.microsoft.com/en-us/aspnet/aspnet/overview/owin-and-katana/). Similarly, you can use [Microsoft's standard library for Bazor WebAssembly applications](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Authentication/).

### Access control

If your application uses Auth0 to check access control to server resources, that is, you are implementing a Web API, check out this matrix to choose the right package:

| | .NET Framework | .NET (Core) |
| -------------------- | ------------------------------------------------------------ | ------------------------------------------------------------ |
| **ASP.NET Web API** | [Microsoft.Owin.Security.Jwt](https://www.nuget.org/packages/Microsoft.Owin.Security.Jwt) | |
| **ASP.NET Core Web API** | | [Microsoft.AspNetCore.Authentication.JwtBearer](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.JwtBearer) |

 

As you can see, you can use Microsoft's standard libraries to check JWT tokens in Web APIs.

### Auth0 tenant management

If your application needs to manage users and other Auth0 tenant features, refer to this table:

| | .NET Framework | .NET (Core) |
| ------------ | ------------------------------------------------------------ | ------------------------------------------------------------ |
| **Any app type** | [Auth0.ManagementApi](https://www.nuget.org/packages/Auth0.ManagementApi) | [Auth0.ManagementApi](https://www.nuget.org/packages/Auth0.ManagementApi) |

 

The Auth0 Management API can be used for any application type targeting any .NET version.

<include src="SignupCTA" text="Try out Auth0 authentication for free." linkText="Get started →" />

## Summary

Throughout this article, you learned the criteria you must follow to determine the appropriate SDK and package for your .NET application. The current platform complexity is reflected in the complexity of choosing the right package, of course. With the [.NET platform unification](https://auth0.com/blog/dotnet-5-whats-new/), general simplification is expected in the near future, but we cannot forget the legacy code that is still up and running.

So, for your next .NET project, go and pick the right Auth0 SDK!

Choosing the Right .NET SDK for Auth0

Learn how to add authentication to your ASP.NET Razor Pages application using Auth0.

Securing Razor Pages Applications with Auth0

Learn how to secure Blazor WebAssembly applications with Auth0.

Securing Blazor WebAssembly Apps

Learn how to build client-side Web apps using Blazor and how to secure them with Auth0.

What is Blazor? A Tutorial on Building Web Apps with Authentication

Learn how to add authentication to your ASP.NET Core MVC Application by using Auth0.

Add Authentication to Your ASP.NET Core MVC Application

What's new in .NET 6? What are the main relevant features brought by the new version of the .NET platform? Let's take a quick look.

With the release of .NET 6, Microsoft consolidates its plan to create a unified platform to develop applications for any device and operating system. Together with this vision, .NET 6 brings many new features aiming to simplify development and gain performance. Let's take a quick look at the main points.

## Unified Platform Support
The vision of a [unified platform for the .NET world started with .NET 5](https://auth0.com/blog/dotnet-5-whats-new/). That release was meant to be the unified successor of [the various .NET flavors: .NET Framework, .NET Standard, .NET Core, Mono](https://auth0.com/blog/navigating-dotnet-maze/), etc. Beyond this goal, .NET 5 wanted to be a development platform to create any kind of application for any platform. However, at that time, an important piece was missing to complete the puzzle: a unified framework to create cross-platform UIs. Now, with [.NET MAUI](https://devblogs.microsoft.com/dotnet/announcing-net-maui-preview-10/), i.e., the **.NET Multi-platform App UI** framework, the puzzle is complete. Although at the time of writing [.NET MAUI is in preview](https://devblogs.microsoft.com/dotnet/announcing-net-maui-preview-10/), it is mature enough to be considered part of the .NET 6 release.

Now with .NET 6, you can really create the application you want and run it practically everywhere: from desktop to mobile, from the web to the cloud.

![.NET 6 unified platform](https://images.ctfassets.net/23aumh6u8s0i/GOa5gfL6LckpRRhqaBRJe/69341464075cbd46cf88fcbe36af4aa5/dotnet-unified-platform.png)


[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6/)]


In particular, the new [.NET MAUI](https://github.com/dotnet/maui) framework allows you to build desktop and mobile native user interfaces with a single codebase.

![.NET MAUI overview](https://images.ctfassets.net/23aumh6u8s0i/4WkvXpMRwu7j5T82HiW04A/069649d85ea4e1def0831672b5fc8698/dotnet-maui-overview.png)


[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/introducing-net-multi-platform-app-ui/)]


## Simplified Development
One of the main goals of the .NET 6 release is to provide developers with features that simplify their work. You can find support for simplified development throughout the platform, but three contexts are really exciting: new C# features, Hot Reload support, and minimal web APIs.

### C# 10 features
.NET 6 brings you [C# 10 with plenty of new features](https://devblogs.microsoft.com/dotnet/welcome-to-csharp-10/) that help you write code more easily. Let's take a quick look at a few of them.

#### Global and implicit usings

As a C# developer, you know how annoying it is to declare the same namespace in every file of your project. Consider, for example, the `System` namespace. Its use is very common, and I'm pretty sure you forget it all the time and let Visual Studio suggest it.

Now you can declare namespaces using a global `using`, as shown in the following example:

```csharp
global using System;
```

With this declaration, you don't need to insert the `using System;` declaration in all files anymore. You can declare a namespace through `global using` in any file, and it will be available in the entire project.

If you prefer (and I think it's a good practice), you can declare your namespaces in a file named `GlobalUsings.cs`.

You can also take advantage of implicit `using`s by configuring the `<ImplicitUsings>` element in your `.csproj` file, as shown below:

```xml
<PropertyGroup>
 
 <ImplicitUsings>enable</ImplicitUsings>
</PropertyGroup>
```

This way, the compiler will automatically add the required `global using` directives based on the type of your project.

#### New namespace syntax

You know that the usual way to declare a namespace is as follows:

```csharp
namespace Geometry
{
 class Triangle 
 {
 // ...class members...
 }
}
```

Now you can use the file-scoped namespace syntax to get the same result:

```csharp
namespace Geometry

class Triangle 
{
 // ...class members...
}
```

With this approach, everything you define in the current file belongs to the declared namespace. By removing a nesting level, you make the code a bit cleaner. However, you can't create nested namespaces with this new syntax.

#### Natural types for lambda expressions

Consider the following assignment of a lambda expression to a variable:

```csharp
Func<string, int> parse = (string s) => int.Parse(s);
```

You need to declare the target type of the lambda expression, `Func<string, int>` in the example. Starting with C# 10, you can write the above code as follows:

```csharp
var parse = (string s) => int.Parse(s);
```

The compiler will try to infer the "natural" type of the lambda expression.

### Hot Reload
To improve the developer's productivity, .NET 6 extends [the Hot Reload feature](https://devblogs.microsoft.com/dotnet/announcing-net-6/#hot-reload) to Visual Studio and almost any type of project. It allows you to run an application in your development environment, make changes, and get the changes applied without stopping, rebuilding, and rerunning the application.

In previous .NET releases, this feature was available just for the .NET CLI via the `dotnet watch` command. Not without [some minor hiccups with the community](https://www.theverge.com/2021/10/22/22740701/microsoft-dotnet-hot-reload-removal-decision-open-source), you can now benefit from it in [Visual Studio 2022](https://devblogs.microsoft.com/dotnet/update-on-net-hot-reload-progress-and-visual-studio-2022-highlights/#improved-user-experience-in-visual-studio-2022) as well by simply clicking a button:

![Visual Studio 2022 Hot Reload button](https://images.ctfassets.net/23aumh6u8s0i/3wu09sA8C4IQ5uKfmGoITK/e13d618f3f497e72281665de780b472d/vs2022-hot-reload-button.png)


[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/update-on-net-hot-reload-progress-and-visual-studio-2022-highlights/)]


### Minimal web APIs
One astonishing feature introduced by .NET 6 to simplify your code is [minimal web APIs](https://docs.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis). Along the lines of top-level statements, now you can build a fully working web API application with a few lines of code. Consider the following sample:

```csharp
//Program.cs
var app = WebApplication.CreateBuilder(args).Build();

app.MapGet("/", () => "Hello World!");
app.Run();
```

This is all the code you need to run a simple *Hello World!* web API.

If you have some experience building web APIs with ASP.NET Core, you know that you usually need a more articulate project. You need at least a `Program.cs` file with the setup code for the application, a `Startup.cs` file where you configure your API, and a controller class defining the API routes and implementing the endpoints.

That's a lot of simplification!

## Performance Improvements
In the last years, the .NET team put a lot of effort into improving the platform performance in compiling and execution time and reducing memory consumption. With .NET 6, you can appreciate these improvements in many parts of the framework. For example, the effort to [improve inner-loop performance](https://github.com/dotnet/core/issues/5510) in building .NET projects has given awesome results, as you can see from the following diagram:

![dotnet6-build-improvements](https://images.ctfassets.net/23aumh6u8s0i/2ZVS4o4DKc6OroBO0Lb76b/187a5cbf18d934d9a1cefae71f1535f5/dotnet6-build-improvements.png)


[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6-preview-2/)]


Other performance improvements include the IO subsystem. For example, the `FileStream` class [was almost completely rewritten](https://devblogs.microsoft.com/dotnet/file-io-improvements-in-dotnet-6/) with amazing results even with respect to .NET 5, as the following table summarizes for the writing operation:

![FileStream performance improvement](https://images.ctfassets.net/23aumh6u8s0i/6RgFjbKytdIQk6pHtEaHxT/1d524bb8a02e4688979d71f3151aef3f/filestream-performance-improvement.png)


[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6/)]

You can check out [a detailed report on performance improvements in .NET 6](https://devblogs.microsoft.com/dotnet/performance-improvements-in-net-6/) with related benchmarks for more information.

## Summary

This quick overview of .NET 6 shows that this is a consolidation release of the .NET platform. It aims to complete the unified platform vision started with .NET 5, improves the internals of the platform to provide the best performance, and starts a process of development simplification that probably will go further in future releases.

<include src="asides/DotNetCore" />

.NET 6 Highlights

paul-asalu

Microsoft Student Ambassador | Cowrywise Student Ambassador | Back-end Developer

Software Developer

Paul Asalu

A practical insight into role-based authorization with FaunaDB, Netlify, and Auth0

Building A Secure E-diary Using FaunaDB, Netlify, and Auth0

Learn how to use .NET Core to implement a reverse proxy to overcome specific needs.

Building a Reverse Proxy in .NET Core

Learn about the new features introduced by the .NET Core 3.0 release.

Exploring .NET Core 3.0. What's New?

Learn what Dependency Injection and IoC are and what .NET Core provides you to support them.

Understanding Dependency Injection in .NET Core

How to create your .NET project template to use with .NET CLI and Visual Studio.

How to Create Your .NET Project Template

Creating unit tests and integration tests with xUnit for C# applications.

Using xUnit to Test your C# Code

An overall view of .NET, Microsoft's cross-platform development environment that allows you to build any type of application with C# and other languages.

Microsoft's ambition to provide developers with one platform to solve any type of problem has been fulfilled by .NET. For a couple of decades already, the .NET platform has been powering up web, desktop, and mobile applications in both the startup and enterprise scenes.

Without any doubt, .NET plays a central role in the software development industry. .NET popularity in the developer community is a fact. You can measure it through the number of open source projects around the world and the presence of [C# among the five most popular programming languages](https://www.tiobe.com/tiobe-index/). Its popularity is going to grow even more, especially after [the latest release (.NET 5)](https://auth0.com/blog/dotnet-5-whats-new/), which revolutionizes the industry by pioneering the concept of universal software development.

To understand the power of .NET, let's explore some of its technical foundations.

## What is .NET?

.NET is an open-source and cross-platform development platform for building many types of applications. Designed by Microsoft, the platform supports multiple programming languages and libraries to build web, mobile, desktop, IoT applications, and more.

![.NET 5 platform](https://images.ctfassets.net/23aumh6u8s0i/2bsVrNvzMOk64yfFw0ZU3O/b88d3412d42844d54011f31d69d5860f/dotnet5_platform)

<a href="https://devblogs.microsoft.com/dotnet/introducing-net-5/">[Source: Microsoft]</a>

Even if C# is considered the main programming language for .NET, you can use many other different languages of your choice. The languages directly supported by Microsoft are:

- [C# (C sharp)](https://docs.microsoft.com/en-us/dotnet/csharp/): A modern object-oriented programming language that belongs to the C language family. Its syntax may look familiar to C, C++, Java, and JavaScript developers.

- [F# (F sharp)](https://dotnet.microsoft.com/languages/fsharp): A functional-oriented programming language, member of the [ML](https://en.wikipedia.org/wiki/ML_(programming_language%29) language family. It also supports the object-oriented programming paradigm.

- [Visual Basic](https://docs.microsoft.com/en-us/dotnet/visual-basic/): The historical Microsoft programming language. It has become a full object-oriented programming language within the context of .NET.

.NET supports the [*Common Language Infrastructure*](https://en.wikipedia.org/wiki/Common_Language_Infrastructure) (CLI), so your source code is compiled into a [*Common Intermediate Language*](https://en.wikipedia.org/wiki/Common_Intermediate_Language) (CIL), independently of the programming language you use. This guarantees great interoperability between languages in the platform.

Besides the above mentioned languages supported directly by Microsoft, many other programming languages can compile to the .NET CIL. For example, ClojureCLR, Eiffel, IronPython, PowerBuilder, and many others. For a complete list, check out [this page](https://en.wikipedia.org/wiki/List_of_CLI_languages).

## .NET Architecture and Components

.NET allows you to build different application types, ranging from command-line to desktop applications, from web to mobile applications, from gaming to IoT applications.

This is possible thanks to its modular and optimized architecture.

### .NET Components

The .NET architecture is based on two main components:

- *CoreCLR*: This is the .NET runtime. It is responsible for executing CLI programs and includes a just-in-time compiler.

- *CoreFX*: The platform’s API implementing the CLI Standard Libraries, that is, the set of libraries that provide the most common functionalities, such as file system management, exception handling, network communication, threading, reflection, and so on. The CoreFX component is sometimes called the *Unified Base Class Library*.

### .NET Application Models

Above the core components, you have the different **application model frameworks**, that is, the libraries that offer support for developing different types of applications. So, for example, you have:

- [ASP.NET](https://dotnet.microsoft.com/apps/aspnet): The framework that allows you to build [web applications](https://auth0.com/docs/quickstart/webapp/aspnet-core-3) and [web APIs](https://auth0.com/blog/how-to-build-and-secure-web-apis-with-aspnet-core-3/).

- [Windows Presentation Foundation (WPF)](https://docs.microsoft.com/en-us/dotnet/desktop/wpf/?view=netdesktop-5.0): A graphical user interface for [Windows desktop applications](https://auth0.com/docs/quickstart/native/wpf-winforms).

- [Xamarin](https://auth0.com/blog/easy-authentication-xamarin-auth0/): The framework for building cross-platform mobile, TV, and desktop applications.

- [Blazor](https://auth0.com/blog/what-is-blazor-tutorial-on-building-webapp-with-authentication/): The framework to build client web applications by using C#. It also allows you to generate [client web apps in WebAssembly code](https://auth0.com/blog/securing-blazor-webassembly-apps/).

- [ML.NET](https://dotnet.microsoft.com/apps/machinelearning-ai): The machine learning framework that simplifies the integration of machine learning models in your .NET application.

In addition to application model frameworks, .NET offers you support for most of the common programming tasks: from file management to network communication, from security to database access. For example, on the networking side, it supports socket programming, HTTP communication, and [gRPC](https://auth0.com/blog/securing-grpc-microservices-dotnet-core/). This allows you to [create microservices](https://auth0.com/blog/implementing-microservices-grpc-dotnet-core-3/) with the protocol that better fits your needs.

For any other needs not embedded in the framework, you can find a huge number of specific libraries on the public [NuGet repository](https://www.nuget.org/). In fact, [NuGet](https://docs.microsoft.com/en-us/nuget/) is the package manager for .NET. It allows you to create, share, and use many .NET libraries for almost any purpose.

