andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Learn how to validate a JSON Web Token (JWT) in different contexts using C# in .NET.

**JSON Web Tokens (JWTs)** have become very popular. Many developers use them in their applications for authentication and authorization purposes, but not all of them really know why and how to validate their JWTs.

This article will explain why you need to validate a JWT, what it means in general, and give you an overview of the many ways you can do it in the .NET platform.

## What Are JWTs?

If you landed on this article, you probably know what a JSON Web Token is. If not, [here is a great introduction to JWTs](https://jwt.io/introduction) and [a tool to decode them](https://jwt.io/#debugger-io).

Simply put, JSON Web Token is an [open standard](https://datatracker.ietf.org/doc/html/rfc7519) that defines how to share information between parties using the [JSON format](https://datatracker.ietf.org/doc/html/rfc8259). The [JWT structure](https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-token-structure) consists of three concatenated Base64 url-encoded strings, separated by dots: the header, the payload, and the signature The information carried by a JWT is **digitally signed so you can verify its origin and trust it**. The digital signature also guarantees the integrity of the information, but it doesn't guarantee privacy unless explicitly encrypted.

Besides this, the JWT specification doesn't define the specific purpose of a token. While most developers think of authentication when dealing with JWTs, this is not an intrinsic property of tokens in the JWT format. JWT is just a format. The meaning of the token depends on the specific context or application.

For example, in the [OpenID Connect](https://openid.net/developers/how-connect-works/) (OIDC) context, the JWT format is used for the ID token, which is the token that proves a user is authenticated. In the [OAuth 2.0](https://auth0.com/docs/authenticate/protocols/oauth) context, the [JWT format can optionally be used for the access token](https://datatracker.ietf.org/doc/html/rfc9068), which is the token that allows a client application to access a specific resource on behalf of the user.

> To learn more about ID and access tokens and their differences, you can read [this blog post](https://auth0.com/blog/id-token-access-token-what-is-the-difference/) or watch [this video](https://www.youtube.com/watch?v=vVM1Tpu9QB4) instead.

<include src="ebook-ads/JwtHandbook" />

## What Does Token Validation Mean?

The main purpose of a JWT is to carry information that the recipient can trust. So, the first thing your application needs to do when it receives a JWT is to ensure that the information it carries is trustworthy. This is where validation comes in.

In short, validating a JSON Web Token means ensuring that the token has the structure defined in the standard specification and that you can trust the information it carries.

The JWT validation is based on the following five criteria:

- **Token structure**. The first check is about the token's structure. Does the token match the structure of a JSON Web Token? If the token doesn't follow the standard guidelines, it's not valid.

- **Token integrity**. The next check is for the token's integrity. Has the token been tampered with? You can verify this by checking the signature. If you verify that the token's signature is valid, then it has not been altered in any way.
- **Token expiration**. JWTs have an expiration time defined in the `exp` claim. Is the token expired when it has been received? If a token has expired, you should no longer trust its contents.
- **Expected authority**. The next check is to verify that the token was issued and signed by the expected sender (authority). There are two steps to this check:
 - Verify that the authority is the one expected by your application by comparing it to the `iss` claim (issuer).
 - Verify that the key used to sign the JWT actually belongs to the expected authority.
- **Expected audience**. Finally, verify that the token is intended for your application. In other words, you should check that the `aud` claim matches with the value that identifies your application. For example, in an ID token, the value for the audience is the client ID; in an access token in JWT format, the value for the audience is the [API identifier](https://auth0.com/docs/get-started/apis/api-settings#general-settings).

> To learn more about [digital signatures, read this article](https://auth0.com/blog/how-to-explain-public-key-cryptography-digital-signatures-to-anyone/). Check out [this article](https://auth0.com/blog/rs256-vs-hs256-whats-the-difference/) for the differences between the signing algorithms used in a JWT.

Token validation doesn't involve the custom information carried by the token. This is an application-specific logic, which is out of the scope of token validation. For example, validating an ID token does not include verifying that the user's email address in the `email` claim exists.

## Validate a JWT Using an Auth0 SDK

Now that you know what validating a JWT means, you are ready to learn how to validate your tokens in .NET.

Before jumping into the validation code, you should evaluate whether you really need to explicitly validate the JWTs you receive from an issuer like Auth0. Depending on the specific application, you may want to use an Auth0 SDK, which will take care of all the validation steps for you. For example, if you are developing an ASP.NET Core MVC application or a Blazor Server application, you can use the [Auth0 ASP.NET Core Authentication SDK](https://github.com/auth0/auth0-aspnetcore-authentication). This SDK will take care of the entire process of obtaining the JWT tokens for your application, including token validation. Check out [this article](https://auth0.com/blog/exploring-auth0-aspnet-core-authentication-sdk/) for an overview of this specific SDK.

So, if your application can benefit from an SDK, the best move is to write less code and get the JWT validation for free. Take a look at [this article to learn which Auth0 SDK is right for your .NET application type](https://auth0.com/blog/choose-the-right-dotnet-sdk-for-auth0/). 

## Using the ASP.NET Core Middleware

If, for some reason, you can't use an Auth0 SDK, you can configure your ASP.NET Core application by using two middleware:

- The [OpenIdConnect middleware](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.OpenIdConnect), which allows your ASP.NET Core web applications to authenticate users and get ID and access tokens via [OpenId Connect](https://openid.net/developers/how-connect-works/).
- The [JwtBearer middleware](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.JwtBearer), which enables your ASP.NET Core web API to handle access tokens.

Both middleware provide you with a convenient way to obtain and validate JWT tokens. The following code snippet shows an example of how to configure OpenIdConnect middleware:

```csharp
// Program.cs

var builder = WebApplication.CreateBuilder(args);


builder.Services.AddAuthentication(options => {
 options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
 options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
 options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
 })
 .AddCookie()
 .AddOpenIdConnect("Auth0", options => {
 options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
 options.ClientId = builder.Configuration["Auth0:ClientId"];
 options.CallbackPath = new PathString("/callback");
 });

// ...other code...
```

The next example shows how to use the JwtBearer middleware:

```csharp
// Program.cs

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
 .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
 {
 options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
 options.Audience = builder.Configuration["Auth0:Audience"];
 });

// ...other code...
```

In both cases, by configuring the `Authority` option, you implicitly ask the middleware to validate your tokens. The middleware will use this value to retrieve the issuer's signing key, which is needed to validate the token's signature. All the other required validation steps are performed automatically. There is nothing else you need to do.

### Simplified configuration for the JwtBearer middleware

Starting with .NET 7, you can [use the JwtBearer middleware in a simplified way](https://auth0.com/blog/whats-new-in-dotnet-7-for-authentication-and-authorization/#Simplified-Configuration). You define your validation values in the `appsettings.json` file, as in the following example:

```json
// appsettings.json

{
 "Logging": {
 "LogLevel": {
 "Default": "Information",
 "Microsoft.AspNetCore": "Warning"
 }
 },
 "AllowedHosts": "*",
 "Authentication": {
 "Schemes": {
 "Bearer": {
 "Authority": "https://{DOMAIN}",
 "ValidAudiences": [ "{AUDIENCE}" ],
 "ValidIssuer": "{DOMAIN}"
 }
 }
 }
}
```

Then you can simply add the middleware to your ASP.NET Core application, as follows:

```csharp
// Program.cs

// ...existing code...

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication().AddJwtBearer();

// ...existing code...
```

The behavior is exactly the same as before but with much less code.