## .NET Design and Development Support

.NET support for software development is not limited to the multiple programming languages you can use. .NET also promotes the use of some best practices while letting you use the approach you prefer to build your application.

For example, it encourages you to [use dependency injection to decouple your application’s components](https://auth0.com/blog/dependency-injection-in-dotnet-core/). Dependency injection helps you design better software by limiting the component interdependence and facilitating reuse. In addition, it makes it easier to test your components.

By the way, on the testing side, .NET also comes with support for [unit and integration tests via xUnit](https://auth0.com/blog/xunit-to-test-csharp-code/).

On the front of the development experience, developers can choose from different approaches. They can use the [.NET CLI ](https://docs.microsoft.com/en-us/dotnet/core/tools/)environment, using the command line to create new projects, adding dependencies, build, run, and so on.

They can use [Visual Studio Code](https://code.visualstudio.com/) for an intermediate approach: an advanced cross-platform editor on top of the .NET CLI. Or they can use a powerful IDE like [Visual Studio](https://visualstudio.microsoft.com/vs/), available for both Windows and Mac, that provides you an interactive programming experience.

Regardless of the tool you choose, you can use many project templates to quickly start creating your new application. You can also [create your own .NET project template](https://auth0.com/blog/create-dotnet-project-template/).

## From the .NET Framework to the .NET Platform

Microsoft launched the .NET project in 2002. Since the beginning, the .NET goal was to create a universal platform for programming with any language. Of course, as the first step, Windows was the main .NET target.

However, Microsoft submitted the specifications of the .NET runtime infrastructure and the C# programming language to [ECMA](https://www.ecma-international.org/) for standardization. This led to the birth of a few porting projects on other platforms: Linux, embedded systems, mobile devices, browsers, and so on.

This also led to a fragmentation of the platform and sometimes generated confusion among developers. Take a look at [this article to learn more about the evolution of .NET](https://auth0.com/blog/navigating-dotnet-maze/).

Let’s try to clarify the differences among a few common concepts.

### .NET Framework

The .NET Framework was the initial flavor of .NET. It provides the developer with a set of APIs for the most common programming needs and interacts with the underlying operating system. It runs only on Windows, and its lifecycle is coming to an the end right now, after [the release of .NET 5](https://auth0.com/blog/dotnet-5-whats-new/).

### Mono

The Mono project brings .NET to Linux machines. It is the best known porting project based on the .NET standard specifications. Even if Mono's aim is to run on Linux applications built for the .NET Framework and vice versa, the compatibility is not always guaranteed. There are a couple of reasons for this: some .NET Framework features are too tied to the Windows operating system, and often the Mono implementation lags behind the newest .NET Framework features.

### .NET Core

.NET Core is a complete rewriting of the .NET Framework with the cross-platform goal in mind. Its redesigned architecture defines a minimal feature set as the common core across Windows, Linux, and Mac platforms. The rest of the features can be downloaded as library packages.

### .NET Standard

The .NET Standard is not another .NET implementation. It is a formal specification of .NET APIs that helps to create cross-platform libraries. If a platform supports a given .NET Standard version, then a library supporting the same version will run on it, regardless of the device type and the framework implementation (.NET Framework, Mono, .NET Core).

### .NET

Since the beginning, the .NET term has been used to indicate the universal development platform. However, many implementations arose since then, so the .NET name created ambiguities. .NET 5 aims to make concrete the initial vision of a universal development platform. It replaces the current existing implementations: .NET Framework, .NET Core, and even Mono. So, from .NET 5 on, only .NET will exist as a name and as a platform.

## Auth0 and .NET

Auth0 has extensive support for .NET that allows you to easily integrate modern authentication and authorization into your .NET applications: from specific SDKs to documentation, from blog posts to sample projects. In this section, you find a list of the .NET resources that Auth0 provides you.

### .NET QuickStarts

Auth0 Quickstarts help you in setting up your first [authentication](https://auth0.com/docs/authentication) and [authorization](https://auth0.com/docs/authorization) integration. They guide you in adding the needed code and the required configuration step by step. If you are logged in, the code snippets are configured for your account. If you don't have an account, you <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">can sign up for free with Auth0</a>.

The following .NET-related Quickstarts are available:

- [**ASP.NET Core Web API v3.1**](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi): This Quickstart helps you to add authorization to an ASP.NET Core Web API using the standard [JWT](https://jwt.io/) middleware.
- [**ASP.NET Core v3.1 Web Application**](https://auth0.com/docs/quickstart/webapp/aspnet-core-3): This Quickstart demonstrates how to add user login to an ASP.NET Core Web Application.
- [**WPF/Windows Forms (WinForms**)](https://auth0.com/docs/quickstart/native/wpf-winforms): The Quickstart guides you in adding user login Windows desktop C# applications.
- [**Xamarin**](https://auth0.com/docs/quickstart/native/xamarin): This Quickstart helps you add user login to Xamarin applications.
- [**Windows Universal App**](https://auth0.com/docs/quickstart/native/windows-uwp-csharp): Reading this Quickstart, you will learn how to add user login to [Windows Universal](https://docs.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide) C# applications.

### Software Development Kits (SDKs)

Auth0 provides you the following SDKs to help you to integrate authentication and authorization in your .NET applications:

- [**.NET Client Library for Auth0**](https://github.com/auth0/auth0.net): This SDK supports two APIs:
 - *The Authentication API*: This API allows you to add [OIDC](https://auth0.com/docs/protocols/openid-connect-protocol)-based authentication to your application
 - *The Management API*: This API allows you to interact with the [Auth0 Management API](https://auth0.com/docs/api/management/v2) and deal with your [Auth0 tenant](https://auth0.com/docs/videos/get-started-series/architect-your-tenant).
- [**Auth0 OIDC Client for .NET** ](https://github.com/auth0/auth0-oidc-client-net): This library supports [OIDC authentication](https://auth0.com/docs/protocols/openid-connect-protocol) for .NET desktop applications based on WinForms, WPF, and UWP as well as Xamarin mobile applications.

### .NET blog posts

In addition to SDKs and Quickstarts, Auth0 provides you with specific content, use cases, and code examples through its [developer blog](https://auth0.com/blog/developers/). You can find [many .NET-related articles](https://auth0.com/blog/search/?query=.net) that help you build and secure your applications and keep up to date with the most recent features. Most articles include a sample project to demonstrate how to practically implement your apps. You can download them from GitHub, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up with Auth0</a> if needed, configure the app, run it, and explore the code.

So, enjoy building your next .NET project with Auth0!

What is .NET? An Overview of the Platform

A guide for understanding the differences between .NET, .NET Core, .NET Framework, .NET Standard, etc. by exploring the history of the platform.

If you are confused in front of the different facets of .NET, or if you are not clear on the differences between .NET, .NET Core, .NET Framework, .NET Standard, and similar, well, this article is for you.

## What .NET Means Today

Say you are a new developer that wants to approach .NET. Caught up in the excitement, you navigate to [Microsoft's website](https://dotnet.microsoft.com/) and find the following definition:

![.NET: Free. Cross-platform. Open source. A developer platform for building all your apps (web, mobile, desktop, game, IoT).](https://images.ctfassets.net/23aumh6u8s0i/2yLTpLYPjn9DUjXgqHkN0f/03d54d78d435bc55ea6885a912cc9945/dotnet-platform.gif)

Cool! This platform looks great! You can build any kind of application by using C# or [any other .NET compatible programming language](https://en.wikipedia.org/wiki/List_of_CLI_languages).

However, there are issues are around the corner...

Maybe you find an awesome library on [NuGet](https://www.nuget.org/), but learn that it is for the .NET Framework and cannot use it in your project unless you target your project to .NET Standard 2.0. In that case, your application will also run on .NET Core.

What? Isn't .NET Framework just .NET? And what are .NET Standard and .NET Core?

Welcome to the .NET maze! If you don't want to get lost in it, you need [Ariadne's thread](https://en.wikipedia.org/wiki/Ariadne).

I understand that not everyone likes history, especially in the IT field. Many people prefer to know what and how to do things *today*. But, as it happens in everyday life, the past has a great influence on the present and also on the future. To understand today's and future .NET, you need to take a step back and trace its history, at least in broad strokes.

## In the Beginning Was the .NET Framework

In 2002, Microsoft promised one framework to build applications with any programming language: C# (born for that occasion), Visual Basic, and [many other languages](https://en.wikipedia.org/wiki/List_of_CLI_languages). The framework granted a common API set, language independence, interoperability with the underlying operating system and other non-.NET applications, portability (at least in perspective, at the time), and many interesting features.

Although the long-term idea was to make .NET a cross-platform framework, **the .NET Framework only ran on Windows**.

Don't get me wrong. Even if I'm speaking in the past tense, the .NET Framework is still alive and operative. Its [current version is 4.8](https://devblogs.microsoft.com/dotnet/announcing-the-net-framework-4-8/), and it is the last version of the framework, as you will learn later. But a huge amount of code runs on it, so you cannot consider it a dead framework yet.

## Mono on the Stage

One interesting thing is that Microsoft published the specifications of the [*Common Language Infrastructure* (CLI)](https://en.wikipedia.org/wiki/Common_Language_Infrastructure), that is, the .NET Framework runtime, and the C# language. Even better, they set them as open standards: [ECMA-335](https://www.ecma-international.org/publications-and-standards/standards/ecma-335/) and [ECMA-334](https://www.ecma-international.org/publications-and-standards/standards/ecma-334/). So pretty much anyone could implement the .NET runtime and the C# programming language.

In 2007, this paved the way for a project to port .NET to Linux: [the Mono Project](https://www.mono-project.com/). Other attempts to port .NET on Linux were made: [DotGNU](https://www.gnu.org/software/dotgnu/pnet.html) and [CrossNet](https://archive.codeplex.com/?p=crossnet), among others. However, only the Mono Project attracted significant interest and generated a production-ready framework.

However, not everything in the .NET Framework could be ported to Mono due to some strict dependencies on Windows. In addition, the state of Mono development was usually not so aligned with the current state of the .NET Framework. This actually created some friction with the real portability of .NET applications to Linux.

## .NET Everywhere

The open specifications of the .NET fundamental components were the first step towards the quick spread of the framework. Microsoft on one side and other independent developers on the other side brought the .NET Framework to different platforms.

When the .NET Framework was born, Microsoft also released the [.NET Compact Framework](https://en.wikipedia.org/wiki/.NET_Compact_Framework). It was a reduced version of the framework designed to run on devices with limited computing capacity, such as PDAs, mobile phones, set-top boxes, etc.
In 2007, the [.NET Micro Framework](https://netmf.github.io/) was launched: a more efficient version of the .NET Compact Framework that could also run directly on the hardware.

The same year, [Silverlight](https://en.wikipedia.org/wiki/Microsoft_Silverlight) brought .NET to the browser, providing developers with a framework for building rich Internet applications similar to Adobe Flash.

In 2009, the [MonoTouch](https://en.wikipedia.org/wiki/Mono_(software%29#MonoTouch) project started. It was the first attempt to port the Mono framework (that is, the Linux implementation of the .NET Framework) to iOS and Android. In a few years, the MonoTouch project became the foundation for [Xamarin](https://dotnet.microsoft.com/apps/xamarin), the framework for building Android and iOS apps with C# (2013).

So, as early as 2013, .NET allowed you to build applications for Windows and Linux machines, for embedded devices, for the browser, and for iOS and Android devices.

You may think that it was amazing! However, the proliferation of different environments led to a fragmentation of the framework itself. That wasn't much of a problem for those who were developing applications. Applications are usually platform-specific. This fragmentation was a big problem for library developers. In fact, a .NET assembly could theoretically be loaded in any .NET runtime. Unfortunately, it could break at any point if it calls an API that wasn’t supported by the platform it is running on.

The cross-platform dream had not yet come true.

<include src="TweetQuote" quoteText="As early as 2013, .NET allowed you to build applications for Windows and Linux machines, for embedded devices, for the browser, and for iOS and Android devices."/>

## The Rise of .NET Core

In 2014, to pursue the goal of an actual cross-platform development framework, Microsoft started writing .[NET Core](https://github.com/dotnet/core) from scratch. The first release was ready in 2016. The new framework was a complete redesign of the .NET specifications with cross-platform support in mind. In fact, its runtime ran on Windows, Linux, and macOS.

This new framework didn't have the backward-compatibility constraints that the .NET Framework had. Its modular architecture provided smaller versions of the framework's core components, letting the developer download the additional components from the NuGet repository. This refactoring enabled simplified deployment and portability.

## The Need for a Standard

While .NET Core was a step in the right direction for cross-platform support, it brought yet another implementation in the already entangled .NET ecosystem. In other words, a library developer has another potential pain point for the portability of their library.

Microsoft tried to put order into this chaos by [introducing the .NET Standard](https://devblogs.microsoft.com/dotnet/introducing-net-standard/). This is not just another framework implementation, but a formal specification of .NET APIs that multiple .NET platforms have to implement. Different .NET Standard versions define different .NET API sets. This way, a .NET implementation declares which .NET Standard version it supports. The library developer needs to target that specific .NET Standard version.

For example, if you want your library to run on .NET Framework 4.5, .NET Core 2.1, and Mono 4.6, you should target your project to [.NET Standard 1.1](https://github.com/dotnet/standard/blob/master/docs/versions/netstandard1.1.md). See the [official documentation to take a closer look at the .NET Standard](https://docs.microsoft.com/en-us/dotnet/standard/net-standard).

Targeting a .NET Standard is a matter of specify the [Target Framework Moniker (TFM)](https://docs.microsoft.com/en-us/dotnet/standard/frameworks) in the .NET project file. It is something like the following in your .NET project file:

``` xml 
<Project Sdk="Microsoft.NET.Sdk">

 <PropertyGroup>
 <TargetFrameworks>netstandard2.0</TargetFrameworks>
 </PropertyGroup>
 ...
</Project>
```

## Only .NET from Now On

Finally, in November 2020, [.NET 5 was released](https://auth0.com/blog/dotnet-5-whats-new/). This new version of the framework aims to be the unified .NET platform from now on. No more need for different implementations: .NET 5 is the common set of APIs that runs on Windows, Linux, Mac, iOS, and Android. So, if your project targets .NET 5, your code will run on all those platforms.

![.NET 5 platform](https://images.ctfassets.net/23aumh6u8s0i/62ADaRg2zm1S8J9gpKX6Kv/a062f9c576330a811fb155da37104beb/dotnet5_platform)
<a href="https://devblogs.microsoft.com/dotnet/introducing-net-5/">[Source: Microsoft]</a>

If you need a given platform's APIs, you should use a specific TFM. For example, if you want to use [Windows.Forms](https://docs.microsoft.com/en-us/dotnet/desktop/winforms/?view=netdesktop-5.0) for your desktop application, you need to specify the `net5.0-windows` TFM, since this feature is supported on the Windows operating system. Of course, in this case, you know that your code will run only on that specific platform.

.NET 5 removes the need for .NET Standard. Actually, you may think of .NET 5 as the evolution of .NET Standard. However, .NET 5 is not a formal specification but an actual implementation. Also, the release of .NET 5 marks the end of .NET Framework.

At this point, you might ask: .NET 5 is the subsequent version of .NET Core 3.1. What happened to .NET 4?

The answer is pretty simple: there is no .NET 4! Microsoft decided to skip this version to avoid confusion with .NET Framework 4.x. So, from now on, .NET will have no more Framework, Core, Compact, or Micro. The future of .NET will have no other qualifier than just its version.

<include src="asides/DotNetCore" />

.NET Core vs .NET Framework vs .NET Standard: A Guided Tour

Learn the best practices to store and manage secrets in your .NET applications.

Secrets Management in .NET Applications

Learn how to build a CRUD Web API with ASP.NET through this practical tutorial.

Building ASP.NET CRUD Web APIs

Checking user permissions allows you to have more control over access to your ASP.NET Web API.

Protecting a Web API from unauthorized users is the first step to get control over who can access it. However, simply excluding anonymous users may be insufficient in some situations. You may need to control over who can do what on your application. This article will show you how to define and check permissions for users accessing your ASP.NET Web API secured with Auth0.

## The Need for Permissions

A previous article introduced [how to enable authorization for ASP.NET Web APIs](https://auth0.com/blog/aspnet-web-api-authorization/). The sample application accompanying that article is an ASP.NET Web API that implements the CRUD (*Create*, *Retrieve*, *Update*, *Delete*) operations over a glossary of terms. That article explains how to protect the Web API by using Auth0 so that only authorized users can create, modify, and delete glossary items. Everyone can still get the list of terms or a single glossary item.

That worked pretty well! However, you may need more granular control over the users who can do specific operations. For example, you may want to give some users the ability to add a new glossary term or modify an existing one, but you don't want them to delete items. Only specific users should be able also to delete items. To achieve this control level, you must deal with permissions.

In the security context, a **permission** is a property of a resource that indicates the operation a user can do on it, like, for example, read, write, print, send, etc. In the case of your sample application, you have the glossary and term resources. Regarding the former, you can get the list of terms and add new items. Regarding the latter, you can read, update, or delete it.

<details>
 <summary>Permissions vs. privileges</summary>
Usually, permissions and privileges are used interchangeably, but technically they have precise and different meanings in the context of computer security.


A **permission** is an action that can be performed on a resource. It is somehow bounded to the resource, and you can consider it as a resource property.

A **privilege** is a permission assigned to a user or an application. When you assign the writing permission to a user, you are granting them a privilege.
</details>

## Setting up the Web API Application

The goal of this article is to show you how to implement permission-based authorization in this sample application. 

> Make sure you have [the latest .NET SDK](https://dotnet.microsoft.com/download/dotnet/current) already installed on your machine to run the sample ASP.NET application.

So, let's start by downloading the source code with the following command:

```bash
git clone --branch add-authorization --single-branch https://github.com/auth0-blog/glossary-web-api-aspnet.git
```

Once you download the application, register it with Auth0 in order to enable support for the authorization service. If you haven't an Auth0 account, you can <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free one</a>. Follow the [instructions in this article to register the application with Auth0](https://auth0.com/blog/aspnet-web-api-authorization/#Registering-the-Web-API-with-Auth0).

After you completed the registration, move to the `glossary-web-api-aspnet` folder and open the `appsettings.json` configuration file. Its content looks as follows:

```json
{
 "Logging": {
 "LogLevel": {
 "Default": "Information",
 "Microsoft": "Warning",
 "Microsoft.Hosting.Lifetime": "Information"
 }
 },
 "AllowedHosts": "*",
 "Auth0": {
 "Domain": "YOUR_AUTH0_DOMAIN",
 "Audience": "YOUR_UNIQUE_IDENTIFIER"
 }
}
```

Replace the `YOUR_AUTH0_DOMAIN` placeholder with your Auth0 domain and the `YOUR_UNIQUE_IDENTIFIER` placeholder with the value you provided as a unique identifier of your API (`https://glossary.com`, if you kept the value suggested in [the mentioned article](https://auth0.com/blog/aspnet-web-api-authorization/#Registering-the-Web-API-with-Auth0)).

> Note: Your Auth0 domain is a string in the form `YOUR-TENANT-NAME.auth0.com` where `YOUR-TENANT-NAME` is the name you provided when you created your account with Auth0. For more information, [check the documentation](https://auth0.com/docs/getting-started/the-basics#domains).

Now, launch the ASP.NET Web API application by typing `dotnet run` in a terminal window. By pointing your browser to `https://localhost:5001/swagger`, you should see the [Swagger UI](https://swagger.io/tools/swagger-ui/) shown below to test the API interactively:

![Protected Web APIs in Swagger UI](https://images.ctfassets.net/23aumh6u8s0i/1rNBChKdbCr9fKdpbbYcKR/014f6ace0411febc726959cd88ed8e6a/protected-swagger-ui-webapi.png)

To call the `POST`, `PUT`, and `DELETE` actions, [you need an access token, as explained in this section](https://auth0.com/blog/aspnet-web-api-authorization/#Testing-the-Secure-Web-API).

Now you are ready to set up permissions on your Web API.

## Defining Permissions for an API

The first step is to define the permissions for your application. These permissions can vary depending on the needs of your application. In the glossary Web API application, we are going to define the permissions identified by the following strings:

- `create:term`. This permission allows you to add a new term to the glossary.
- `update:term`. With this permission, you can update an existing term.
- `delete:term`. This permission allows you to delete a term from the glossary.

To associate these permissions with your API, go to the [API section](https://manage.auth0.com/#/apis) of your Auth0 Dashboard and select the API you defined for the glossary application. Then select the *Permissions* tab. Here you can add the permissions with their descriptions as defined above. At the end of this process, that page will look like the following:

![Defining permissions in the Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/52FOUrB7EcV17WYLSjdbDS/19d1360d9def0ea77cc550ba664a7748/defining-permissions-auth0-dashboard.png.png)

This configuration informs Auth0 that the glossary Web API supports only these permissions.

Next, move to the *Settings* tab and scroll down to the *RBAC Settings* section. Here, click both the *Enable RBAC* and the *Add Permissions in the Access Token* toggle buttons, as in the following picture, and don't forget to click the *Save* button at the end:

![](https://images.ctfassets.net/23aumh6u8s0i/49AQnZIW5pP4wBIHA4sV9i/2c476e2508ff68fde80061b6973016ca/enabling-rbac.png)

These settings will enforce the evaluation of roles and permissions assignments during the user login.

> Although we will not use roles in this article, you still need to enable RBAC (Role-Based Access Control) support.



<details>
 <summary>Permissions vs. scopes</summary>
When defining the API permissions in the Auth0 Dashboard, you find the term *scope* next to the term *permission*. You may think that they are synonymous, but they actually aren't. Both describe the actions that can be performed on a resource, but they are used in different authorization scenarios.

**Permissions** are used in a [first-party authorization scenario](https://auth0.com/docs/applications/first-party-and-third-party-applications#first-party-applications), i.e., when the same organization or person controls both the client and the server applications.

**Scopes** are used in a [third-party authorization scenario](https://auth0.com/docs/applications/first-party-and-third-party-applications#third-party-applications), i.e., when different organizations control the client and the server applications.

In the latter scenario, the client application asks for one or more permissions to operate on a specific resource on behalf of the user. This requested permission is a **scope**. Usually, scopes limit what an app can do on behalf of the user, and the user may grant them to the application or not.

Scopes have been [introduced by OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc6749#section-3.3) in the context of delegated authorization.
</details>

## Checking Permissions in an API

As the next step, you need to check that the user calling your API has the proper permissions. You can accomplish this task by defining one or more authorization policies and applying them to the controller or the methods that implement your ASP.NET Web API.

An **authorization policy** is a set of requirements that users or applications must meet in order to be allowed to perform an action on a resource. Let's see how you can define and apply an authorization policy in practice.

### Registering an authorization policy

To define an authorization policy for the glossary Web API, open the `Startup.cs` file in the root folder of the project and append the following code to the body of the `ConfigureServices()` method:

```csharp
// Startup.cs

// ...existing code...

namespace Glossary
{
 public class Startup
 {
 // ...existing code...
 
 public void ConfigureServices(IServiceCollection services)
 {
 // ...existing code...
 
 //👇 new code
 services.AddAuthorization(options =>
 {
 options.AddPolicy("WriteAccess", policy => 
 policy.RequireClaim("permissions", "create:term", "update:term"));
 options.AddPolicy("DeleteAccess", policy => 
 policy.RequireClaim("permissions", "delete:term"));
 });
 //👆 new code
 }
 
 // ...existing code...
 }
}

```

You invoked the `AddAuthorization()` method to configure the ASP.NET authorization service. To this purpose, you defined two authorization policies via the `AddPolicy()` method of the `options` parameter. Each policy has a name and a lambda expression. For example, the `WriteAccess` authorization policy is defined by requiring the `permissions` [claim](https://auth0.com/docs/tokens/json-web-tokens/json-web-token-claims) in the access token whose value can be `create:term` or `update:term`. Similarly, for the `DeleteAccess` policy.

### Authorization policy approaches

You defined two authorization policies based on the permissions you defined for the API in the Auth0 Dashboard. Both policies are based on requiring the existence of claims with specific values. This is the simplest way to define an authorization policy in ASP.NET. It is usually referred to as [claim-based authorization](https://docs.microsoft.com/en-us/aspnet/core/security/authorization/claims).

If you have more complex criteria for defining your authorization policies, you need to use the [policy-based authorization](https://docs.microsoft.com/en-us/aspnet/core/security/authorization/policies) approach. For example, if you want to be sure that the issuer of the `permissions` claim is your [Auth0 tenant](https://auth0.com/docs/get-started/create-tenants), you can define your `WriteAccess` authorization policy as follows:

```csharp
options.AddPolicy("WriteAccess", policy => 
 policy.RequireAssertion(context =>
 context.User.HasClaim(claim =>
 (claim.Type == "permissions" &&
 (claim.Value == "create:term" ||
 claim.Value == "update:term") &&
 claim.Issuer == $"https://{Configuration["Auth0:Domain"]}/"
 )
 )
 )
 );
```

In this case, you used the `RequireAssertion()` method to build a boolean expression that evaluates your specific criteria. In particular, this criteria checks that the `Issuer` property of the claim matches the URL of your Auth0 tenant.

> Note that claim-based authorization is just a specialized case of policy-based authorization.

If you have more specific needs, you can even [customize the built-in ASP.NET authorization middleware](https://docs.microsoft.com/en-us/aspnet/core/security/authorization/customizingauthorizationmiddlewareresponse).

### Applying an authorization policy

Once you define and register your authorization policies, you can apply them in your Web API. Applying an authorization policy is just a matter of passing parameters to the `Authorize` attribute. So, open the `GlossaryController.cs` file under the `Controllers` folder and apply the changes outlined in the following:

```csharp
// Controllers/GlossaryController.cs

// ...existing code...

namespace Glossary.Controllers
{
 [ApiController]
 [Route("api/[controller]")]
 public class GlossaryController : ControllerBase
 {
 // ...existing code...

 [HttpPost]
 [Authorize(Policy = "WriteAccess")] //👈 changed code
 public ActionResult Post(GlossaryItem glossaryItem)
 {
 // ...existing code...
 }

 [HttpPut]
 [Authorize(Policy = "WriteAccess")] //👈 changed code
 public ActionResult Put(GlossaryItem glossaryItem)
 {
 // ...existing code...
 }

 [HttpDelete]
 [Route("{term}")]
 [Authorize(Policy = "DeleteAccess")] //👈 changed code
 public ActionResult Delete(string term)
 {
 // ...existing code...
 }
 }
}
```

This way, you are requesting the ASP.NET authorization middleware to evaluate a specific policy to authorize the execution of the related controller's method.

Your Web API is ready to run and check permissions!

## Testing Permissions

To test the new glossary Web API, you are going to simulate users accessing the endpoints with different permissions. For this simulation, you will interact with the API through the Swagger UI by providing an access token. So, launch the Web API by typing `dotnet run` in a terminal window and point your browser to [https://localhost:5001/swagger](https://localhost:5001/swagger).

### Testing access without permissions

Let's try to access a protected endpoint with an access token not bound to any permissions. Go to the [API section](https://manage.auth0.com/#/apis) of your Auth0 Dashboard, select the API related to the glossary app, and select the *Test* tab. Here you can get a token to test your Web API by clicking the *Copy Token* icon as shown in the following picture:

![Copy access token](https://images.ctfassets.net/23aumh6u8s0i/1FENUfKNw5FrmexhvdWwv5/bb1c283a019dc0fd7322e357efd1bdb2/copy-token.png)

Now, head back to your browser and click the *Authorize* button. A window dialog opens, as shown in the following picture:

![Bearer token in Swagger UI](https://images.ctfassets.net/23aumh6u8s0i/18f9kh3tBXiOMbxjSA7j1k/c0ab1d1475b75ef51a50a1009ea3c5c1/access-token-swagger-ui.png)

Paste the token you copied from the Auth0 Dashboard into the text box and click *Authorize*.

> To learn a bit more about the Swagger UI, check out [this article about ASP.NET Web API authorization](https://auth0.com/blog/aspnet-web-api-authorization/).

Now, try to add a new glossary term through the `POST` action. You should get a negative response from the server similar to this one:

![Forbidden action on an endpoint](https://images.ctfassets.net/23aumh6u8s0i/2jJfEWsECwVKy9qwcy7Nyk/182e158601d78774ee3fd633028badea/forbidden-action-on-endpoint.png)

Notice that, this time, you didn't receive the `401 Unauthorized` HTTP status code. You received the `403 Forbidden` status code. This denotes that you are providing an access token, so you are authorized to access the application, but you don't have the required permissions to perform this specific action.

You can verify your current permissions by visiting [jwt.io](https://jwt.io/) and pasting your access token there. This tool allows you to decode your access token. You will discover that the `permissions` claim shown in the payload section is an empty array, as in the following picture:

![Empty permissions claim in JWT](https://images.ctfassets.net/23aumh6u8s0i/5bMNrF4vS9iYs3hQuxCMe2/d8bffd83f61373f5b9a6e2b0d69691b6/empty-permissions-claim-in-jwt.png)

### Testing access with writing permissions

Let's create an access token with the required permissions for adding a new term.

Back in your API configuration page on the Auth0 Dashboard, select the *Machine to Machine Applications* tab. You'll get a list of applications, some of them with the *(Test Application)* label in the name. These applications are automatically created by Auth0 when you create an API there. They are meant as test clients from your API. One of them should have the *Authorized* switch on. Click the dropdown next to it and check the `create:term` and `update:term` permissions in the section that will be shown:

![Writing permissions assignment](https://images.ctfassets.net/23aumh6u8s0i/1noHOvxBZaRERXAJ9SpPt2/849b32e5f54524cc3e6f3e58eb1f3578/assign-writing-permissions.png)

Then, click the *Update* button, move again to the *Test* tab, and copy the new token that has been generated for you. Now, in the Swagger UI of your Web API, click the *Authorize* button again. This time the following window should appear:

![Changing the access token](https://images.ctfassets.net/23aumh6u8s0i/1WKMrki5ZtwLPvBKmoQ1Gv/b276253e73ed5848f804ac69a37718d3/changing-access-token.png)

Click the *Logout* button and paste the new access token in the text box that appears.

At this point, try again to add a new term to the glossary through the `POST` action. Now you should get a successful response from the server.

If you decode your new access token in [jwt.io](https://jwt.io/), you should see that the `permissions` claim now contains the two permissions you assigned:

![Writing permissions in JWT](https://images.ctfassets.net/23aumh6u8s0i/WVVEcOwuIeuB73aYKu0Q0/e8a722919757b259befd52ddc09dfdf5/writing-permissions-in-jwt.png)

If you attempt to delete the newly created term with the same access token, you get the `403 Forbidden` status code as before. In fact, your access token doesn't contain the deleting permission.

### Testing access with deleting permissions

To be authorized to delete a glossary term, you need to grant the deleting permission to the test application. So, go back to the *Machine to Machine Application* tab of your API configuration on the Auth0 Dashboard and open the permissions section of the test application again. Check also the `delete:term` permission and click the *Update* button. Now, in the *Test* tab, copy the new access token and head back to your browser.

In the Swagger UI of your Web API, replace your current access token with the new one by using the *Authorize* button. Then, delete the glossary term you added earlier by using the `DELETE` action. This time your attempt should be successful!

## Recap

In summary, you learned that permissions give you more granular control over access to your Web API. You discovered how to define permissions associated with your API in Auth0 and how to define and register authorization policies in your ASP.NET application. You saw that checking permissions in your API controller is a matter of adding a parameter to the `Authorize` attribute. You used your test client application on the Auth0 Dashboard to generate access tokens with the required permissions. Finally, you used the Swagger UI to test your Web API with access tokens having different permissions.

You can download the final code of the sample application from [this GitHub repository](https://github.com/auth0-blog/glossary-web-api-aspnet/tree/add-permission).

Permission-Based Security for ASP.NET Web APIs

What's new in .NET 5? Learn how .NET Core and .NET Framework evolve into the new cross-platform framework.