### Custom validation with the ASP.NET Core middleware

If you have specific needs, you can customize the JWT validation using the `TokenValidationParameters` option. For example, if you already have the issuer's public key stored on your file system, you can configure your middleware as shown in the following example:

```csharp
// Program.cs

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
 .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
 {
 options.Audience = builder.Configuration["Auth0:Audience"];
 options.TokenValidationParameters = 
 new Microsoft.IdentityModel.Tokens.TokenValidationParameters
 {
 ValidateIssuer = true,
 ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}",
 ValidateIssuerSigningKey = true,
 IssuerSigningKey = new X509SecurityKey(new X509Certificate2(certificateFilePath)),
 ValidateLifetime = true
 };
 });

// ...other code...
```

You can see that the `Audience` option is still there while the `Authority` option is missing. Instead of the `Authority` option, you find the `TokenValidationParameters` option, which is assigned an instance of the `TokenValidationParameters` class. The properties of this instance define what to check in order to complete the JWT validation. Specifically, you ask to validate the issuer (`ValidateIssuer`) and provide the value to match with (`ValidIssuer`). You ask to validate the issuer's signature (`ValidateIssuerSigningKey`) and provide the issuer's public signing key (`IssuerSigningKey`) embedded in a certificate stored in the file system. And finally, you ask to check the expiration time (`ValidateLifetime`).

You can see how removing the `Authority` option from the middleware configuration forces you to manually specify what to check in order to validate the token.

## Validate a JWT “By Hand”

In case you can't use the ASP.NET Core middleware, for example, when you are not developing a web application, don't get desperate. .NET gives you what you need, although this requires some effort on your side.

### Validate your token

First, you need to install the `Microsoft.IdentityModel.Tokens` package from NuGet:

```bash
dotnet add package Microsoft.IdentityModel.Tokens
```

This package provides everything you need for token manipulation, including validation, of course.

Have a look at the following function:

```csharp
public bool ValidateToken(
 string token, 
 string issuer, 
 string audience, 
 ICollection<SecurityKey> signingKeys,
 out JwtSecurityToken jwt
)
{
 var validationParameters = new TokenValidationParameters {
 ValidateIssuer = true,
 ValidIssuer = issuer,
 ValidateAudience = true,
 ValidAudience = audience
 ValidateIssuerSigningKey = true,
 IssuerSigningKeys = signingKeys,
 ValidateLifetime = true
 };

 try
 {
 var tokenHandler = new JwtSecurityTokenHandler();
 tokenHandler.ValidateToken(token, validationParameters, out SecurityToken validatedToken);
 jwt = (JwtSecurityToken)validatedToken;
 
 return true;
 } catch (SecurityTokenValidationException ex) {
 // Log the reason why the token is not valid
 return false
 }
}
```

This function takes a token and validates it by using the other parameters: the issuer, the audience, and the signing keys. If the token is valid, it returns `true` and provides a `JwtSecurityToken` instance representing the token as the `jwt` output parameter.

Once again, you see the `TokenValidationParameters` class, which allows you to define the validation criteria. This time there is no implicit validation. You need to specify all the required validation criteria and the valid values. Then you create a token handler (`JwtSecurityTokenHandler`) and use it to validate the token against the validation parameters. If the validation succeeds, you get an object representing the token, which you assign to the output parameter after casting to `JwtSecurityToken`. Finally, the function returns `true`.

If the validation fails, it should log the reason for the failed validation and return `false`.

### Get the signing keys

The `ValidateToken()` function expects you to pass the basic information for the token validation: the token issuer identifier, the audience, and the issuer's signing keys. You may have all this information on hand or need to retrieve some of it. For example, you can obtain the signing key of the issuer online. According to the [OIDC standard](https://openid.net/specs/openid-connect-discovery-1_0.html), you can find the set of keys (*JSON Web Key Sets*) to verify the issuer's signatures at a public and well-defined URL: `https://{DOMAIN}/.well-known/openid-configuration`.

Read [this document to learn more about the JSON Web Key Sets](https://auth0.com/docs/secure/tokens/json-web-tokens/locate-json-web-key-sets).

To validate a JWT using the `ValidateToken()` function, you must first retrieve the signing key from this URL. As you can see, things start to get complex. This is why I suggest using an Auth0 SDK in the first place, or at least the ASP.NET Core middleware, if possible.

However, if using one of these tools is not feasible in your specific case, here is what you need to do to get the issuer's signing keys.

First, you need to install another package from NuGet: the `Microsoft.IdentityModel.Protocols.OpenIdConnect` package:

```bash
dotnet add package Microsoft.IdentityModel.Protocols.OpenIdConnect
```

This package provides you with the `ConfigurationManager` class, which helps you retrieve the JSON Web Key Sets. The following code shows you how to obtain the signing key of your JWT issuer:

```csharp
var configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(
 $"https://{builder.Configuration["Auth0:Domain"]/.well-known/openid-configuration}",
 new OpenIdConnectConfigurationRetriever(),
 new HttpDocumentRetriever());

 var discoveryDocument = await configurationManager.GetConfigurationAsync();
 var signingKeys = discoveryDocument.SigningKeys;
```

Once you have the signing keys, you are ready to use the `ValidateToken()` function.

## Recap

Throughout this article, you have learned what JWT validation is and why you need to do it. You also learned that as a .NET developer, you have many options for validating the JWTs your application receives: from a zero-code approach to an almost manual validation.

With the Auth0 SDKs, you get the JWT validation for free. No specific code is required. The SDKs validate tokens for you.

Using the ASP.NET Core middleware, OpenIdConnect and JwtBearer, you get implicit token validation in the default cases. However, you can customize your validation criteria if you are dealing with special cases.

In case you need full control over the validation process, you can rely on the `Microsoft.IdentityModel.Tokens` package for the JWT manipulation and validation and on the `Microsoft.IdentityModel.Protocols.OpenIdConnect` package for retrieving the issuer's signing keys.

Of course, the suggestion is to delegate as much as possible to the SDKs and middleware because the less code you write, the fewer bugs you may create 🙂.

How to Validate JWTs in .NET

Learn about the new features introduced by the .NET Core 3.0 release.

Exploring .NET Core 3.0. What's New?

Creating unit tests and integration tests with xUnit for C# applications.

Using xUnit to Test your C# Code

An overall view of .NET, Microsoft's cross-platform development environment that allows you to build any type of application with C# and other languages.

Microsoft's ambition to provide developers with one platform to solve any type of problem has been fulfilled by .NET. For a couple of decades already, the .NET platform has been powering up web, desktop, and mobile applications in both the startup and enterprise scenes.

Without any doubt, .NET plays a central role in the software development industry. .NET popularity in the developer community is a fact. You can measure it through the number of open source projects around the world and the presence of [C# among the five most popular programming languages](https://www.tiobe.com/tiobe-index/). Its popularity is going to grow even more, especially after [the latest release (.NET 5)](https://auth0.com/blog/dotnet-5-whats-new/), which revolutionizes the industry by pioneering the concept of universal software development.

To understand the power of .NET, let's explore some of its technical foundations.

## What is .NET?

.NET is an open-source and cross-platform development platform for building many types of applications. Designed by Microsoft, the platform supports multiple programming languages and libraries to build web, mobile, desktop, IoT applications, and more.

![.NET 5 platform](https://images.ctfassets.net/23aumh6u8s0i/2bsVrNvzMOk64yfFw0ZU3O/b88d3412d42844d54011f31d69d5860f/dotnet5_platform)

<a href="https://devblogs.microsoft.com/dotnet/introducing-net-5/">[Source: Microsoft]</a>

Even if C# is considered the main programming language for .NET, you can use many other different languages of your choice. The languages directly supported by Microsoft are:

- [C# (C sharp)](https://docs.microsoft.com/en-us/dotnet/csharp/): A modern object-oriented programming language that belongs to the C language family. Its syntax may look familiar to C, C++, Java, and JavaScript developers.