.NET 5, the successor of .NET Core 3.1 and .NET Framework 4.8, aims to provide .NET developers with a new cross-platform development experience. It puts order to the .NET universe fragmentation that has been arising over the years and brings new amazing features. Of course, you cannot learn all about .NET 5 right now, but you can focus on just five things to have a clear understanding of what is going on.

## The Unified Platform

The first thing you have to know is that .NET 5 brings you a new unified vision of the .NET world.

If you have been working with .NET, you may be aware of its platform fragmentation since its first release in 2002. The .NET Framework was initially designed for Windows, but its runtime specification, also known as Common Language Infrastructure (CLI), was standardized as [ECMA 335](https://www.ecma-international.org/publications/standards/Ecma-335.htm).

The standardization allowed anyone to create their own implementation of the .NET runtime. And in fact, a few of them appeared on the horizon: [Mono](https://www.mono-project.com/) for Linux-based systems, [Silverlight](https://www.microsoft.com/silverlight/) for browser-based applications, .[NET Compact](https://en.wikipedia.org/wiki/.NET_Compact_Framework) and [Micro](https://en.wikipedia.org/wiki/.NET_Micro_Framework) frameworks for mobile and resource-constrained devices, and so on. Then, Microsoft decided to write .NET Core from scratch with cross-platform compatibility in mind.

These different implementations raised the need to understand where a .NET package could run on. Should you build different versions of your library to distribute it? The answer to this question was [.NET Standard](https://docs.microsoft.com/en-us/dotnet/standard/net-standard), i.e., a formal specification of the common APIs you should expect across CLI implementations. In other words, if you build your library for one specific .NET Standard, you'll be guaranteed it will run on all the runtimes that implement that specification.

You understand that, in this messy situation, the desired cross-implementation compatibility is not so easy to achieve. This is why .NET 5 appears on the scene.

![.NET 5 Platform](https://images.ctfassets.net/23aumh6u8s0i/l9JJaTYKjT55fB2VDus2R/d3bbe04d363cf6e022e24ca882840173/dotnet5_platform)

[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/introducing-net-5/)]

The new .NET platform is the unified successor of the various .NET flavors: .NET Framework, .NET Standard, .NET Core, Mono, etc. It is officially the next version of .NET Core 3.1, but basically determines the end of .NET Framework, .NET Standard, and the other variants that caused big headaches to .NET developers.

.NET 5 provides a common set of APIs that aligns the different runtime implementations. This set of APIs is identified by the `net5.0` [Target Framework Moniker](https://docs.microsoft.com/en-us/dotnet/standard/frameworks) (TFM), which is the token you set in your .NET project to specify the target framework. This enables your application to run on any runtime implementation supporting .NET 5. However, you can still build applications for a specific platform. For example, to build an application that uses Windows API, you need to specify the `net5.0-windows` TFM. This way, building a platform-specific application is **your** choice, not a choice depending on the runtime implementation you are using to develop your application.

Of course, achieving this unified platform required a significant effort and an internal architecture rearrangement. A few features have been removed from the core API set, as you will see later on, but [the platform gained a general improvement in performance](https://devblogs.microsoft.com/dotnet/performance-improvements-in-net-5/).

While the new .NET 5 comes with the platform unification goal, the initial plan changed because of COVID-19. In fact, .NET 5 sets the foundations of the unification, but it will be completed with .NET 6 in November 2021. With that release, you will get the stable release of the new Universal UI and support for the specific TFMs for Android (`net6.0-android`) and iOS (`net6.0-ios`), for example.

<include src="TweetQuote" quoteText=".NET 5 was born with cross-platform compatibility in mind."/>

## New Features in C# #

The second thing you should know is about C#. .NET 5 comes with C# 9, the new version of the .NET platform's main programming language. There are several new features, but here you will find a taste of the most relevant ones.

### Top-level statements

Among the new features, one of the most notable is the introduction of **top-level statements**. To learn what they are, take a look at the following classic minimal program:

<include src="AmpWarning" fullUrl="https://auth0.com/blog/dotnet-5-whats-new"/>

``` csharp 
using System;

namespace HelloWorld
{
 class Program
 {
 static void Main(string[] args)
 {
 Console.WriteLine("Hello World!");
 }
 }
}
```

Just to write one string to the console, you need to define a namespace, a class, and the static method `Main()`. Now, you can get rid of this code infrastructure and simply write the following:

``` csharp 
System.Console.WriteLine("Hello World!");
```

Top-level statements allow you to focus on what really matters in small console programs and utilities and use C# with a more scripting-oriented approach.

### Record types

Another interesting new feature is **record types**. With records, you can declare an immutable reference type, i.e., a class-based type that cannot be changed after its creation. An example of a built-in immutable reference type is the `System.String` class. After you create an instance of a `System.String`, you cannot change its value anymore.

Consider the following record type declaration:

``` csharp 
public record Person
{
 public string FirstName { get; }
 public string LastName { get; }

 public Person(string first, string last) => (FirstName, LastName) = (first, last);
}
```

You can create an instance of the `Person` record as you do with a class, but you can't change its `FirstName` property:

``` csharp 
var person = new Person("John", "Doe");

person.FirstName = "Jack";	//throws an error
```

However, you can compare two instances of the `Person` record similarly to primitive values:

``` csharp 
var person = new Person("John", "Doe");
var anotherPerson = new Person("John", "Smith");

Console.WriteLine(person == anotherPerson); //false
```

### Init setters

C# 9 also adds the `init` accessor to define **properties that can only be initialized**. To better explain its use cases, consider the following class definition:

``` csharp 
public class Person {
 public string FirstName { get; init; }
 public string LastName { get; init; }
 public string Address { get; set; }
}
```

This class defines a person with `LastName` and `FirstName` properties that can be initialized, but not changed. The `Address` property can be changed at any time:

``` csharp 
var person = new Person {
 FirstName = "John",
 LastName = "Doe",
 Address = "124 Conch Street, Bikini Bottom, Pacific Ocean"
}

person.Address = "17 Cherry Tree Lane";
person.FirstName = "Jack";	//throws error
```

If you want to learn more about the features brought by C# 9, please [check out the official documentation](https://docs.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-9).

## .NET MAUI, the Universal UI

As the third thing, you have to know that .NET 5 is bringing to you a new way to build cross-platform user interfaces. Thanks to the **.NET Multi-platform App UI** framework, also known as **.NET MAUI**), you will be able to build user interfaces for Android, iOS, macOS, and Windows with a single project.

> Actually, this feature is still in progress and will be released with .NET 6, but [you can start taking a look at .NET MAUI](https://github.com/dotnet/maui) to be ready when it is officially released. Take a look at [the roadmap](https://github.com/dotnet/maui/wiki/Roadmap) to follow its progress.

.NET MAUI can be considered an evolution of [Xamarin.Forms](https://dotnet.microsoft.com/apps/xamarin/xamarin-forms), the open-source framework for building iOS and Android apps with a single .NET codebase. But this new framework proposes a universal model for building UIs on mobile and desktop platforms.

![.NET MAUI](https://images.ctfassets.net/23aumh6u8s0i/5QASNuBVJCrC7bIIH6RLct/0edcc3942920c3e8dc49b49026bfeff0/maui-overview)

[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/introducing-net-multi-platform-app-ui/)]

In addition to the well-known [Model-View-ViewModel](https://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93viewmodel) (MVVM) pattern, .NET MAUI supports the new *Model-View-Update* (MVU) pattern. This is a one-way data flow pattern inspired by the [Elm programming language architecture](https://elmprogramming.com/model-view-update-part-1.html) that provides an effective way to manage UI updates and application state.

## Supporting Single-File Applications

The fourth thing you will get in .NET 5 is the support of **single-file applications**, that is, applications published and deployed as a single file. That means that your application and all its dependencies are bundled into one file. For example, say you run the following command within the folder of your .NET 5 project:

``` bash 
dotnet publish -r linux-x64 --self-contained true /p:PublishSingleFile=true
```

You will get a single file containing your application built for Linux, all the dependencies you used in your project, and the .NET runtime (`--self-contained true`). This means that you even don't need to install the .NET runtime on the target machine.

Of course, you can also specify these parameters in your project configuration:

``` xml 
<Project Sdk="Microsoft.NET.Sdk">

 <PropertyGroup>
 <OutputType>Exe</OutputType>
 <TargetFramework>net5.0</TargetFramework>
 
 <PublishSingleFile>true</PublishSingleFile>
 
 <SelfContained>true</SelfContained>
 
 <RuntimeIdentifier>linux-x64</RuntimeIdentifier>
 </PropertyGroup>

</Project>
```

Be aware that this feature doesn't use the same approach as the single-file applications you can build in .NET Core 3.1. In .NET Core 3.1, the single-file application is just a way to package binaries. At run time, they are unpackaged to a temporary folder, loaded, and executed. In .NET 5, the single-file application has a new internal structure, and it is directly executed with no performance penalty.

Take a look at the documentation to [learn more about this deployment type](https://docs.microsoft.com/en-us/dotnet/core/deploying/single-file).

## No Longer Supported Technologies

The last of the five things you are learning about .NET 5 concerns what is no longer supported. As said above, the architectural review and the attempt to make .NET 5 an actual cross-platform programming framework led to removing a few features supported in .NET Framework. Let's take a quick look at the removed features and the possible alternatives.

### Web Forms

For a long time, [ASP.NET Web Forms](https://dotnet.microsoft.com/apps/aspnet/web-forms) has been the main technology to build dynamic web UIs. However, it is not a secret that its lifetime was closely bound to .NET Framework's destiny. .NET Core doesn't support Web Forms, so the fact it is no longer supported in .NET 5 shouldn't actually be news.

However, you have a few alternatives to build web UIs. If you are building traditional web applications, [Razor Pages](https://docs.microsoft.com/en-us/aspnet/core/tutorials/razor-pages/?view=aspnetcore-5.0) are one of these alternatives. If you want to build single-page applications, you can use [Blazor](https://docs.microsoft.com/en-us/aspnet/core/blazor/?view=aspnetcore-5.0).

### Windows Communication Foundation (WCF)

Even [WCF](https://docs.microsoft.com/en-us/dotnet/framework/wcf/whats-wcf), the traditional communication framework for Windows, is going to be deprecated. This may appear a bit shocking for the developers that have used it to build their service-oriented applications. However, it is pretty understandable if you realize that the primary goal of .NET 5 is becoming a cross-platform framework.

The alternative to WCF recommended by Microsoft is to migrate to [gRPC](https://docs.microsoft.com/en-us/aspnet/core/grpc/?view=aspnetcore-5.0). But if you are nostalgic about WCF or want to prepare a smooth transition, you can give the [CoreWCF](https://github.com/CoreWCF/CoreWCF) open-source project a try.

### Windows Workflow Foundation

Finally, .NET 5 will not even include [Windows Workflow Foundation](https://docs.microsoft.com/en-us/dotnet/framework/windows-workflow-foundation/), the workflow engine technology available in .NET Framework. There is no official replacement for this technology. However, you can use an open-source porting project, [CoreWF](https://github.com/UiPath/corewf), to attempt moving your existing workflows on .NET 5 or creating new ones.

## Summary

At the end of this article, you have a high-level idea of how .NET 5 will impact your existing .NET projects and which opportunities the new platform is going to offer you. Maybe these highlighted five things may seem like little stuff, but they should allow you to find your way around this turning point in the .NET evolution.

Of course, you can [try .NET 5 right now by downloading its runtime and SDK]( https://dotnet.microsoft.com/download/dotnet/5.0).

While .NET 5 is out, many applications that need security rely on older versions of .NET. Here’s how you can secure an [ASP.NET](http://asp.net/) Core 3.x with Auth0. The same patterns should apply to .NET 5. Let us know in the comments if you bump into any difficulties.

<include src="asides/DotNetCore" />

Five Things You Should Know About .NET 5

The new Auth0 ASP.NET Core Authentication SDK makes adding authentication and authorization to your web applications a breeze.

Auth0 brings you the new [ASP.NET Core Authentication SDK](https://github.com/auth0/auth0-aspnetcore-authentication), which improves your development experience and better integrates with Auth0 features! Let's take a tour through the main features of the SDK to see how easy it becomes to integrate your ASP.NET applications with Auth0.

## The SDK Overview

So far, you were used to relying on the standard `Microsoft.AspNetCore.Authentication.OpenIdConnect` package to integrate your ASP.NET application with Auth0. That library does its job very well. However, when you move away from implementing the simple login and logout, your code starts becoming verbose until it gets messy.

You can mitigate this issue by [implementing your authentication with C# extension methods](https://auth0.com/blog/using-csharp-extension-methods-for-auth0-authentication/). But why do it yourself when the experts at Auth0 can provide you with a ready-to-use SDK?

The [ASP.NET Core Authentication SDK](https://github.com/auth0/auth0-aspnetcore-authentication) allows you to write less code to integrate Auth0 authentication and authorization into your ASP.NET applications. It simplifies configuration, supports additional query parameters and refresh tokens, natively supports [Auth0 Organizations](https://auth0.com/docs/organizations) and user invitations. It is actually a wrapper around the `Microsoft.AspNetCore.Authentication.OpenIdConnect` library, but it brings you a standard and easy way to integrate Auth0 into your applications.

You can use the SDK for all your ASP.NET applications that require authentication, such as ASP.NET MVC apps, Razor web apps, and Blazor server apps.

## Install the ASP.NET Core Authentication SDK

You can install the Auth0 ASP.NET Core SDK by using the NuGet Package Manager UI in Visual Studio, as shown below:

![Installing the Auth0 ASP.NET SDK with NuGet Package Manager UI](https://images.ctfassets.net/23aumh6u8s0i/52AB2b6XDotBDpBlPPR1F7/f4b71a1b33c3cecb56b46d96b2e27788/installing-auth0-aspnet-core-authentication-sdk.png)

You can also install it by running the following command in the Package Manager Console:

```powershell
Install-Package Auth0.AspNetCore.Authentication
```

Or you can use the following command in a terminal window:

```bash
dotnet add package Auth0.AspNetCore.Authentication
```

Independently of your preferred approach, you will get the `Auth0.AspNetCore.Authentication` dependency in your ASP.NET project.

## The Basic Login Use Case

Let's start to take a look at the way the new SDK improves your developer experience. Of course, you need an Auth0 account to integrate your ASP.NET application with Auth0. If you haven't, you can <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free one</a> right now. Follow [the Auth0 ASP.NET Core Authentication SDK quickstart to register your application and get your application keys](https://auth0.com/docs/quickstart/webapp/aspnet-core#configure-auth0). 

The following is the typical code you write to enable authentication in your ASP.NET application when using `Microsoft.AspNetCore.Authentication.OpenIdConnect`:

```csharp
public void ConfigureServices(IServiceCollection services)
{
 services.AddAuthentication(options => {
 options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
 options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
 options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
 })
 .AddCookie()
 .AddOpenIdConnect("Auth0", options => {
 options.Authority = $"https://{Configuration["Auth0:Domain"]}";
 options.ClientId = Configuration["Auth0:ClientId"];
 options.CallbackPath = new PathString("/callback");
 options.TokenValidationParameters = new TokenValidationParameters
 {
 NameClaimType = "name"
 };
 options.Events = new OpenIdConnectEvents
 {
 OnRedirectToIdentityProviderForSignOut = (context) =>
 {
 var logoutUri = $"https://{Configuration["Auth0:Domain"]}/v2/logout?client_id={Configuration["Auth0:ClientId"]}";

 var postLogoutUri = context.Properties.RedirectUri;
 if (!string.IsNullOrEmpty(postLogoutUri))
 {
 if (postLogoutUri.StartsWith("/"))
 {
 // transform to absolute
 var request = context.Request;
 postLogoutUri = request.Scheme + "://" + request.Host + request.PathBase + postLogoutUri;
 }
 logoutUri += $"&returnTo={ Uri.EscapeDataString(postLogoutUri)}";
 }

 context.Response.Redirect(logoutUri);
 context.HandleResponse();

 return Task.CompletedTask;
 }
 };
 });
}
```

I will not go through that code to explain every single step. You just need to know it implements the login and logout features in your applications by relying on the [Auth0 Universal Login](https://auth0.com/docs/login/universal-login) page.

By using the Auth0 ASP.NET Core Authentication SDK, your code shortens as follows:

```csharp
public void ConfigureServices(IServiceCollection services)
{
 services.AddAuth0WebAppAuthentication(options =>
 {
 options.Domain = Configuration["Auth0:Domain"];
 options.ClientId = Configuration["Auth0:ClientId"];
 });
}
```

Impressive, isn't it? 😲

The SDK takes care of all the configuration stuff you previously needed to do manually. And that's just the beginning! 🎉

## Get an Access Token

What if you want to call an API from your ASP.NET application? In this case, you need to [request an access token for a specific audience](https://auth0.com/docs/security/tokens/access-tokens/get-access-tokens#control-access-token-audience) to Auth0.

Doing it without the SDK would require a code similar to the following:

```csharp
public void ConfigureServices(IServiceCollection services)
{
 services.AddAuthentication(options => {
 options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
 options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
 options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
 })
 .AddCookie()
 .AddOpenIdConnect("Auth0", options => {
 options.Authority = $"https://{Configuration["Auth0:Domain"]}";
 options.ClientId = Configuration["Auth0:ClientId"];
 //👇new code
 options.ClientSecret = Configuration["Auth0:ClientSecret"];
 options.SaveTokens = true;
 options.ResponseType = OpenIdConnectResponseType.Code;
 //👆new code
 options.CallbackPath = new PathString("/callback");
 options.TokenValidationParameters = new TokenValidationParameters
 {
 NameClaimType = "name"
 };
 options.Events = new OpenIdConnectEvents
 {
 OnRedirectToIdentityProviderForSignOut = (context) =>
 {
 var logoutUri = $"https://{Configuration["Auth0:Domain"]}/v2/logout?client_id={Configuration["Auth0:ClientId"]}";

 var postLogoutUri = context.Properties.RedirectUri;
 if (!string.IsNullOrEmpty(postLogoutUri))
 {
 if (postLogoutUri.StartsWith("/"))
 {
 // transform to absolute
 var request = context.Request;
 postLogoutUri = request.Scheme + "://" + request.Host + request.PathBase + postLogoutUri;
 }
 logoutUri += $"&returnTo={ Uri.EscapeDataString(postLogoutUri)}";
 }

 context.Response.Redirect(logoutUri);
 context.HandleResponse();

 return Task.CompletedTask;
 }
 //👇new code
 OnRedirectToIdentityProvider = context =>
 {
 context.ProtocolMessage.SetParameter("audience", Configuration["Auth0:Audience"]);
 return Task.FromResult(0);
 }
 //👆new code
 };
 });
}
```

Basically, you need to add a few more lines to the previous code in order to change the OAuth flow, provide the client secret, enable token saving, and attach the audience value to the authorization request.

The equivalent code to achieve the same result using the SDK is as follows:

```csharp
public void ConfigureServices(IServiceCollection services)
{
 services.AddAuth0WebAppAuthentication(options =>
 {
 options.Domain = Configuration["Auth0:Domain"];
 options.ClientId = Configuration["Auth0:ClientId"];
 options.ClientSecret = Configuration["Auth0:ClientSecret"];
 })
 .WithAccessToken(options =>
 {
 options.Audience = Configuration["Auth0:Audience"];
 }); 
}
```

Aren't you excited about this? 💥 Your code will be more concise, clean, and clear!

## Refresh Tokens As Magic

And in case you need a [refresh token](https://auth0.com/docs/security/tokens/refresh-tokens)? 🤔 Nothing could be simpler. Just set a flag:

```csharp
public void ConfigureServices(IServiceCollection services)
{
 services.AddAuth0WebAppAuthentication(options =>
 {
 options.Domain = Configuration["Auth0:Domain"];
 options.ClientId = Configuration["Auth0:ClientId"];
 options.ClientSecret = Configuration["Auth0:ClientSecret"];
 })
 .WithAccessToken(options =>
 {
 options.Audience = Configuration["Auth0:Audience"];
 options.UseRefreshTokens = true; //👈 new code
 });
}
```

Compare it with the code you need to add to the SDK-less code:

```csharp
public void ConfigureServices(IServiceCollection services)
{
 services.AddAuthentication(options => {
 //...the code to configure authentication...
 })
 .AddCookie(options => {
 options.Events.OnValidatePrincipal = (context) => {
 var options = context.HttpContext.RequestServices.GetRequiredService<Auth0Options>();

 string accessToken;
 if (context.Properties.Items.TryGetValue(".Token.access_token", out accessToken))
 {
 if (options.UseRefreshTokens)
 {
 string refreshToken;
 if (context.Properties.Items.TryGetValue(".Token.refresh_token", out refreshToken))
 {
 var now = DateTimeOffset.Now;
 var expiresAt = DateTimeOffset.Parse(context.Properties.Items[".Token.expires_at"]);
 var leeway = 60;
 var difference = DateTimeOffset.Compare(expiresAt, now.AddSeconds(leeway));
 var isExpired = difference <= 0;

 if (isExpired && !string.IsNullOrWhiteSpace(refreshToken))
 {
 var result = await RefreshTokens(options, refreshToken, auth0Options.Backchannel);

 if (result != null)
 {
 context.Properties.UpdateTokenValue("access_token", result.AccessToken);
 context.Properties.UpdateTokenValue("refresh_token", result.RefreshToken);
 context.Properties.UpdateTokenValue("id_token", result.IdToken);
 context.Properties.UpdateTokenValue("expires_at", DateTimeOffset.Now.AddSeconds(result.ExpiresIn).ToString("o"));
 }
 else
 {
 context.Properties.UpdateTokenValue("refresh_token", null);
 }

 context.ShouldRenew = true;
 }
 } 
 }
 }
 })
 .AddOpenIdConnect("Auth0", options => {
 //...the code to configure OpenID Connect...
 });
}
```

You should take care of all the details about determining the token expiration and requesting a new access token. The Auth0 ASP.NET Core Authentication SDK does this on your behalf. Do you agree it's magic? ✨

## Auth0 Organizations Support

Not only the ASP.NET Core Authentication SDK lets you deal with standard OpenID Connect and OAuth duties, but it also simplifies your life in using specific Auth0 features such as [Auth0 Organizations](https://auth0.com/docs/organizations). By using Organizations, you can represent logical groups of users such as teams, partners, business customers, and so on. They can have specific policies, branding, and other customizations. So, to enable a user to log in to an organization, you need to specify it in your ASP.NET application. The following is an example of how you can accomplish this by using the SDK:

```csharp
public void ConfigureServices(IServiceCollection services)
{
 services.AddAuth0WebAppAuthentication(options =>
 {
 options.Domain = Configuration["Auth0:Domain"];
 options.ClientId = Configuration["Auth0:ClientId"];
 options.Organization = Configuration["Auth0:Organization"];
 });
}
```

Pretty straightforward, right? 🙌 Of course, you can do more with Organizations. Please, take a look at [the ASP.NET Core Authentication SDK documentation](https://github.com/auth0/auth0-aspnetcore-authentication#organization) to learn more.

## Customization

At this point, you may think that having an SDK forces you to use its methods to work with OpenID Connect and OAuth. So you no longer have the freedom of adding extra parameters to the authorization request, for example. Or you may think you can't anymore apply your custom token validation or freely manage OpenID Connect events.

I have good news: you don't need to worry about this. The ASP.NET Core Authentication SDK leaves you the freedom to customize many things.

For example, you can add custom parameters to the authorization request. Look at the following example:

```csharp
public void ConfigureServices(IServiceCollection services)
{
 services.AddAuth0WebAppAuthentication(options =>
 {
 options.Domain = Configuration["Auth0:Domain"];
 options.ClientId = Configuration["Auth0:ClientId"];
 options.LoginParameters = new Dictionary<string, string>() { 
 { "screen_hint", "signup" } 
 };
 }); 
}
```

Here you configured your ASP.NET application to attach the `screen_hint` parameter with the `signup` value to the authorization request. In this specific case, the user will see the signup window instead of the default login screen.

But you can also apply your custom validation, as in the following case:

```csharp
public void ConfigureServices(IServiceCollection services)
{
 services.AddAuth0WebAppAuthentication(options =>
 {
 options.Domain = Configuration["Auth0:Domain"];
 options.ClientId = Configuration["Auth0:ClientId"];
 options.OpenIdConnectEvents = new OpenIdConnectEvents
 {
 OnTokenValidated = (context) =>
 {
 var birthDateClaim = context.SecurityToken.Claims.SingleOrDefault(claim => claim.Type == "birthdate")?.Value;

 if (string.IsNullOrWhiteSpace(birthDateClaim))
 {
 context.Fail("The 'birthdate' claim must be present in the ID token.");
 }
 
 return Task.CompletedTask;
 }
 };
 })
}
```

As you can see, the ASP.NET Core Authentication SDK exposes the `OpenIdConnectEvents` option to let you handle the standard events triggered by the `Microsoft.AspNetCore.Authentication.OpenIdConnect` library. This way, you can combine the SDK simplicity with the standard library behavior to get the maximum flexibility.

## Summary

Now you should have a clearer idea about the benefits you have by using the ASP.NET Core Authentication SDK to integrate Auth0 into your ASP.NET applications: less code, more readability, flexibility, and best practices inside. So, give a try to the SDK and integrate your [ASP.NET applications with Auth0 by following the QuickStart](https://auth0.com/docs/quickstart/webapp/aspnet-core). Check out [the SDK documentation](https://auth0.github.io/auth0-aspnetcore-authentication/) to learn more.

You can also [contribute to it](https://github.com/auth0/auth0-aspnetcore-authentication#contributing): it's open-source!

Exploring the Auth0 ASP.NET Core Authentication SDK

Matt leads the Developer Relations team at Ionic, an app development platform that helps companies ship powerful cross-platform apps using one codebase. A .NET developer for many years, he embraced the open web after realizing he should probably pay attention to an up-and-coming language called “JavaScript.” Today, he specializes in cross-platform hybrid apps built with web technologies. When not coding, you can find him traveling the world, hiking, and exploring the local sights and culture.

Learn how to secure your Ionic app by adding user authentication with Auth0 and Ionic Auth Connect.

Adding Auth0 to an Ionic Angular App Using Auth Connect

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Value-added distributor to provide Auth0’s identity management solutions for LATAM’s top companies

**BUENOS AIRES, Argentina – June 29, 2021 –** The** **[Auth0 Identity Platform](https://auth0.com/), a product unit within Okta (NASDAQ: OKTA), today announced a partnership with [CLM](https://clm.com.br/), a value-added distributor that specializes in advanced data center infrastructure and cybersecurity. CLM is Auth0’s first distribution partner in Latin America (LATAM) and extends Auth0’s reach into Brazil, Colombia, Ecuador, and Peru to provide local partners and their customers with an extensible, trusted identity management solution.

CLM operates in LATAM and specializes in creating opportunities across the channel ecosystem by educating their clients on best of breed solutions such as Auth0 to solve their customer identity management needs. The addition of CLM to Auth0’s [Partner Program](https://auth0.com/partners) and Auth0’s growth in LATAM indicates demand for cloud-based identity management solutions that balance security and customer experience. 

The onset of COVID-19 has accelerated the transition to digital globally. Delivering a secure and frictionless customer experience online starts with a [Customer Identity and Access Management (CIAM)](https://auth0.com/resources/whitepapers/ciam-buyers-guide) solution that enables businesses to capture, convert, and retain customers and fuel business growth. A [recent PwC survey](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) found that approximately half of consumers (49%) in LATAM say they will walk away from a brand they love after just one bad experience. 

“Companies cannot predict exactly what their business and customers will need tomorrow, especially in response to today’s rapidly changing digital environment. With identity at the heart of security and any transformation process, an adaptable and modular identity solution that supports the breadth of all identity needs is essential,” said Gabriel Camargo, product director at CLM. “Auth0 is a trusted identity management provider and a natural addition to our best-in-class portfolio of disruptive vendors.”

Together, Auth0 and CLM are supporting major companies in Latin America—including [AK Networks](http://akcela.com.br/) and [XP Inc.](https://www.xpi.com.br/)—to meet their evolving identity management and security goals.

“We are honored to welcome CLM to our Partner Program and join forces to deliver growth opportunities to customers in Brazil and throughout LATAM,” said Ghazi Masood, SVP, Americas at Auth0. “The addition of Auth0 to CLM’s cybersecurity portfolio means partners and their customers now have a set of extensible building blocks to solve for any identity use case without having to compromise between convenience, privacy, or security—allowing them to innovate and launch products and services faster.”

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com) 

Grupo Muchnik for Auth0 
[auth0@muchnik.co](mailto:auth0@muchnik.co)

Auth0 Expands Global Partner Network in Latin America with CLM

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Auth0 integrates netID to support customer privacy needs in Europe

**London/Montabaur, Germany – August 17, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, and the [European netID Foundation](https://enid.foundation/en/) today announced the availability of netID Single Sign-On on [Auth0 Marketplace](https://marketplace.auth0.com/), a catalog of trusted technology integrations to extend the functionality of Auth0’s identity management platform. 

[netID](https://marketplace.auth0.com/integrations/netid-single-sign-on) enables users to sign into apps and websites with their netID account and to decide privately and transparently which data to share. As an independent European identity provider with more than 38 million active user accounts in Germany, netID provides the necessary infrastructure for [Single Sign-On (SSO)](https://auth0.com/blog/what-is-single-sign-on-a-non-developer-s-guide/) but does not store any user data itself. Users can manage the consents they’ve given at any time in netID’s Privacy Center.

“Whether in finance, e-commerce, or online publishing, engaging with users in an all trusted and transparent way is key to driving success. We are excited about the partnership with Auth0 and the availability of the netID Single Sign-On integration. Joint customers can now seamlessly integrate our product and offer users a European alternative to U.S. social login providers,” says Achim Schlosser, board member, and chief technology officer of the European netID Foundation.

“After speaking with many customers, we have identified the integrations that matter to them. The availability of netID on [Auth0 Marketplace](https://marketplace.auth0.com/) is a direct response to the growing need for privacy-enhancing technologies in Europe and part of our continued commitment to international markets,” said Cassio Sampaio, SVP of Product at Auth0. “We are thrilled to have netID as a vetted and valuable vendor in Auth0 Marketplace.” 

Auth0 reviews partner integration functionality and makes available integrations that are easy to discover and integrate for customers. Partners can participate in the growing demand for digital identity solutions and increase their visibility as part of the Auth0 Marketplace and can learn more here: [https://auth0.com/partners](https://auth0.com/partners).

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), provides a modern identity platform that helps organizations meet the security, privacy, and convenience needs of their users. Please visit [Auth0 Identity Platform](https://auth0.com/identity-platform) to learn more.

## About the European netID Foundation

The European netID Foundation was established in March 2018 by Mediengruppe RTL Deutschland, ProSiebenSat.1, and United Internet with its brands WEB.DE and GMX. With an independent market solution, the foundation supports Internet offerings from all industry sectors with the implementation of the new European data protection law and, for this purpose, has created the open login standard netID. The initiators of the foundation together reach around 50 million unique users every month and together have more than 38 million active accounts. The foundation is explicitly open to additional partners and initiatives. Further information is available at [www.enid.eu](https://enid.foundation).

<include src="asides/AboutAuth0" />

### Media Contacts
Alexandra Roszkowski 
[presse@enid.eu](mailto:presse@enid.eu) 
+49 162 25 27-188 

Sarah Konarski & Nele Mascher 
Finn Partners for Auth0, DACH 
[auth0de@finnpartners.com](mailto:auth0de@finnpartners.com)

Auth0 Marketplace Now Offers netID Solution

daniel-krzyczkowski-2020

Software Engineer passionate about Microsoft technologies. Awarded with Microsoft Most Valuable Professional title. The main part of his activities is to share knowledge and passion about Microsoft Azure, IoT, Universal Windows Platform and DevSecOps.


Software Engineer

Daniel Krzyczkowski

How to securely access secrets stored in the Azure Key Vault service using the new Azure SDK and managed identities.