- [F# (F sharp)](https://dotnet.microsoft.com/languages/fsharp): A functional-oriented programming language, member of the [ML](https://en.wikipedia.org/wiki/ML_(programming_language%29) language family. It also supports the object-oriented programming paradigm.

- [Visual Basic](https://docs.microsoft.com/en-us/dotnet/visual-basic/): The historical Microsoft programming language. It has become a full object-oriented programming language within the context of .NET.

.NET supports the [*Common Language Infrastructure*](https://en.wikipedia.org/wiki/Common_Language_Infrastructure) (CLI), so your source code is compiled into a [*Common Intermediate Language*](https://en.wikipedia.org/wiki/Common_Intermediate_Language) (CIL), independently of the programming language you use. This guarantees great interoperability between languages in the platform.

Besides the above mentioned languages supported directly by Microsoft, many other programming languages can compile to the .NET CIL. For example, ClojureCLR, Eiffel, IronPython, PowerBuilder, and many others. For a complete list, check out [this page](https://en.wikipedia.org/wiki/List_of_CLI_languages).

## .NET Architecture and Components

.NET allows you to build different application types, ranging from command-line to desktop applications, from web to mobile applications, from gaming to IoT applications.

This is possible thanks to its modular and optimized architecture.

### .NET Components

The .NET architecture is based on two main components:

- *CoreCLR*: This is the .NET runtime. It is responsible for executing CLI programs and includes a just-in-time compiler.

- *CoreFX*: The platform’s API implementing the CLI Standard Libraries, that is, the set of libraries that provide the most common functionalities, such as file system management, exception handling, network communication, threading, reflection, and so on. The CoreFX component is sometimes called the *Unified Base Class Library*.

### .NET Application Models

Above the core components, you have the different **application model frameworks**, that is, the libraries that offer support for developing different types of applications. So, for example, you have:

- [ASP.NET](https://dotnet.microsoft.com/apps/aspnet): The framework that allows you to build [web applications](https://auth0.com/docs/quickstart/webapp/aspnet-core-3) and [web APIs](https://auth0.com/blog/how-to-build-and-secure-web-apis-with-aspnet-core-3/).

- [Windows Presentation Foundation (WPF)](https://docs.microsoft.com/en-us/dotnet/desktop/wpf/?view=netdesktop-5.0): A graphical user interface for [Windows desktop applications](https://auth0.com/docs/quickstart/native/wpf-winforms).

- [Xamarin](https://auth0.com/blog/easy-authentication-xamarin-auth0/): The framework for building cross-platform mobile, TV, and desktop applications.

- [Blazor](https://auth0.com/blog/what-is-blazor-tutorial-on-building-webapp-with-authentication/): The framework to build client web applications by using C#. It also allows you to generate [client web apps in WebAssembly code](https://auth0.com/blog/securing-blazor-webassembly-apps/).

- [ML.NET](https://dotnet.microsoft.com/apps/machinelearning-ai): The machine learning framework that simplifies the integration of machine learning models in your .NET application.

In addition to application model frameworks, .NET offers you support for most of the common programming tasks: from file management to network communication, from security to database access. For example, on the networking side, it supports socket programming, HTTP communication, and [gRPC](https://auth0.com/blog/securing-grpc-microservices-dotnet-core/). This allows you to [create microservices](https://auth0.com/blog/implementing-microservices-grpc-dotnet-core-3/) with the protocol that better fits your needs.

For any other needs not embedded in the framework, you can find a huge number of specific libraries on the public [NuGet repository](https://www.nuget.org/). In fact, [NuGet](https://docs.microsoft.com/en-us/nuget/) is the package manager for .NET. It allows you to create, share, and use many .NET libraries for almost any purpose.

## .NET Design and Development Support

.NET support for software development is not limited to the multiple programming languages you can use. .NET also promotes the use of some best practices while letting you use the approach you prefer to build your application.

For example, it encourages you to [use dependency injection to decouple your application’s components](https://auth0.com/blog/dependency-injection-in-dotnet-core/). Dependency injection helps you design better software by limiting the component interdependence and facilitating reuse. In addition, it makes it easier to test your components.

By the way, on the testing side, .NET also comes with support for [unit and integration tests via xUnit](https://auth0.com/blog/xunit-to-test-csharp-code/).

On the front of the development experience, developers can choose from different approaches. They can use the [.NET CLI ](https://docs.microsoft.com/en-us/dotnet/core/tools/)environment, using the command line to create new projects, adding dependencies, build, run, and so on.

They can use [Visual Studio Code](https://code.visualstudio.com/) for an intermediate approach: an advanced cross-platform editor on top of the .NET CLI. Or they can use a powerful IDE like [Visual Studio](https://visualstudio.microsoft.com/vs/), available for both Windows and Mac, that provides you an interactive programming experience.

Regardless of the tool you choose, you can use many project templates to quickly start creating your new application. You can also [create your own .NET project template](https://auth0.com/blog/create-dotnet-project-template/).

## From the .NET Framework to the .NET Platform

Microsoft launched the .NET project in 2002. Since the beginning, the .NET goal was to create a universal platform for programming with any language. Of course, as the first step, Windows was the main .NET target.

However, Microsoft submitted the specifications of the .NET runtime infrastructure and the C# programming language to [ECMA](https://www.ecma-international.org/) for standardization. This led to the birth of a few porting projects on other platforms: Linux, embedded systems, mobile devices, browsers, and so on.

This also led to a fragmentation of the platform and sometimes generated confusion among developers. Take a look at [this article to learn more about the evolution of .NET](https://auth0.com/blog/navigating-dotnet-maze/).

Let’s try to clarify the differences among a few common concepts.

### .NET Framework

The .NET Framework was the initial flavor of .NET. It provides the developer with a set of APIs for the most common programming needs and interacts with the underlying operating system. It runs only on Windows, and its lifecycle is coming to an the end right now, after [the release of .NET 5](https://auth0.com/blog/dotnet-5-whats-new/).

### Mono

The Mono project brings .NET to Linux machines. It is the best known porting project based on the .NET standard specifications. Even if Mono's aim is to run on Linux applications built for the .NET Framework and vice versa, the compatibility is not always guaranteed. There are a couple of reasons for this: some .NET Framework features are too tied to the Windows operating system, and often the Mono implementation lags behind the newest .NET Framework features.

### .NET Core

.NET Core is a complete rewriting of the .NET Framework with the cross-platform goal in mind. Its redesigned architecture defines a minimal feature set as the common core across Windows, Linux, and Mac platforms. The rest of the features can be downloaded as library packages.

### .NET Standard

The .NET Standard is not another .NET implementation. It is a formal specification of .NET APIs that helps to create cross-platform libraries. If a platform supports a given .NET Standard version, then a library supporting the same version will run on it, regardless of the device type and the framework implementation (.NET Framework, Mono, .NET Core).

### .NET

Since the beginning, the .NET term has been used to indicate the universal development platform. However, many implementations arose since then, so the .NET name created ambiguities. .NET 5 aims to make concrete the initial vision of a universal development platform. It replaces the current existing implementations: .NET Framework, .NET Core, and even Mono. So, from .NET 5 on, only .NET will exist as a name and as a platform.

## Auth0 and .NET

Auth0 has extensive support for .NET that allows you to easily integrate modern authentication and authorization into your .NET applications: from specific SDKs to documentation, from blog posts to sample projects. In this section, you find a list of the .NET resources that Auth0 provides you.

### .NET QuickStarts

Auth0 Quickstarts help you in setting up your first [authentication](https://auth0.com/docs/authentication) and [authorization](https://auth0.com/docs/authorization) integration. They guide you in adding the needed code and the required configuration step by step. If you are logged in, the code snippets are configured for your account. If you don't have an account, you <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">can sign up for free with Auth0</a>.