Secrets Access with Managed Identities in .NET Applications

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Dan Arias

## 1. asides/AboutAuth0

<include src="asides/AboutAuth0" />

## 2. ebook-ads/JwtHandbook

<include src="ebook-ads/JwtHandbook" />

## 3. asides/Jwt

<include src="asides/Jwt" />

## 4. TweetQuote

<include src="TweetQuote" quoteText="It is now possible to securely interact with services like Amazon Cognito from the client code" />

## 5. asides/React

<include src="asides/React" />

## 6. JpTweetQuote

<include src="JpTweetQuote" quoteText="Access Tokenは秘密にしなければなりませんが、存続期間が短いため、セキュリティの考慮事項の制限も緩くなります。" />

## 7. asides/JavascriptAtAuth0

<include src="asides/JavascriptAtAuth0" />

## 8. asides/Angular

<include src="asides/Angular" />

## 9. ebook-ads/OidcHandbook

<include src="ebook-ads/OidcHandbook" />

## 10. asides/Node

<include src="asides/Node" />

## 11. asides/SpringBoot

<include src="asides/SpringBoot" />

## 12. asides/MarketBasketLinksAbout

<include src="asides/MarketBasketLinksAbout" />

## 13. asides/Python

<include src="asides/Python" />

## 14. asides/Android

<include src="asides/Android" />

## 15. asides/JpAndroid

<include src="asides/JpAndroid" />

## 16. asides/LaravelBackend

<include src="asides/LaravelBackend" />

## 17. asides/ExpressGateway

<include src="asides/ExpressGateway" />

## 18. asides/Vue

<include src="asides/Vue" />

## 19. asides/JpJavascriptAtAuth0

<include src="asides/JpJavascriptAtAuth0" />

## 20. asides/Angularjs

<include src="asides/Angularjs" />

## 21. ebook-ads/UserMigrationYourWay

<include src="ebook-ads/UserMigrationYourWay" />

## 22. Book

<include src="Book" title="Sh*t My Dad Says" url="https://www.amazon.com/Shit-Dad-Says-Justin-Halpern-ebook/dp/B003PJ6FY8" cover="https://cdn.auth0.com/blog/beach-reads/shit_my_dad_says.jpg" author="Justin Halpern" description="Because the work week is too hectic to only read serious stuff on Saturday." referredBy="Dave Wilner, Chief Revenue Officer (Bellevue, Wash., USA)" referrerUrl="https://www.linkedin.com/in/dave-wilner-0a50a72/" />

## 23. asides/JpNode

<include src="asides/JpNode" />

## 24. ebook-ads/Oauth2OidcGuide

<include src="ebook-ads/Oauth2OidcGuide" />

## 25. Tweet

<include src="Tweet" tweetId="907274986892791808" />

## 26. ProfileCard

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/abigail-sanchez.png" name="Abigail Sanchez" title="Program Manager" team="Field Ops" location="Washington, United States" body="Leaving your desk at 9:45 AM to take your kid their forgotten lunch and making it back in time for your 10:00 AM meeting" />

## 27. ClickImg

<include src="ClickImg" externalUrl="https://auth0.com/blog/what-is-data-security/" imgUrl="https://cdn.auth0.com/blog/what-is-data-security/google-authenticator.png" altText="Google Authenticator 2FA on WordPress login" imgHeight="405" imgWidth="616" />

## 28. asides/JpAboutAuth0

<include src="asides/JpAboutAuth0" />

## 29. asides/DotNetCore

<include src="asides/DotNetCore" />

## 30. tutorial/NextButton

<include src="tutorial/NextButton" nextPart="create-a-simple-and-secure-node-express-app" />

## 31. tutorial/IssueButton

<include src="tutorial/IssueButton" communityTopic="create-a-simple-and-stylish-node-express-app/26760/20" />

## 32. asides/AboutAuth0De

<include src="asides/AboutAuth0De" />

## 33. QuizAnswer

<include src="QuizAnswer" answer="_Correct answer is **c**. The integrity of the product prices is compromised because the attacker was able to alter the prices_" />

## 34. QuoteCard

<include src="QuoteCard" picture="https://cdn.auth0.com/blog/auziros/kris-babbish.jpg" name="Jeffrey Bruns" title="Director of Product Engineering" company="The Chronicle of Higher Education" body="The Auth0 flows tool helped our UX and design folks gain an understanding of how best to implement the login and sign up experience during our design phase. The biggest challenge with any new project is overcoming the ‘you don't know what you don't know’ challenge. Being able to visualize an end-to-end workflow and present something for business stakeholders to preview has been very helpful in overcoming the knowledge gap make the right decisions around our login and registration flows." />

## 35. tutorial/FeedbackButton

<include src="tutorial/FeedbackButton" communityTopic="developing-a-secure-api-with-nestjs/33026" />

## 36. asides/AboutAuth0Fr

<include src="asides/AboutAuth0Fr" />

## 37. asides/AboutAuth0Jp

<include src="asides/AboutAuth0Jp" />

## 38. ebook-ads/JwtHandbookJp

<include src="ebook-ads/JwtHandbookJp" />

## 39. asides/JpJwt

<include src="asides/JpJwt" />

## 40. ebook-ads/OidcHandbookJp

<include src="ebook-ads/OidcHandbookJp" />

## 41. AmpWarning

<include src="AmpWarning" fullUrl="https://auth0.com/blog/complete-guide-to-react-user-authentication" />


## 42. PartnerCard

<include src="PartnerCard" picture="https://cdn.auth0.com/blog/hackathon/1-evil-rabit.png" name="Evil Rabbit" title="Head of Design" team="Vercel" />

## 43. ebook-ads/BrokenAuthChecklist

<include src="ebook-ads/BrokenAuthChecklist" />

## 44. ebook-ads/DigitalTransformationBook

<include src="ebook-ads/DigitalTransformationBook" />

## 45. asides/AboutAuth0Es

<include src="asides/AboutAuth0Es" />

## 46. ebook-ads/IamWhitepaper

<include src="ebook-ads/IamWhitepaper" />

## 47. ebook-ads/CredentialStuffingAttacksWhitepaper

<include src="ebook-ads/CredentialStuffingAttacksWhitepaper" />

## 48. asides/IdentityUnlocked

<include src="asides/IdentityUnlocked" />

## 49. AvocadoLabsPromo

<include src="AvocadoLabsPromo" description="Join us on Monday, October 5th, 2020 at 9 am PT as we talk about our strategy behind building the Auth0 Marketplace and the opportunity it delivers." buttonText="Register now!" buttonLink="https://avocadolabs.dev/events/avocado-labs-community-4/?utm_source" />

## 50. ebook-ads/ConsentManagement

<include src="ebook-ads/ConsentManagement" />

## 51. BigQuote

<include src="BigQuote" quoteText="By enabling native social authentication, our app's Facebook login times have been reduced by 50% compared to web authentication. And successful Facebook logins in our app have increased by 16%." quoteAuthor="Eric Jensen, Principal Engineer, Kiva" />

## 52. ebook-ads/PostMergerIntegration

<include src="ebook-ads/PostMergerIntegration" />

## 53. ebook-ads/EvolutionCiam

<include src="ebook-ads/EvolutionCiam" />

## 54. whatabyte/BuildWhatYouBuild

<include src="whatabyte/BuildWhatYouBuild" tool="Express" />

## 55. whatabyte/BuildMenuItemModel

<include src="whatabyte/BuildMenuItemModel" />

## 56. whatabyte/BuildTestEndpoints

<include src="whatabyte/BuildTestEndpoints" tool="Express" />

## 57. whatabyte/BuildUseDemoClient

<include src="whatabyte/BuildUseDemoClient" />

## 58. whatabyte/BuildSecurityConsiderations

<include src="whatabyte/BuildSecurityConsiderations" />

## 59. whatabyte/SecureSetUpAuth0Api

<include src="whatabyte/SecureSetUpAuth0Api" />

## 60. whatabyte/SecureRegisterClientApp

<include src="whatabyte/SecureRegisterClientApp" />

## 61. whatabyte/SecureSignIn

<include src="whatabyte/SecureSignIn" tool="Express" />

## 62. whatabyte/SecureConfigureRbacSteps

<include src="whatabyte/SecureConfigureRbacSteps" />

## 63. whatabyte/SecureSignAsAdmin

<include src="whatabyte/SecureSignAsAdmin" />

## 64. whatabyte/SecureTestRbac

<include src="whatabyte/SecureTestRbac" tool="Express" />

## 65. asides/AboutAuth0Pr

<include src="asides/AboutAuth0Pr" />

Blog Includes Preview

duncan-godfrey

Duncan is a security, engineering, and business leader. His background is in security engineering and, in particular, cloud security.

Sr. Director of Security and Compliance

Duncan Godfrey



The death of the corporate network had long been predicted. You can't rely on your old corporate controls anymore &mdash; firewalls, NIDS, and WAFs don't keep attackers out; "they are a Band-aid," they said. They give you a "false sense of security," they cried. I know you think your hardened perimeter protects you, but eventually, someone will find their way past it. Once there is that single crack, an attacker can rampage around your network's soft center. Building a castle wall around your data won't stop a persistent threat.

The security industry had an answer for that; you started to hear about more and more companies pushing towards a Zero Trust security model. Then you started to read about Google's [BeyondCorp](https://cloud.google.com/beyondcorp#:~:text=BeyondCorp%20began%20as%20an%20internal,authorization%20for%20Google's%20core%20infrastructure.) implementation. And then you visited the vendor floor at a major security conference, and you found a lot of companies willing to sell you that zero trust dream. 

It all made total sense. Why should you trust a device just because it's inside your perimeter? Why do you even need a perimeter?! Do I even know what my perimeter is?!

Then, on Monday morning, you returned to your headquarters and were confronted with your reality. Most people were still in your office. They came in every day and left again. Maybe they did some work here and there outside of the building, a flex-day to work around an appointment or a school sports day. The corporate applications that kept your Business running mostly still lived in your data center, within your building, and accessed from the local network. Your perimeter was pretty hard; it was the walls of your buildings that wrapped around your employees. Adding external access outside of your corporate VPN introduced its own set of problems and risks. Then, before you could start decoupling them, they were still heavily integrated with an old legacy IAM system, which was also sitting in your data center. 

What you had was mostly fine. It's hard to get investment in the [digital transformation](https://auth0.com/blog/what-digital-transformation-is-and-what-it-isnt/) when things are static and mostly the same.

Then it wasn't the same. 

Overnight your workforce moved out of the office, off your network to their homes. And, your corporate network was no more. The process now was remote.

I've repeatedly heard this story from many Security and IT leaders. Their world has suddenly changed overnight. A scramble began to build or upgrade the infrastructure needed to move their employees into a remote environment: they quickly spun up a VPN, or in some cases, they just open applications up to the Internet. They allowed users to roam beyond their castle walls and allowed access to data in ways that would have terrified them previously.

## There Never Was a Castle Wall Around Your Data

I was having some fun in the intro, but most security professionals have had the realization that their networks were not fortresses. Unless you are able to disconnect your users from the Internet, then you were only ever one firewall rule change, misconfigured wireless access point, or a secret operations maintenance backdoor away from having unexpected and unmonitored remote access. If you issued Laptops, then unless you had locked in a mandatory full tunnel VPN, then your users were likely taking them home to work on the weekends, and you lost visibility into their activity "off-net."

The reality of [Shadow IT](https://en.wikipedia.org/wiki/Shadow_IT) in Enterprise environments is not new. People expect to move quickly, and if your infrastructure was static and restrictive, then likely your users had silently adopted a new cloud tool. This means that your data was being moved to unknown and unmonitored locations. Finding and curbing this has always been ongoing risk mitigation for IT and Security teams.

## Remote Is Here to Stay So Make It Your Strength, Not Your Weakness

In the early months of this pandemic, we thought a lot of this new infrastructure would be temporary. But we already see a changing landscape for remote work. Twitter's [announcement](https://techcrunch.com/2020/05/12/twitter-says-staff-can-continue-working-from-home-permanently/) they would permanently move to a remote model received a lot of headlines, and they were quickly joined by a number of large [companies](https://github.com/arjunmadgavkar/Newly-Remote-Companies/blob/master/List.md), including [Atlassian](https://www.smartcompany.com.au/startupsmart/news/atlassian-remote-work-permanent/), that have made it clear that this will be their new normal.

This has always been our normal at Auth0, and, in fact, we viewed our remote workforce as a competitive advantage. We could find talent anywhere in the world, offer candidates real mobility and flexibility, and attract top talent who wanted to escape expensive tech centers. Employees had been identifying remote work as a key differentiating job perk before it became a necessity.

So, your security controls need to catch-up with this new reality. Remember, being nimble with your infrastructure and policy means you can now move at the speed of the Business. You can give them what they want!

## A Remote Workforce Doesn’t Have to Reduce Your Security Posture, in Fact, the Opposite Is True as Long as You Put the Right Building Blocks in Place

This new environment changes your [Threat Model](https://en.wikipedia.org/wiki/Threat_model#:~:text=Threat%20modeling%20is%20a%20process,and%20mitigations%20can%20be%20prioritized.) and your risk. For example, a fundamental principle for our environment has always been that our employee laptops are never on a "safe" network. Sometimes, people are in the office, but likely they are at home or traveling. With this in mind, you harden them accordingly - making sure they are resistant to a colocated attacker and that you have deep visibility into their behavior.

The Zero Trust concept is itself maturing, and with NIST's publication of their [Draft ZT Paper](https://csrc.nist.gov/News/2019/zero-trust-architecture-draft-sp-800-207), an agreed definition of a Zero Trust Architecture (ZTA) is forming. This also clears the way for the Federal Government and risk-averse Enterprises to consider this approach. The security industry rallying around a standard approach is good for our users as we are all working together. And, to tie it back to our threat model, what this approach does is recognize that a lot of attacks are successful because that attacker is able to steal a credential and leverage it. So that an "outsider" immediately looks like an insider and is therefore trusted. 

This puts authentication at the forefront of your security controls and further drives home that Identity is the perimeter. And, at a minimum, this means the building blocks of:
	
1. Strong [authentication](https://auth0.com/blog/what-is-an-authentication-server/), are you using [multifactor authentication](https://auth0.com/learn/get-started-with-mfa/) everywhere in your Enterprise? Preferably use a hardware token.
2. Maintain an agile IAM solution that provides centralized SSO for all these new apps to be monitored and controlled.

2020 has forced some quick and reactive changes upon us. As we move forward, there should also be space for some positive security wins to come out of a terrible situation. This is the new normal, but we do have the building blocks to secure it, especially if you begin building with Identity at the heart of your Security Architecture.


The Death of the Corporate Network

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Streaming companies must adapt to unprecedented network strain

Everyone is coping with the Coronavirus pandemic in their own ways, yet people around the world seem to share a few rituals: washing our hands, wearing masks, and of course, catching up on our Netflix queue. 

With much of the world’s population stuck at home under social distancing, quarantine, and mandatory lockdowns, consumer spending on streaming has increased [anywhere from 20% to 50%](https://www.nytimes.com/interactive/2020/04/11/business/economy/coronavirus-us-economy-spending.html) depending on the channel. Given this unprecedented surge in demand, it’s not hyperbolic to say the internet is going through the most intense stress test in its history.

The global desire for entertainment and escapism is [creating a windfall for streaming services](https://www.cnn.com/2020/03/02/investing/coronavirus-stay-at-home-stocks/index.html). Netflix, for example, [more than doubled](https://www.theguardian.com/media/2020/apr/21/netflix-new-subscribers-covid-19-lockdown) its projected number of new subscribers since the pandemic began, and [Disney+ added](https://www.theguardian.com/media/2020/apr/09/disney-netflix-rival-doubles-subscriptions-in-virus-lockdown) 22 million subscribers as well. However, a combination of network slowdowns (and failures) and streaming models that don’t monetize increased traffic means that the situation for streaming media companies is more complicated than it first appears.

Media companies are facing new challenges and new opportunities and working to develop technological solutions that help them weather this historic moment.