The following .NET-related Quickstarts are available:

- [**ASP.NET Core Web API v3.1**](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi): This Quickstart helps you to add authorization to an ASP.NET Core Web API using the standard [JWT](https://jwt.io/) middleware.
- [**ASP.NET Core v3.1 Web Application**](https://auth0.com/docs/quickstart/webapp/aspnet-core-3): This Quickstart demonstrates how to add user login to an ASP.NET Core Web Application.
- [**WPF/Windows Forms (WinForms**)](https://auth0.com/docs/quickstart/native/wpf-winforms): The Quickstart guides you in adding user login Windows desktop C# applications.
- [**Xamarin**](https://auth0.com/docs/quickstart/native/xamarin): This Quickstart helps you add user login to Xamarin applications.
- [**Windows Universal App**](https://auth0.com/docs/quickstart/native/windows-uwp-csharp): Reading this Quickstart, you will learn how to add user login to [Windows Universal](https://docs.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide) C# applications.

### Software Development Kits (SDKs)

Auth0 provides you the following SDKs to help you to integrate authentication and authorization in your .NET applications:

- [**.NET Client Library for Auth0**](https://github.com/auth0/auth0.net): This SDK supports two APIs:
 - *The Authentication API*: This API allows you to add [OIDC](https://auth0.com/docs/protocols/openid-connect-protocol)-based authentication to your application
 - *The Management API*: This API allows you to interact with the [Auth0 Management API](https://auth0.com/docs/api/management/v2) and deal with your [Auth0 tenant](https://auth0.com/docs/videos/get-started-series/architect-your-tenant).
- [**Auth0 OIDC Client for .NET** ](https://github.com/auth0/auth0-oidc-client-net): This library supports [OIDC authentication](https://auth0.com/docs/protocols/openid-connect-protocol) for .NET desktop applications based on WinForms, WPF, and UWP as well as Xamarin mobile applications.

### .NET blog posts

In addition to SDKs and Quickstarts, Auth0 provides you with specific content, use cases, and code examples through its [developer blog](https://auth0.com/blog/developers/). You can find [many .NET-related articles](https://auth0.com/blog/search/?query=.net) that help you build and secure your applications and keep up to date with the most recent features. Most articles include a sample project to demonstrate how to practically implement your apps. You can download them from GitHub, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up with Auth0</a> if needed, configure the app, run it, and explore the code.

So, enjoy building your next .NET project with Auth0!

What is .NET? An Overview of the Platform

What's new in .NET 5? Learn how .NET Core and .NET Framework evolve into the new cross-platform framework.

.NET 5, the successor of .NET Core 3.1 and .NET Framework 4.8, aims to provide .NET developers with a new cross-platform development experience. It puts order to the .NET universe fragmentation that has been arising over the years and brings new amazing features. Of course, you cannot learn all about .NET 5 right now, but you can focus on just five things to have a clear understanding of what is going on.

## The Unified Platform

The first thing you have to know is that .NET 5 brings you a new unified vision of the .NET world.

If you have been working with .NET, you may be aware of its platform fragmentation since its first release in 2002. The .NET Framework was initially designed for Windows, but its runtime specification, also known as Common Language Infrastructure (CLI), was standardized as [ECMA 335](https://www.ecma-international.org/publications/standards/Ecma-335.htm).

The standardization allowed anyone to create their own implementation of the .NET runtime. And in fact, a few of them appeared on the horizon: [Mono](https://www.mono-project.com/) for Linux-based systems, [Silverlight](https://www.microsoft.com/silverlight/) for browser-based applications, .[NET Compact](https://en.wikipedia.org/wiki/.NET_Compact_Framework) and [Micro](https://en.wikipedia.org/wiki/.NET_Micro_Framework) frameworks for mobile and resource-constrained devices, and so on. Then, Microsoft decided to write .NET Core from scratch with cross-platform compatibility in mind.

These different implementations raised the need to understand where a .NET package could run on. Should you build different versions of your library to distribute it? The answer to this question was [.NET Standard](https://docs.microsoft.com/en-us/dotnet/standard/net-standard), i.e., a formal specification of the common APIs you should expect across CLI implementations. In other words, if you build your library for one specific .NET Standard, you'll be guaranteed it will run on all the runtimes that implement that specification.

You understand that, in this messy situation, the desired cross-implementation compatibility is not so easy to achieve. This is why .NET 5 appears on the scene.

![.NET 5 Platform](https://images.ctfassets.net/23aumh6u8s0i/l9JJaTYKjT55fB2VDus2R/d3bbe04d363cf6e022e24ca882840173/dotnet5_platform)

[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/introducing-net-5/)]

The new .NET platform is the unified successor of the various .NET flavors: .NET Framework, .NET Standard, .NET Core, Mono, etc. It is officially the next version of .NET Core 3.1, but basically determines the end of .NET Framework, .NET Standard, and the other variants that caused big headaches to .NET developers.

.NET 5 provides a common set of APIs that aligns the different runtime implementations. This set of APIs is identified by the `net5.0` [Target Framework Moniker](https://docs.microsoft.com/en-us/dotnet/standard/frameworks) (TFM), which is the token you set in your .NET project to specify the target framework. This enables your application to run on any runtime implementation supporting .NET 5. However, you can still build applications for a specific platform. For example, to build an application that uses Windows API, you need to specify the `net5.0-windows` TFM. This way, building a platform-specific application is **your** choice, not a choice depending on the runtime implementation you are using to develop your application.

Of course, achieving this unified platform required a significant effort and an internal architecture rearrangement. A few features have been removed from the core API set, as you will see later on, but [the platform gained a general improvement in performance](https://devblogs.microsoft.com/dotnet/performance-improvements-in-net-5/).

While the new .NET 5 comes with the platform unification goal, the initial plan changed because of COVID-19. In fact, .NET 5 sets the foundations of the unification, but it will be completed with .NET 6 in November 2021. With that release, you will get the stable release of the new Universal UI and support for the specific TFMs for Android (`net6.0-android`) and iOS (`net6.0-ios`), for example.

<include src="TweetQuote" quoteText=".NET 5 was born with cross-platform compatibility in mind."/>

## New Features in C# #

The second thing you should know is about C#. .NET 5 comes with C# 9, the new version of the .NET platform's main programming language. There are several new features, but here you will find a taste of the most relevant ones.

### Top-level statements

Among the new features, one of the most notable is the introduction of **top-level statements**. To learn what they are, take a look at the following classic minimal program:

<include src="AmpWarning" fullUrl="https://auth0.com/blog/dotnet-5-whats-new"/>

``` csharp 
using System;

namespace HelloWorld
{
 class Program
 {
 static void Main(string[] args)
 {
 Console.WriteLine("Hello World!");
 }
 }
}
```

Just to write one string to the console, you need to define a namespace, a class, and the static method `Main()`. Now, you can get rid of this code infrastructure and simply write the following:

``` csharp 
System.Console.WriteLine("Hello World!");
```

Top-level statements allow you to focus on what really matters in small console programs and utilities and use C# with a more scripting-oriented approach.

### Record types

Another interesting new feature is **record types**. With records, you can declare an immutable reference type, i.e., a class-based type that cannot be changed after its creation. An example of a built-in immutable reference type is the `System.String` class. After you create an instance of a `System.String`, you cannot change its value anymore.

Consider the following record type declaration:

``` csharp 
public record Person
{
 public string FirstName { get; }
 public string LastName { get; }

 public Person(string first, string last) => (FirstName, LastName) = (first, last);
}
```

You can create an instance of the `Person` record as you do with a class, but you can't change its `FirstName` property:

``` csharp 
var person = new Person("John", "Doe");

person.FirstName = "Jack";	//throws an error
```

However, you can compare two instances of the `Person` record similarly to primitive values:

``` csharp 
var person = new Person("John", "Doe");
var anotherPerson = new Person("John", "Smith");

Console.WriteLine(person == anotherPerson); //false
```

### Init setters

C# 9 also adds the `init` accessor to define **properties that can only be initialized**. To better explain its use cases, consider the following class definition:

``` csharp 
public class Person {
 public string FirstName { get; init; }
 public string LastName { get; init; }
 public string Address { get; set; }
}
```

This class defines a person with `LastName` and `FirstName` properties that can be initialized, but not changed. The `Address` property can be changed at any time:

``` csharp 
var person = new Person {
 FirstName = "John",
 LastName = "Doe",
 Address = "124 Conch Street, Bikini Bottom, Pacific Ocean"
}

person.Address = "17 Cherry Tree Lane";
person.FirstName = "Jack";	//throws error
```

If you want to learn more about the features brought by C# 9, please [check out the official documentation](https://docs.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-9).

## .NET MAUI, the Universal UI

As the third thing, you have to know that .NET 5 is bringing to you a new way to build cross-platform user interfaces. Thanks to the **.NET Multi-platform App UI** framework, also known as **.NET MAUI**), you will be able to build user interfaces for Android, iOS, macOS, and Windows with a single project.

> Actually, this feature is still in progress and will be released with .NET 6, but [you can start taking a look at .NET MAUI](https://github.com/dotnet/maui) to be ready when it is officially released. Take a look at [the roadmap](https://github.com/dotnet/maui/wiki/Roadmap) to follow its progress.

.NET MAUI can be considered an evolution of [Xamarin.Forms](https://dotnet.microsoft.com/apps/xamarin/xamarin-forms), the open-source framework for building iOS and Android apps with a single .NET codebase. But this new framework proposes a universal model for building UIs on mobile and desktop platforms.

![.NET MAUI](https://images.ctfassets.net/23aumh6u8s0i/5QASNuBVJCrC7bIIH6RLct/0edcc3942920c3e8dc49b49026bfeff0/maui-overview)

[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/introducing-net-multi-platform-app-ui/)]

In addition to the well-known [Model-View-ViewModel](https://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93viewmodel) (MVVM) pattern, .NET MAUI supports the new *Model-View-Update* (MVU) pattern. This is a one-way data flow pattern inspired by the [Elm programming language architecture](https://elmprogramming.com/model-view-update-part-1.html) that provides an effective way to manage UI updates and application state.

## Supporting Single-File Applications

The fourth thing you will get in .NET 5 is the support of **single-file applications**, that is, applications published and deployed as a single file. That means that your application and all its dependencies are bundled into one file. For example, say you run the following command within the folder of your .NET 5 project:

``` bash 
dotnet publish -r linux-x64 --self-contained true /p:PublishSingleFile=true
```

You will get a single file containing your application built for Linux, all the dependencies you used in your project, and the .NET runtime (`--self-contained true`). This means that you even don't need to install the .NET runtime on the target machine.

Of course, you can also specify these parameters in your project configuration:

``` xml 
<Project Sdk="Microsoft.NET.Sdk">

 <PropertyGroup>
 <OutputType>Exe</OutputType>
 <TargetFramework>net5.0</TargetFramework>
 
 <PublishSingleFile>true</PublishSingleFile>
 
 <SelfContained>true</SelfContained>
 
 <RuntimeIdentifier>linux-x64</RuntimeIdentifier>
 </PropertyGroup>

</Project>
```

Be aware that this feature doesn't use the same approach as the single-file applications you can build in .NET Core 3.1. In .NET Core 3.1, the single-file application is just a way to package binaries. At run time, they are unpackaged to a temporary folder, loaded, and executed. In .NET 5, the single-file application has a new internal structure, and it is directly executed with no performance penalty.

Take a look at the documentation to [learn more about this deployment type](https://docs.microsoft.com/en-us/dotnet/core/deploying/single-file).

## No Longer Supported Technologies

The last of the five things you are learning about .NET 5 concerns what is no longer supported. As said above, the architectural review and the attempt to make .NET 5 an actual cross-platform programming framework led to removing a few features supported in .NET Framework. Let's take a quick look at the removed features and the possible alternatives.

### Web Forms

For a long time, [ASP.NET Web Forms](https://dotnet.microsoft.com/apps/aspnet/web-forms) has been the main technology to build dynamic web UIs. However, it is not a secret that its lifetime was closely bound to .NET Framework's destiny. .NET Core doesn't support Web Forms, so the fact it is no longer supported in .NET 5 shouldn't actually be news.

However, you have a few alternatives to build web UIs. If you are building traditional web applications, [Razor Pages](https://docs.microsoft.com/en-us/aspnet/core/tutorials/razor-pages/?view=aspnetcore-5.0) are one of these alternatives. If you want to build single-page applications, you can use [Blazor](https://docs.microsoft.com/en-us/aspnet/core/blazor/?view=aspnetcore-5.0).

### Windows Communication Foundation (WCF)

Even [WCF](https://docs.microsoft.com/en-us/dotnet/framework/wcf/whats-wcf), the traditional communication framework for Windows, is going to be deprecated. This may appear a bit shocking for the developers that have used it to build their service-oriented applications. However, it is pretty understandable if you realize that the primary goal of .NET 5 is becoming a cross-platform framework.

The alternative to WCF recommended by Microsoft is to migrate to [gRPC](https://docs.microsoft.com/en-us/aspnet/core/grpc/?view=aspnetcore-5.0). But if you are nostalgic about WCF or want to prepare a smooth transition, you can give the [CoreWCF](https://github.com/CoreWCF/CoreWCF) open-source project a try.

### Windows Workflow Foundation

Finally, .NET 5 will not even include [Windows Workflow Foundation](https://docs.microsoft.com/en-us/dotnet/framework/windows-workflow-foundation/), the workflow engine technology available in .NET Framework. There is no official replacement for this technology. However, you can use an open-source porting project, [CoreWF](https://github.com/UiPath/corewf), to attempt moving your existing workflows on .NET 5 or creating new ones.

## Summary

At the end of this article, you have a high-level idea of how .NET 5 will impact your existing .NET projects and which opportunities the new platform is going to offer you. Maybe these highlighted five things may seem like little stuff, but they should allow you to find your way around this turning point in the .NET evolution.

Of course, you can [try .NET 5 right now by downloading its runtime and SDK]( https://dotnet.microsoft.com/download/dotnet/5.0).

While .NET 5 is out, many applications that need security rely on older versions of .NET. Here’s how you can secure an [ASP.NET](http://asp.net/) Core 3.x with Auth0. The same patterns should apply to .NET 5. Let us know in the comments if you bump into any difficulties.

<include src="asides/DotNetCore" />

Five Things You Should Know About .NET 5

How to use C# extension methods to simplify Auth0 configuration for ASP.NET web applications.

Using C# Extension Methods for Auth0 Authentication

facundo-giuliani

Facundo is a Systems Engineer from Buenos Aires, Argentina with 15+ years of experience in software development. Full Stack Developer. Auth0 Ambassador. GitKraken Ambassador. Cloudinary Media Developer Expert. He is also an open-source contributor.

Systems Engineer, Full Stack Developer

Facundo Giuliani

Most languages and frameworks support asynchronous programming. But, what is it exactly? Learn about async programming and how to implement it in C#.

You probably already read about asynchronous programming. `async` and `await` words are used everywhere, no matter which programming language we choose. Talking about .NET framework, and C# in particular, we have some native functions, classes, and reserved words that we can use to implement asynchronous tasks and workflows in our projects.

In this article, we will talk about synchronism, parallelism, concurrency, and how to implement asynchronous algorithms in our C# applications.