## Quarantined Nations Increase Their Streaming Time

We can see the effects of COVID-19 on streaming services by watching how currently quarantined countries (those hits hardest by the virus) have been behaving. Even without a full-blown quarantine, the rise of voluntary social distancing and enforced isolation creates at least a comparable situation.

Though China [is showing signs of recovery](https://www.cnn.com/2020/03/19/asia/coronavirus-covid-19-update-china-intl-hnk/index.html), they implemented mass quarantine first and can give us useful data on streaming behavior. Chinese Nielsen [data shows a significant rise](https://mp.weixin.qq.com/s/vxKFJOFeXLWuasuvtu7kBw) in TV viewing, but people are also streaming less conventional content. Quarantined Chinese citizens are getting creative with streaming entertainment, [streaming concerts](https://www.nytimes.com/2020/03/04/arts/music/arts-coronavirus.html), and [setting up digital clubbing and digital gyms](https://www.bbc.com/news/world-asia-china-51628693) in their living rooms.

Italy, still in quarantine, has seen a similar rise in streaming content, with an average viewing-time increase of [11% nationally with highs of 17%](https://www.corriere.it/spettacoli/20_febbraio_29/effetto-coronavirus-volano-ascolti-telegiornali-talk-9399464c-5afe-11ea-8b1a-b76251361796.shtml?refresh_ce-cp) in the Lombardy region. During the nationwide quarantine, the Italian telecoms giant Telecom Italian SpA has reported an overall [70% increase in internet traffic](https://www.bloomberg.com/news/articles/2020-03-12/housebound-italian-kids-strain-network-with-fortnite-marathon) from work-from-home traffic and daytime online gaming.

**The spread of the novel coronavirus is also forcing studios and streaming services to rethink how they create and distribute content**, jumping release dates forward, skipping the box office, and closing down production. This will all lead to greater strain on streaming services and the larger internet.

The outbreak is closing theaters [across the United States and across the world](https://www.npr.org/2020/03/17/817136846/as-coronavirus-shuts-down-theaters-universal-shifts-some-films-to-on-demand), which has been linked to a [13% rise in streaming in the US that could rise up to 60%](https://time.com/5806060/coronavirus-movie-theaters-streaming/) based on prior crises. Production companies are fighting this by streaming [first-run movies straight to home services](https://www.vulture.com/2020/03/coronavirus-is-pushing-movies-online-faster-than-ever-before.html): Universal released _Emma_ and other new movies to streaming services, the new Pixar movie _Onward_ is going right to Disney+, and huge films like _Frozen 2_, _Birds of Prey_, and _The Invisible Man_ are coming much sooner than their prior release date.

While these first-run movies popping up on streaming services does create a large viewership base at home, it may not lead to the massive streaming profits being predicted.

<include src="TweetQuote" quoteText="Consumer spending on streaming media is up 20-50%. What streaming media companies can do to make sure they can withstand the quarantine-driven stress test."/>

## Streaming Services Are Doing Better Than Expected

It seems like a simple, logical equation: more time at home equals more streaming, which means greater profits for streaming services. But many streaming services, like Netflix, aren’t modeled to reap more profits from an increase in individual streaming time - which is why some were predicting that Netflix might not see a huge boost in profits.

 “If you have to decide between food and your Netflix subscription, it seems to me like you disconnect your Netflix. You’re probably not going to add another $13 a month if you don’t know when your next paycheck’s going to come in.” — Laura Martin, the senior entertainment analyst at Needham & Company, [told the Guardian](https://www.theguardian.com/film/2020/mar/12/coronavirus-binge-watching-netflix-streamers-viral).

**Netflix doesn’t monetize volume**. They make their money [from subscriptions](https://www.vox.com/2019/12/17/21025154/netflix-global-growth-numbers-sec-streaming-investors) ([and some product placement](https://www.cnbc.com/2017/07/27/bill-gates-ben-does-product-placement-in-netflix-and-amazon-shows.html)). The stock market reflects this uncertainty — Netflix has seen [less than a quarter of a percent of growth](https://www.cnbc.com/quotes/?symbol=NFLX) in the last month.

However, despite a [majority of consumers being aware of Netflix](https://morningconsult.com/2019/09/19/in-tvs-content-war-netflixs-shows-capture-biggest-share-of-viewer-awareness/) before lockdown and quarantine conditions, Netflix has seen a surprising surge in subscriptions. In fact, they’ve doubled their estimates: from an estimated 7 million new subscribers [to 15.77 million new subscribers](https://www.theguardian.com/media/2020/apr/21/netflix-new-subscribers-covid-19-lockdown). 

This may be a temporary situation however: considering the shutdown of television and movie production across the board, time will tell if new subscribers will stick around for old content.

**A la carte streaming services like Amazon Prime may see a boost in revenue**. An Amazon Prime subscription [nets users a variety of shows and movies](https://www.businessinsider.com/amazon-prime-benefits-what-is-included) for “free,” like Netflix, but the newest releases must be rented or purchased.

Then again, despite the [rush of online ordering](https://blog.aboutamazon.com/company-news/amazons-actions-to-help-employees-communities-and-customers-affected-by-covid-19) and their strong grip on streaming media, [Amazon stock isn’t seeing much of a surge either](https://www.cnbc.com/quotes/?symbol=AMZN). Though the entire stock market has taken a hit, [early predictions that streaming company stock would be safe refuges](https://nypost.com/2020/02/28/how-coronavirus-benefits-netflix-and-other-in-home-services/) may have been premature.

Meanwhile, Twitch — the [most popular streaming service](https://www.nytimes.com/2019/12/15/business/tech-video-game-streaming-twitch.html) for gaming videos and livestreams — [has seen a 10% growth](https://www.theverge.com/2020/3/18/21185114/twitch-youtube-livestreaming-streamelements-coronavirus-quarantine-viewership-numbers) in viewership as of March 18. Unlike Netflix or Amazon Prime, Twitch monetizes through ads and will likely see a commensurate rise in revenue.

But differing monetization methods don’t tell the whole story. These potential revenue boosts or profit stagnation trends are dependent on network architecture surviving the sudden swell of usage, which may not be a guarantee.

## Strained Network Architecture Will Need Relief

Social distancing and quarantine [are closing schools](https://www.npr.org/sections/health-shots/2020/03/16/816428320/coronavirus-u-s-enters-quarantine-life-as-many-schools-and-businesses-close) and [workplaces](https://www.washingtonpost.com/national/coronavirus-outbreak-shutdown-america/2020/03/13/d8589434-6550-11ea-acca-80c22bbee96f_story.html), which means a glut of people at home streaming media for entertainment, work, and educational purposes placing unprecedented strain on the internet. Some websites are [even taking bets](https://www.sportsbettingdime.com/news/odds-global-netflix-outage-playstation-network-xbox-live-crash/) on which streaming or web service will go down next.

[Microsoft Teams crashed](https://www.independent.co.uk/life-style/gadgets-and-tech/news/microsoft-teams-service-status-crashes-outage-issues-today-work-home-down-a9404771.html) under the increased load of remote video conferences, and YouTube and Netflix have started [throttling quality on their videos](https://edition.cnn.com/2020/03/19/tech/netflix-internet-overload-eu/index.html) in order to reduce bandwidth in the face of the surge. Hulu [users reported a widespread outage](https://www.cnet.com/news/hulu-is-down-as-users-complain-of-videos-not-loading/) on March 20, one that seemed to affect multiple devices:

![hulu-activity-03-20-2020](https://images.ctfassets.net/23aumh6u8s0i/6Gp4ntk7M1cxNGwTHZxD3k/049ae9a357782e60896684ff437b7297/hulu-activity-march-20-2020)
[DownDetector.com](http://DownDetector.com) - Hulu - March 20, 2020

Many companies [suspended their data caps](https://www.cnet.com/news/carriers-are-suspending-internet-data-caps-during-coronavirus/) and [increased streaming limits](https://www.pcgamer.com/discord-ups-streaming-viewer-limit-while-coronavirus-keeps-people-at-home/) in order to help people stay entertained and in contact during isolation and quarantine. However, these acts of generosity may increase the amount of simultaneous traffic online.

Streaming services may need to try new network solutions to stay ahead of this bloom of potentially network-crashing traffic.

## Private Cloud Boosts Streaming Infrastructure

In the face of this inflating audience and inflating screen time, streaming services using a public cloud may want to consider other options to bolster their network architecture.

There’s nothing wrong with choosing a public cloud; it’s a perfectly reasonable option for a smaller streaming service. Larger streaming services, however, can increase their bandwidth and reduce their downtime and slowdowns with a private cloud solution.

A private cloud service like Auth0 offers scalability and can provide a [greater request-per-second](https://auth0.com/blog/how-finservs-can-reduce-risk-increase-innovation-with-private-cloud/) (rps) baseline — one that can add capacity as needed. It also has enhanced uptime over a public cloud, with a guaranteed 99.99% uptime.

<include src="TweetQuote" quoteText="How private cloud can help streaming companies withstand quarantine streaming pressures."/>

A private cloud doesn’t share resources or bandwidth with other companies, which is where a public cloud can sometimes struggle. Public cloud services like AWS do create server instances as needed, but they’re doing that for every business or individual using the service. COVID-19 isolation causes internet traffic to increase through every channel — streaming media, [communication](https://www.voicesage.com/blog/communication-best-practices-for-organisations-working-to-contain-covid-19/), [education](https://nypost.com/2020/03/17/coronavirus-in-ny-teachers-prepare-for-unprecedented-challenges-of-remote-learning/), and more — public cloud services are going to be hit from multiple angles at increasing speeds.

A private cloud can help streaming companies with servers dedicated to their businesses. Moreover, a private cloud can be managed or unmanaged, depending on whether you have the time and dedicated staff to maintain it.

## Getting Through This Together, Apart

The COVID-19 pandemic is a situation without precedent, creating entire nations of at-home workers, students, and entertainment-seekers all jumping on the internet at the same time. And with isolation and [lockdown orders](https://www.wsj.com/articles/china-reports-no-new-domestic-coronavirus-infections-for-the-first-time-since-outbreak-started-11584611233) coming [faster every day](https://www.washingtonpost.com/world/2020/03/20/coronavirus-latest-news/), this isn’t a situation [likely to change in the immediate future](https://www.washingtonpost.com/health/2020/03/16/social-distancing-coronavirus/).

Keeping streaming services going is a necessity for education, entertainment, and the economy. After a discussion with Netflix CEO Reed Hastings, the Internal Market Commissioner of Brussels, Thierry Breton, had this to say in [a statement to Politico](https://www.politico.eu/article/brussels-in-talks-with-netflix-about-reducing-internet-congestion/):

 “We all have a joint responsibility to take steps to ensure the smooth functioning of the internet during the battle against the virus propagation.”

With scalable network solutions such as a private cloud, we can deploy and use more servers to keep everyone entertained, educated, in shape, and in contact with one another until the situation is resolved. And, hopefully, we can all get back to business — and life — as usual.

<include src="asides/AboutAuth0" />

The (Surprisingly Complex) Impact of COVID-19 on Streaming Media

kapehe-jorgenson

Kapehe is an R&D Content Engineer for Auth0 with a passion for learning and teaching. With her primary focus on ReactJS and JavaScript, she is impressed with what code can create for the web. Technology and web development are constantly evolving and naturally bring that need for continual learning. She enjoys writing tutorials, hosting local meetups, and learning with others to expand coding knowledge.

R&D Content Engineer

Kapehe Jorgenson

Utilize the power of JAMstack and build a portfolio with Gatsby Cloud, Netlify, and DatoCMS.

<AmpContent>
<amp-youtube
 data-videoid="9t3kZ0rVDTw"
 layout="responsive"
 width="315" height="560">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/9t3kZ0rVDTw" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

**TL;DR:** In today's article, we are going to be building a [JAMstack](https://jamstack.org/) application using [Gatsby Cloud](https://www.gatsbyjs.com/cloud/) and [Netlify](https://www.netlify.com/). Using the power of these two, we will see just how easy it is to go from ground zero to a fully deployed website. We will also go over the idea of JAMstack and how it's changing the way we think of web development.

## The Art of JAMstack

The term JAMstack was first coined and created by Netlify. It's probably safe to say that most of us have used JAMstack in one way or another in our web development. Okay, but what is JAMstack? Let's chat about it.

Let's go over what the JAM in JAMstack means.

* J: JavaScript - Arguably one of the most popular coding languages in the world, it makes sense we are using it. Creating apps with [React](https://reactjs.org/), [Vue](https://vuejs.org/), or even just plain vanilla JavaScript, this helps build the stack and keeps our requests client-side.
* A: API's - This one is cool because it utilizes the power of an API and takes away the need for a database or a backend that needs to host a server.
* M: Markup - Next, we can have templated markup that is prebuilt. Once we pull in a static site generator like [Jekyll](https://jekyllrb.com/) or [Gatsby](https://www.gatsbyjs.org/), we can get that content displayed quickly.

These three together make for some pretty fast load times. While these three are working hard to creating a fast website, we have so many resources out there. JAMstack takes JavaScript further than what we are used to in SPAs. JAMstack takes an extra step to generate a static version of the site, whereas SPAs are usually client-side rendered.

In today's project, we will be building a portfolio with Gatsby Cloud and Netlify. Let's go over those.

<include src="TweetQuote" quoteText="JAMstack is changing the way we think of web development!"/>

## What is Gatsby

In our project today, we are going to be using [Gatsby](https://www.gatsbyjs.org/). Gatsby is a React-based, static site generator that is powered by [GraphQL](https://graphql.org/). Being a static site generator means it takes our React applications and creates a static HTML file. Once we have that, then whatever JavaScript is needed is loaded on top of our site to add extra functionality. It takes the load off browsers as we are just serving HTML. We don't need to call any databases or to run any server code to generate our pages. We can utilize the power of JavaScript and API's to get our info.

Not only is it going to make things lightning-fast because HTML is faster for a browser to render than JavaScript, but it's also super easy to get started with. We will get into that in a bit when we start building our site.

### Gatsby Cloud

We will also be using [Gatsby Cloud](https://www.gatsbyjs.com/). Gatsby Cloud is a product provided by Gatsby that allows us to create and manage our Gatsby sites faster. Gatsby Cloud provides a few starter projects that we can use to connect Gatsby, a data source ([DatoCMS](https://www.datocms.com/) for this project), and a deployment tool (Netlify for this project). We can connect all of these things and have a site up in a few quick clicks.

We will talk more on DatoCMS in just a bit. We will also go over how to use this amazing new product, Gatsby Cloud, that Gatsby has given us.

<include src="TweetQuote" quoteText="Gatsby Cloud is a product provided by Gatsby that allows us to create and manage our Gatsby sites faster."/>

## What is Netlify

Before the days of [Netlify](https://www.netlify.com/), we had to use companies like [AWS](https://aws.amazon.com/) or [DigitalOcean](https://www.digitalocean.com/) to create a server and then host our website on that server. Today we have Netlify that takes care of that for us. Deploying a website to Netlify is almost too easy. (I was skeptical on my first deploy!)

There are many ways to get your website up and running. In today's project, we will be using Gatsby Cloud to connect to Netlify. Let's see just how easy it is to use Gatsby Cloud to deploy to Netlify!

## What is DatoCMS

Our content is going to live somewhere. Rather than building our own CMS (Content Management System), we are going to utilize a tool called [DatoCMS](https://www.datocms.com/). All of our content (portfolio items) will be managed there. This is great because we don't have to create our own dashboards or editors. All of this is taken care of for us in the DatoCMS built-in dashboard.

So let's say we have a blog, and we want just a single blog post to be updated. We can update that content, the data will live in DatoCMS, and when we deploy, it will rebuild that one item rather than the entire blog. Sounds time efficient!

Let's build!

## What We Will Build Today

In today's project, we are going to be building a portfolio! Using Gatsby Cloud, Netlify, DatoCMS, and the power of JAMstack, we will get a website built up in no time. Let's see how quickly a portfolio can be created in the JAMstack world!
 