## Synchronous and Asynchronous Tasks

As a developer, you surely faced scenarios where certain actions or operations took a considerable amount of time to execute. We regularly have to do long-running tasks such as reading a file, calling an API, or downloading a big file. We could wait for one of these tasks to be finished before executing another task. If that's the case, we say we are working in a "synchronous" way. By doing this, the whole application gets blocked and stops responding until the whole task is completed, and we can move on to a new one.

In some cases, we don't have any alternative. If we have Task1 and Task2 that depend on the result of the first action, we will have to wait until Task1 finishes executing to start Task2. But we could have the scenario where the subsequent tasks (or some of them) don't depend on the result of the previous long-running task. If that's the case, we have different strategies and approaches that we could take to make our application faster and in a more performant way.

For example, we could have an application that runs concurrent tasks internally. There is a button and a task executed when it is clicked. Right after the user clicks on the button, the application can trigger a separate thread to run the requested task. In the meantime, the main thread becomes available to execute other actions while the button's task is executed in the background. Doing this, we keep the UI responsive in case the user wants to interact with it.

Another scenario would be needing to run multiple copies of a certain group of actions or instructions. An example of this would be uploading many files at the same time. In this case, our application could trigger one thread per file and execute the necessary code inside of them. Doing this, we would be processing the files in a "parallel" way. In a nutshell, here is the difference between the two concepts: concurrency means the application is making progress on more than one task at the same time, while parallelism is about running multiple tasks simultaneously.

But let's say we have to read a big file, call an API, and do some complex calculations. There is no dependency between the three tasks, but we need the result of all of them to continue the execution of our application and update the UI. In this case, we could execute our tasks "asynchronously" with the three ones running simultaneously and wait for their result to do the subsequent tasks.

## What Is Asynchronous Programming?

We could define asynchronous programming as the way of executing programming code in a thread without having to wait for an I/O-bound or CPU-bound task to finish. I/O-bound operations could be file-system accesses, HTTP requests, API calls, or database queries. And CPU-bound operations would be actions like encrypting data, complex calculations, image or document management.

One of the ideas of asynchronous programming is to divide our logic into *awaitable* tasks so that we don't block the execution of our application. We can call an async method and get a task object that represents it. In the meantime, we can do some not related and not dependant work. After we execute those operations, we await the async task, which may already be finished or not. If the execution is finished, we will get the resulting value from the task and use it in the next dependant operations.

### Benefits

Some of the benefits we have working with asynchronous tasks are:

- We keep the UI of our app responsive.
- We improve the performance of our application.
- We avoid [thread pool starvation](https://medium.com/criteo-engineering/net-threadpool-starvation-and-how-queuing-makes-it-worse-512c8d570527).

### Drawbacks

Although, there are some drawbacks when working with async programming:

- Code gets more complex and harder to maintain.
- There is increased memory allocation, as some objects have to stay alive longer while awaiting other code to be executed.
- It can get hard to find bugs occurring in asynchronous tasks.
- When we're writing an asynchronous piece of code, all our application code tends to become asynchronous.

## Asynchronous Programming Patterns

To perform asynchronous operations in .NET, we can follow three different patterns:

**Asynchronous Programming Model (APM)**: Let's say we have two methods, and we name them `BeginOperation` and `EndOperation`. After calling `BeginOperation`, our application can continue executing tasks on the calling thread while the async task is executed on a different thread. For each call to `BeginOperation`, our app should also call `EndOperation` method to get the results. In .NET, it can be implemented using `IAsyncResult`. Let's see an example of this model:

```csharp
using System;
using System.IO;
using System.Threading;
public sealed class Program
{
 public static void Main()
 {
 var buffer = new byte[100];
 var fs = new FileStream("bigFile.txt", FileMode.Open, FileAccess.Read, FileShare.Read, 1024, FileOptions.Asynchronous);

 IAsyncResult result = fs.BeginRead(buffer, 0, buffer.Length, null, null);

 // Do other things...

 int numBytes = fs.EndRead(result);
 fs.Close();

 Console.WriteLine("Read {0} Bytes:", numBytes);
 }
}
```

**Event-based Asynchronous Pattern (EAP)**: We start an async method that will trigger a `Completed` event when the task is completed, making the result available to our application. This would be an example of this model:

```csharp
public class ExampleHandler
{
 public event EventHandler OnTriggerCompleted;

 public void Start(int timeout)
 {
 var timer = new Timer(new TimerCallback((state) =>
 {
 OnTriggerCompleted?.Invoke(null, null);
 }));

 timer.Change(timeout, 0);
 }
}

class Program
{
 private static void Main()
 {
 var handler = new ExampleHandler();

 handler.OnTriggerCompleted += (sender, e) =>
 {
 Console.WriteLine($"Triggered at: { DateTime.Now.ToLongTimeString()}");
 };

 handler.Start(3000);

 Console.WriteLine($"Start waiting at {DateTime.Now.ToLongTimeString()}");
 Console.WriteLine($"Processing...");
 Console.ReadLine();
 }
}
```

**Task-based Asynchronous Pattern (TAP)**: We have an `OperationAsync` method that returns a `Task` object, as in the following example:

```csharp
class ClassName
{
 public Task OperationAsync(byte [] buffer, int offset, int count);
}
```

 We can await that method, using `async` and `await` keywords. We will go deeper into this approach in a while.

> Keep in mind that **the APM and EAP approaches are legacy models and they are no longer recommended**. Microsoft recommends using the *Task-based Asynchronous Pattern* to implement async programming in our applications.

## Asynchronous Programming in C#

As we mentioned, async programming in C# can be accomplished by implementing the *Task-based Asynchronous Pattern*. We will have methods that return a `Task` or `Task<T>` object. Defining those methods as async operations will enable us to await them and keep using the same execution thread to run other operations that are not linked to the awaited task.

C# provides us two keywords to handle `Task` objects in an easier way: `async` and `await`. Adding the keyword `async` to a method signature allows us to use the `await` keyword inside the method while instructs the compiler to create a state machine to handle the asynchronicity. On the other hand, the `await` keyword is used to pause the execution of a method and asynchronously wait for a `Task` to finish, while the current thread is sent back to the thread pool instead of keeping it in a blocked state. Everything happens in the background, avoiding us to implement and maintain the complexity of thread management and the state of the calls.

Let's analyze this piece of code:

```csharp
public async Task<User> GetLoggedUserEmailAsync()
{
 int userId = GetId();
 string email = await GetEmailAsync(userId);
 User user = GetUserByEmail(email);
 return user;
}

public async Task<string> GetEmailAsync(int userId)
{
 // Do something
}
```

An async method should return `void`, `Task`, or `Task<T>`, where `T` is the return data type that we need. Returning `void` is normally used for event handlers. The keyword `async` enables us to use the command `await` within the method so that we can wait for the asynchronous method processing as expected.

Notice that the methods end with "Async". Although it is not mandatory, there is a naming convention that an asynchronous method name should end with the word "Async". This convention aims to make it clear to the consumer of the functionality that the method won't complete all of its work synchronously.

In our previous example, `GetId()` is called synchronously. When the execution thread encounters the `await` keyword on `await GetEmailAsync(userId)`, it creates a `Task<User>` that contains the remainder of the `GetLoggedUserEmailAsync` method. This task is executed asynchronously after the `Task<string>` returned by `GetEmailAsync`. So, the `User` object is returned from the `Task<User>` created by the `await` keyword.

## Asynchronous Code in Action

Let's see a short example to review the concepts previously explained. Having the following console application:

```csharp
using System;
using System.IO;
using System.Threading.Tasks;

class Program
{
 static async Task Main(string[] args)
 {
 string filePath = "bigFile.txt";

 // Create a big file
 FileStream fs = new FileStream(filePath, FileMode.CreateNew);
 fs.Seek(1024 * 1024, SeekOrigin.Begin);
 fs.WriteByte(0);
 fs.Close();

 var task = ReadFileAsync(filePath);

 Console.WriteLine("A synchronous message");

 int length = await task;

 Console.WriteLine("Total file length: " + length);
 Console.WriteLine("After reading message");
 Console.ReadLine();
 }

 static async Task<int> ReadFileAsync(string file)
 {
 Console.WriteLine("Start reading file");

 int length = 0;

 using(StreamReader reader = new StreamReader(file))
 {
 string fileContent = await reader.ReadToEndAsync();
 length = fileContent.Length;
 }

 Console.WriteLine("Finished reading file");

 return length;
 }
}
```

In this application, we read a big file, count the number of characters it has, and print different messages in the console. The method that triggers the file reading operation is defined as asynchronous, and it's the one that starts the asynchronous thread reading the text. While the message "A synchronous message" is printed, the reading of the file continues. If we execute the application, we can see how the execution thread behaves based on the output messages:

![Asynchronous sample application output](https://images.ctfassets.net/23aumh6u8s0i/6QF3i0BPAoDOSdF0T1jm07/269b11a895d0f74b415d49aa5b23d106/async-program-console.png)

## Summary

In this article, we talked about how we can manage and organize the tasks in our application based on the dependency and order of execution. We talked about synchronism, parallelism, concurrency, and asynchronism. We described async programming, its benefits, and how we can implement it in our C# applications. You can find the code shown in this article in [this GitHub repository](https://github.com/auth0-blog/c-sharp-async-intro).

If you want to learn more about asynchronous programming in C# and what advanced features we have available, you can go to:

- [Async in depth](https://docs.microsoft.com/en-us/dotnet/standard/async-in-depth) by Microsoft.
- [Asynchronous programming with async and await](https://docs.microsoft.com/en-us/dotnet/csharp/programming-guide/concepts/async/) by Microsoft.
- [Asynchronous Programming Guidance](https://github.com/davidfowl/AspNetCoreDiagnosticScenarios/blob/master/AsyncGuidance.md) by David Fowler.
- [Async/Await - Best Practices in Asynchronous Programming](https://docs.microsoft.com/en-us/archive/msdn-magazine/2013/march/async-await-best-practices-in-asynchronous-programming) by Microsoft.

<include src="asides/DotNetCore" />

Introduction to Async Programming in C#

Besides surfing the web, you can use web browsers programmatically to automate tasks. Learn how to drive a Chromium browser using Puppeteer Sharp, a browser automation library for C#.

One of the goals every developer has is to automate as many actions and tasks as possible. Some of the reasons why we should try to automate our workflows are:

- We save work time.
- We depend less on human assistance.
- We make things faster.
- We spend less money.
- We get consistent results over iterations.

Besides the benefits that automation brings us, there are some scenarios that couldn't be achieved if we don't execute an automatic process. One example of this is the dynamic generation of files and images. In this article, we will see how to implement automatic workflows interacting with a web browser instance.

## Browser Automation

"Browser automation" is the action of automating the usage of a web browser. Its purpose is to achieve efficiency and speed at a certain level that wouldn't be possible if we rely on human interaction.

With a browser automation tool, we can simulate interactions using input devices (keyboard, mouse, etc.), or we can verify that visual elements are working and displayed correctly. We also have different elements inside a web page that we can interact with: dialogs, downloads, authentication forms, videos, etc.

With browser automation, we can do most of the things we do manually with a web browser. Some examples where we could use a browser automation API are:

- Automate form submission.
- Develop and implement a UI testing strategy using the latest version of Google Chrome Browser.
- Automate and validate keyboard input responses.
- Generate screenshot images.
- Generate PDF files.
- Scrape a website.
- Crawl a Single-Page Application (SPA) and generate pre-rendered content.
- Diagnose performance issues.

There are various browser automation tools in the market, implemented for several programming languages and with different features or purposes. One of the first to be released was [Puppeteer](https://pptr.dev/).

## What Is Puppeteer?

According to the official definition, [Puppeteer](https://pptr.dev/) is "A Node library which provides a high-level API to control headless Chrome or Chromium over the [DevTools Protocol](https://chromedevtools.github.io/devtools-protocol/)".

A [headless browser](https://developers.google.com/web/updates/2017/04/headless-chrome) is basically a web browser without a graphic user interface. It renders HTML documents and executes JavaScript code, but without displaying it on the screen. We can interact with a headless browser through a command line.

Even though Puppeteer runs mainly as a headless Chromium instance, we have the possibility to set it as "non-headless" and display all the interactions on the screen.

## Puppeteer Sharp

Puppeteer Sharp is a .NET port of the official Puppeteer API. It can run on .NET Framework or .NET Core projects. As the library was developed with a C# focus, we can use it with features like dependency injection, Async suffixes, etc.

One cool thing is that Puppeteer Sharp supports Chromium-based browsers (Google Chrome, Microsoft Edge), but also Mozilla Firefox. So, we can automate interactions with those web browsers.

Let's play with Puppeteer Sharp and leverage it to generate content in PDF.

## PDF Generation App Using Puppeteer Sharp

Let's see how to generate PDF files with a C# console app using the [Puppeteer Sharp NuGet package](https://www.nuget.org/packages/PuppeteerSharp/). The application will receive a URL from the user; it will generate a PDF with the content of the website and will save the generated file in a defined directory.

If you want to see the final code of the application, download it from [this GitHub repository](https://github.com/auth0-blog/puppeteer-sharp-pdf-generator).

First of all, we'll create a new Console App.

![Create Console App in Visual Studio for Mac](https://images.ctfassets.net/23aumh6u8s0i/3AmUM3S7DrcgTm6o5hzv5E/640c7747f2e4922b1b1c4266c75d22a0/console-app.png)

After we named our application and generated the boilerplate code, we will add the "PuppeteerSharp" NuGet package to our solution.

![Add PuppeteerSharp NuGet package in Visual Studio for Mac](https://images.ctfassets.net/23aumh6u8s0i/1NumDfbWC4x7bLBB3fVdmx/20aa0a63fb1634341cc44a3d203c7ce8/puppeteer-sharp-nuget-package.png)

We will add the following code to the `Program.cs` file:

```csharp
using System;
using System.Threading.Tasks;
using PuppeteerSharp;

namespace PuppeteerSharpPdfGenerator
{
 class Program
 {
 static async Task Main(string[] args)
 {
 Console.WriteLine("Enter URL to generate PDF file:");

 string url = Console.ReadLine();

 var browserFetcher = new BrowserFetcher();
 await browserFetcher.DownloadAsync();

 await using var browser = await Puppeteer.LaunchAsync(new LaunchOptions { Headless = true });

 await using var page = await browser.NewPageAsync();
 await page.GoToAsync(url);
 await page.PdfAsync($"{DateTime.Today.ToShortDateString().Replace("/", "-")}.pdf");

 Console.WriteLine("PDF File generated successfully.");
 Console.ReadLine();
 }
 }
}
```

Let's detail what this code is doing:

- We start requesting the URL that we want to browse and print as a PDF file. We store that in the string variable `url`.

- We create an instance of BrowserFetcher. This class helps us to download the Chromium browser that we will use to automate our tasks.

- We call `browserFetcher.DownloadAsync` to download all the files related to the Chromium browser that we will use. You can see that the files are downloaded only the first time that we execute our app. In subsequent executions, we won't download anything.

- `DownloadAsync` method can receive a specific version of Chromium and run Puppeteer against it: for example, `await browserFetcher.DownloadAsync(533271)`.

- We launch the Chromium browser. `LaunchAsync` method has several parameters. We send `Headless = true` because we don't want to see how the browser operates while generating the PDF file. In case we want to see how it runs, setting `Headless = false` would be helpful.

- We open a new page in the browser and go to the URL entered by the user.