## Starting Our Project

First things first, let's get a Gatsby site built. We are going to head over to [Gatsby Cloud](https://www.gatsbyjs.com/). Here we will see the homepage. Click on "Log in" and we will be redirected to a page with a button that says "Sign in with GitHub". Once we click on that, we are going to use our own GitHub credentials and log into the Gatsby Cloud.

> Note: We may need to authorize Gatsby Cloud at this point if we have never used it.

![Gatsby Cloud homepage](https://images.ctfassets.net/23aumh6u8s0i/1sMfmSEiTCLI7TjacXcfSi/2e04a961fd49786173a9cb84a30f7b7e/gatsby-cloud-2)

Next, we will want to create a new project. By clicking on the "Create new site +" button, we are going to start that process. We do not have a Gatsby site yet, so we are going to want to click on "I don't have a Gatsby site yet" and then hit, "Next".

![The step that shows "I don't have a Gatsby site yet"](https://images.ctfassets.net/23aumh6u8s0i/2tluYwoIs7wdZEIqAhnidn/321f50846c0539ae48c3c460262117c3/create-new-site-2)

Here we are going to see a four-step process to build our website.

### Four steps in the Gatsby Cloud

* Step #1 - Starter: From the starters list, we are going to use the "Portfolio with DatoCMS". Click on that starter and click "Next".

* Step #2 - Repository: Here, we will give our repository a name. Because of the link to our personal GitHub, Gatsby Cloud will create the repo for us and put it in our GitHub account. If our GitHub account has access to multiple GitHub organizations, we will need to choose the correct one that we want to use. Once the correct organization is selected, we will install Gatsby Cloud. Next, we will name it, and click "Next". In this tutorial, we will use `jamstack-portfolio`.

**Note**: Netlify requires that Site names are unique globally. If following along, a unique name must be used.

![Image of naming our project for GitHub repo name](https://images.ctfassets.net/23aumh6u8s0i/7EWzemqBqvkYHnneX1bqxu/b5ff59156048c5bc35680000fd9d7267/github-name-2)

* Step #3 - Connect CMS: In this step, we are going to either [create a DatoCMS account](https://dashboard.datocms.com/signup) or [connect to an existing one](https://dashboard.datocms.com/login). Click on the "Connect" button to be directed to "Authorize with DatoCMS". A popup will appear, and we will either create a new, free account with DatoCMS or log in to an existing one. Once we authorize all of that, we will return to see that we are indeed "Connected" to our DatoCMS. Once we see that, hit "Start my site".

![Image showing DatoCMS connection](https://images.ctfassets.net/23aumh6u8s0i/2q5pODvevF2RKIFIioXwA7/80af80dd8942531f3919b926a60fc6a5/datocms-connected-2)

* Step #4 - Summary: After just a moment, we will be redirected to the "Summary" tab. Here we have a bunch of information. We see that the set up was successful, we see the link to our DatoCMS project, and we also see our newly created GitHub link. Click on "Finish" to be redirected back to our [Gatsby Cloud dashboard](https://www.gatsbyjs.com/dashboard/sites).

Once on our dashboard, we will see that our newly created project is building. Give it a couple of minutes. Once it finishes, we should see a green checkmark and a "Deployed in (deploy time here)". 

> Note: To double-check that the repo was created, go to the GitHub account that was connected to Gatsby Cloud and go to "Repositories". There we will see our newly created repo!

### Quick recap!

So far, we have done the following:

1. We have created a GitHub repo that has all of our Gatsby code.
2. We have stored our data into DatoCMS, a headless CMS.
3. All of this is built as a static site via Gatsby Cloud.

This is a portfolio we are building, so we want to show off projects that we have built. Let's see how this is done!

## Updating Data in DatoCMS

All of our data lives in DatoCMS; let's go update it! We'll head on over to our [DatoCMS dashboard](https://dashboard.datocms.com/projects) and update an item.

![DatoCMS Dashboard view](https://images.ctfassets.net/23aumh6u8s0i/7Dxw3Q4Qk639dCLnOlwtDE/b2c7ea90b527b49ad104e737883b0775/datocms-dashboard-2)

Click on the project that we created earlier. In our case, we named it "jamstack-portfolio", so we should see that name in our list of projects. At the top of the page, we will see a button that says "Enter project", click on that.

Once we see the words, "Hello Admin!", we can update any of the data from there. 

Let's click on "Works". Here we are looking at the list of "Portfolio Items" that are viewed on our website. "Flyer 1", at the top of the list, happens to be one of the auto-generated items that we can go in and update. Let's go ahead and click on "Flyer 1", and we can update most everything on it. The title, the images, the content, anything! For this example, let's change the following:

* Title
* Cover Image
* Excerpt

It should look like this:

![Updating title, cover image, and excerpt in DatoCMS](https://images.ctfassets.net/23aumh6u8s0i/2JlsTnvqgWtGHmmRHGMYNU/2a464502f46937a8331da4e22eb5d235/editing-data-2)

Once we have updated all the things we want to, let's hit "Save" in the upper righthand corner of the page.

## Checking for Updates on Gatsby Cloud

Let's head on over to our [Gatsby Cloud dashboard](https://www.gatsbyjs.com/dashboard/sites), click on "jamstack-portfolio", and see how our site is doing. We are going to be double-checking that our changes were saved.

We should see our most recent deploy was run. If it's still running, make sure to let it finish deploying. There is a "Trigger build" button if needed, but we should not have to do that.

Once finished, click on the extremely long URL provided.

![Gatsby Cloud URL](https://images.ctfassets.net/23aumh6u8s0i/3EIgYLUq40xG6YmacWC4Ga/ad3908d16356d14431bf4fe353dda3d8/gatsby-url-2)

This URL shows a live version of our website! And we see that our content was updated in DatoCMS.

![Website homepage view](https://images.ctfassets.net/23aumh6u8s0i/4HICothDiKL3rp54ikmIDa/e72460f6ae47805f1914435a1356d8d3/previewing-site-2)
 
## Working on the Project Locally

Now that we have almost everything set up let's chat about adding other things to our website. If we wanted to do more than update the data we have set up through DatoCMS, we would clone the repo from GitHub, and open up our project in [VS Code](https://code.visualstudio.com/) or our editor of choice and do it there. Some of the things we could do are:

* Change the layout
* Change fonts or color
* Create a custom theme
* Create new types of pages
* Add in authentication
* Add more plug-ins for SEO purposes

We can find instructions in the `README.md` of the repo that was created for us. Once open in our editor of choice, run the following commands:

```bash
yarn install
```

> Be sure to have `yarn` installed. We can also use `npm` command instead.

We are going to want to create a `.env` file so we can store our token. This token is so we can get read-access from our DatoCMS project into Gatsby Cloud:

```bash
echo 'DATO_API_TOKEN=abc123' >> .env
```

To get that `DATO_API_TOKEN`, go to our [Gatsby Cloud dashboard](https://www.gatsbyjs.com/dashboard/sites), click into our project, and then click on "Site Settings". Once in there, click on "Environment variables" under "General" in the lefthand menu. There we will see "Build Environment variable" and a `DATO_API_TOKEN` that is starred out. If we click on "Edit" we will see the full token that we want in our `.env` file.

![Dato API Token view in Gatsby](https://images.ctfassets.net/23aumh6u8s0i/4kMwZW23Lt70AWu1Uj68yN/f5279cff29be6eef8a16367fb20a7315/dato-api-token-2)

To run the project locally in development mode, run the command:

```bash
yarn develop
```

To build the final static website, run the command:

```bash
yarn build
```

Again, all of this is in the `README.md` of our GitHub repo.

## Authentication with Auth0

Once inside VS Code or our editor of choice, we are going to be able to add authentication to our Gatsby site. There is an amazing blog post by [Sam Julien](https://auth0.com/blog/authors/sam-julien/) on [Securing Gatsby with Auth0](https://auth0.com/blog/securing-gatsby-with-auth0/).

This blog post will give you a step-by-step on how to secure a Gatsby site. We will need to <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account and we can do that here</a>. 

Auth0 will take care of the authentication process and give users a seamless experience.

## Deploy to Netlify

The URL that we were using earlier is extremely long and confusing; let's make it more readable. So to take care of that, let's deploy to Netlify.

Let's head back to our [project's dashboard in the Gatsby Cloud](https://www.gatsbyjs.com/dashboard/sites). Here we will see the URL that we clicked on earlier and above that is a banner that says, "Setup hosting". In that same banner, we see, "Do it now". Click on that.

We will see a list of different hosts that we can deploy to and we'll do the following steps:

1. Click on "Connect" that is next to Netlify. 
2. The "Netlify Integration" will appear, and we will want to click on "Connect". 
3. A Netlify login modal will popup, and we will want to log in here. 
4. We will then have to "Authorize" Gatsby Cloud for permission to our Netlify.
5. Our Netlify deployment site name will be auto-generated. We can change that if we want, but we'll just keep it that name for now. We will also want to select which Netlify team to add the site to. Then click on "Create":

![Create a new Netlify deployment site view](https://images.ctfassets.net/23aumh6u8s0i/354J3QxTRQ30re9eJGpHjz/8404ec39a4d838244259fdfb60e54140/deploy-netlify-2)

> Note: Remember that each Netlify Site name needs to be unique. Use the unique name that was used in your project.

Return to our [Gatsby Cloud dashboard](https://www.gatsbyjs.com/dashboard/sites) for the project and trigger a build. Once that is done, we can now visit our newly deployed website with our new URL, "unique-site-name.netlify.com.

![Final view of the deployed website homepage](https://images.ctfassets.net/23aumh6u8s0i/7bvVZtFySKmvBtjdnn0mS0/f79ca4059f9b350a4a42ebf5e324c234/deployed-site-2)

Yay!

<include src="asides/AboutAuth0" />

## Conclusion

Looking back, we can see the power of JAMstack, and how putting a couple of different resources together, it can create a dynamic site. By utilizing Gatsby Cloud, DatoCMS, and Netlify, we can create and deploy a website.

Feel free to make this your own and dive into the code and do custom styling or take that next step and authenticate the site. By having this foundation and understanding of JAMstack, we can create just about any website.

What is your favorite part of JAMstack? Which resources are your favorite? Let us know in the comments below!

---

Build a JAMstack App with Gatsby Cloud, DatoCMS, and Netlify

Leading professional services provider to integrate Auth0 for digital transformation initiatives

**BELLEVUE, Wash. – February 26, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that [Cognizant](https://www.cognizant.com/) (Nasdaq: CTSH) has joined its [Partner Program](https://auth0.com/partners) and will use Auth0 as one of its main authentication providers for any of its customers’ identity management needs. Ranked 193 on the Fortune 500 list with nearly 300,000 employees, Cognizant is an integral partner in transforming global enterprises’ business, operating, and technology models for the digital era. 

“Cognizant’s broad portfolio of consulting, professional, and managed security services are designed to help our clients around the globe to meet their security challenges,” said Ryan Parthasarathy, Vice President of Cognizant Security. “Given the complexity of identity management, we’re proud to partner with a global expert and game-changer in the CIAM space to enhance our security offerings and deliver only the best for our customers.”

Known for its highly-scalable platform, Auth0 was recently ranked as a [Leader for CIAM](https://auth0.com/blog/auth0-named-a-leader-in-the-g2-winter-2020/) on G2, the world’s leading business solutions review website. With high-velocity growth and more than 9,000 customers worldwide, Auth0 is answering the demand for identity management with a simple, extensible, and powerful solution for any application, for any audience.

“We’re thrilled to partner with Cognizant, an experienced leader in complex identity projects, and combine our teams’ expertise with our extensible, flexible, and trusted platform to aid Cognizant customers in a successful and secure digital transformation journey,” said Bill Lapcevic, VP of business development of Auth0. “Identity management is a critical and complex step in any transformation process, and a strong CIAM system will help customers modernize their business in a quicker and more organized fashion to address identity and security needs.”

Learn more about the [Auth0 Partner Program here](https://auth0.com/partners) along with the recent [growth of Auth0’s global partner network](https://auth0.com/blog/auth0-partner-program-accelerates-global-growth/), now serving more than 60 partners worldwide.

For more information about Cognizant Security, please visit [www.cognizant.com/security](https://www.cognizant.com/security).

<include src="asides/AboutAuth0" />

### Media Contacts
Kaycie East 
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com) 
 
Ryan Schin 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Expands Global Partner Network with Cognizant

Learn how to add authentication and authorization to gRPC for microservices in .NET Core.

Securing gRPC-based Microservices in .NET Core

Learn how to build efficient microservices in .NET Core 3.1 by leveraging gRPC.

Implementing Microservices with gRPC and .NET Core 3.1

Learn how to add authentication to iOS and Android apps with Xamarin and Auth0.

Easy Authentication in Xamarin Apps with Auth0

Auth0 selected for meeting criteria and providing demonstrated market fit for AWS customers

**BELLEVUE, Wash. - Dec. 4, 2019 -** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, announced today that it has joined the Amazon Web Services (AWS) Partner Network (APN) Global Startup Program. The APN Global Startup is a unique “white glove” support and go-to-market (GTM) Program for selected startup APN Partners so that they can build on their AWS expertise, better serve shared customers, and accelerate their growth. To be selected for the APN Global Startup Program, [Auth0](https://auth0.com/) has to meet pre-defined criteria, including a clear, demonstrated product-market fit for an innovative enterprise tech product, be backed and recommended by a top-tier venture capital firm, and have a strategic commitment to building their cloud expertise.

The APN Global Startup Program enables qualifying startups to gain product design wins, visibility, exposure, leads, and commercial opportunities made possible with exclusive APN resources and dedicated Startup Partner Development Managers (PDM) with deep AWS knowledge and startup business experience, that guide startups in their growth journey with AWS. By becoming an APN Global Startup Partner, [Auth0](https://auth0.com/) will receive benefits ranging from a tailor-made plan for mapping the startup needs and opportunities to a selection of AWS services and APN programs, promotion support to drive visibility and awareness around the startup offering, to resources for helping startups sell and deploy innovative solutions on behalf of AWS shared end-customers.

“Auth0 is honored to be part of the AWS Partner Network Global Startup Program. We look forward to taking advantage of the additional support and worldwide exposure they are providing as part of this program,” said Eric Snyder, senior director of partnerships at Auth0. “We are dedicated to being a valuable partner in the AWS network and providing the best identity management platform to all customers.”

Auth0’s universal platform provides out-of-the-box extensible identity management for customers of virtually any size, and any authentication or authorization needs. As a member of the AWS APN Global Startup Program, Auth0 will continue to help companies achieve their technology goals by leveraging the agility, breadth of services, and pace of innovation that AWS provides.

“[Working with Auth0](https://auth0.com/case-studies/chaossearch/) enabled us to deliver an SSO offering to the **CHAOS**SEARCH customers in a time frame that was impossible without them,” said Thomas Hazel, founder, and CTO, **CHAOS**SEARCH. “By choosing Auth0, we can meet our enterprise customer demand for federated identity in a simple and elegant deployment, allowing us to focus on the business value of our offering. The service was easy to implement and the team, from beginning to end, was exceptional.”

AWS is enabling scalable, flexible, and cost-effective solutions from startups to global enterprises. The APN is a global program helping partners build a successful AWS-based business, by helping organizations build, market, and sell their offerings. The APN provides valuable business, technical, and marketing support, to help startups achieve exponential growth. 

For more information on how AWS customers can have the quick, easily implemented identity solution they need for their specific application, please download the [Why Auth0 and AWS](https://auth0.com/resources/ebooks/aws-auth0-ebook) ebook.

<include src="asides/AboutAuth0" /> 

### Media Contacts 
Alex Plew 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com) 

Deepika Zafar 
Racepoint Global for Auth0, EMEA 
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com)

Auth0 Joins the AWS Partner Network Global Startup Program

preston-lamb

Preston is a Software Developer at MotivHealth in Salt Lake City, UT, as well as a course author for Thinkster.io. His focus is mainly on Angular and JavaScript, and he loves to learn new things that help him to build better web applications. He also likes to share the things he learns through blog posts, video courses, and podcasts.

Software Developer at MotivHealth

Preston Lamb

Angular, Auth0, and Netlify are a perfect combination for creating, securing, and deploying your application.

".net"