- We call ` page.PdfAsync` to generate the PDF file. The parameter is the filename we will assign to the newly created file.

- In case we want to change the browser's viewport before we generate the PDF file, we can call the `SetViewportAsync` method.

```csharp
await page.SetViewportAsync(new ViewPortOptions
{
 Width = 500,
 Height = 500
});
```

So, if we run our application, we will get this message in the Terminal:

![Terminal Requesting URL](https://images.ctfassets.net/23aumh6u8s0i/2IqgX4LqMijRA2lAneIRoG/931b63a0c3f136b20a88efe9972b0ff3/terminal-begin.png)

We will type a URL like "[https://jwt.io/introduction](https://jwt.io/introduction)" and press `Enter`. We should wait until the `PDF File generated successfully.` message appears on the screen and press `Enter` to exit from our app.

![Terminal PDF File Generated](https://images.ctfassets.net/23aumh6u8s0i/17k87SXzvMm7BNr1zDbQmA/5da168f22ac528b5ed7affc7a6324de2/terminal-pdf-generated.png)

After that, let's go to the directory where our app is located (if you are running or debugging it from Visual Studio, take a look at the `bin` directory inside the solution folder). We will see the generated PDF file, and if we open it, we will see the JWT tutorial page.

![PDF file showing the JWT tutorial](https://images.ctfassets.net/23aumh6u8s0i/46zAVG7OwOSf76GOOaCOEe/a20787ec65fc53592b0c9ae0ce9a4385/pdf-file.png)

## Summary

In this article, we talked about browser automation and how to implement it using Puppeteer Sharp, a .NET port of the Node.js library Puppeteer. We talked about different scenarios where we could automate browser tasks. We also talked about the "headless browser" concept. Finally, we created a sample application to show how to generate PDF files using Puppeteer Sharp from a C# console application.

If you want to learn more, explore other features and methods of Puppeteer Sharp, or see example code for other scenarios and usages, you can visit the [official GitHub repository](https://github.com/hardkoded/puppeteer-sharp).

<include src="asides/DotNetCore" />

PDF Generation with Puppeteer Sharp

Automating web browser interactions is a great way to test the functionalities of our web application. Let's see how to create UI tests in C# using Playwright Sharp, a browser automation library.

While creating web applications, we want to release them with as few errors as possible. We also want to make sure that the new functionalities we add to our apps don't break the existing behavior and workflows. The only way we can do that is by testing the different scenarios our apps support.

While our code base gets bigger and bigger, it gets pretty hard to manually go through the different paths our app offers every time we apply changes and edits. And even if we are coding a small web application, manual testing executed by a person may not always be the best solution. That is why having automated tests that run periodically through our apps is always a recommended idea.

We talk about User Interface testing when we want to test the visual aspects of an application. We do this to verify that the parts of our product that users will interact with are working as expected, and they meet the performance and functionality requirements.

We can create automatic processes and algorithms, probably using mock data, that execute [unit and integration tests](https://auth0.com/blog/xunit-to-test-csharp-code/) across our codebase. Doing this, we verify that everything is working as expected, and we are supporting all the logical scenarios and business rules our application handles. But if we want to test visual elements from our apps, we will need the help of a web browser.

## What Is Browser Automation?

As developers, we (should) always try to automate things. We make things faster, we save work time, we spend less money, we depend less on human assistance, we get consistent results over iterations.

If we want to create and run UI tests for our web apps, we should automate actions related to web browsers. We will need to simulate interactions using input devices (keyboard, mouse, etc.), and we will verify that visual elements are working and displayed correctly.
"Browser automation" is automating the usage of a web browser. The goal is to achieve efficiency and speed at a certain level that wouldn't be possible if we depend on human interaction.

There are different tools available to accomplish browser automation, implemented in different programming languages and with different features. Today we will talk about Playwright and the .NET implementation: Playwright Sharp.

## What Is Playwright?

[Playwright](https://playwright.dev/) is an [open-source](https://github.com/microsoft/playwright) browser automation library. It is a JavaScript-based library created to be used with Node.js. One of the main differences with other browser automation tools is that Playwright is cross-browser. It can automate tasks using Chromium (Google Chrome, Microsoft Edge), WebKit (Apple Safari), and Mozilla Firefox browsers, all with the same API.

Playwright was created by Microsoft. It was developed based on [Puppeteer](https://pptr.dev/), and it was improved to perform automatic UI testing.

Some of the benefits Playwright offers are:

- Support for all browsers
- Test for mobile using device emulation
- Cross-platform WebKit testing
- Headless and headful execution: while automation is being executed, you can hide (headless) or show (headful) the web browser UI. Headful is usually selected for debugging, while headless is the preferred option for continuous integration or cloud executions.

<include src="TweetQuote" quoteText="Playwright Sharp ports the power of browser automation to .NET." />

## What Is Playwright Sharp?

[Playwright Sharp](https://github.com/microsoft/playwright-sharp) is a .NET porting for Playwright. It works close to the product, so we have all the features from the original library available to be used in .NET.

Playwright Sharp has been built with C#, so developers can get the advantage of .NET features such as dependency injection, "Async" suffixes, etc.

The NuGet package has two required dependencies: the Playwright driver and the browsers that we can use. Playwright drivers will be copied to the bin folder at build time. The browsers are installed in different ways depending on the use we give to the library. If we want to use Playwright Sharp in test projects, browsers will be installed at build time.

Let's create an example project to use some of the features Playwright Sharp offers.

## Playwright Sharp in Action

To get acquainted with Playwright Sharp methods and features, we will create a small end-to-end test. End-to-end testing is a technique that tests a complete workflow, from beginning to end, to ensure the flow behaves as expected. The idea is to test real scenarios to verify that everything is working as expected.
For this article, we will test part of the [Auth0 website](https://auth0.com/). Let's say that we want to test if a particular Quickstart guide is working, and the link to the GitHub repository where the sample code lives is correct. Let's pick ["Regular Web App" for ASP.NET Core](https://auth0.com/docs/quickstart/webapp/aspnet-core).

If you want to see the final code of the project we are going to create, download it from [this GitHub repo](https://github.com/auth0-blog/playwright-sharp-auth0).

First of all, we need to create a project using a testing library to code and run our tests. You can choose any testing library you want that works with .NET Core and C#. For this example, let's create a new [NUnit](https://nunit.org/) Test Project.

![NUnit Test Project in Visual Studio for Mac](https://images.ctfassets.net/23aumh6u8s0i/5I32SOweWF4ndmTeapbNP9/82198c8a017365acd1e69073c86f1f77/nunit-test-project.png)

Once the project is created and the standard files are generated, let's add the "PlaywrightSharp" NuGet package to the project.

![Playwright Sharp Nuget Package in Visual Studio for Mac](https://images.ctfassets.net/23aumh6u8s0i/6DO9jJ8OSwyKPMGDrtTSNa/2e6740b35a1e5c562619b5b3af37abfb/playwright-sharp-nuget.png)

We will create only one test, so we will use the `UnitTest1.cs` file already generated and replace its content with the following:

```csharp
// UnitTest1.cs

using System.Threading.Tasks;
using NUnit.Framework;
using PlaywrightSharp;

namespace PlaywrightSharpAuth0
{
 public class Tests
 {
 [Test]
 public async Task Auth0RegularWebAppASPNETCoreLinkWorks()
 {
 using var playwright = await Playwright.CreateAsync();
 await using var browser = await playwright.Chromium.LaunchAsync(headless: true);

 // Go to Auth0 home page
 var page = await browser.NewPageAsync();
 await page.GoToAsync("https://auth0.com/");

 // Click on the cookie policy acceptance button if it exists
 if ((await page.QuerySelectorAsync("#truste-consent-button")) != null)
 {
 await page.ClickAsync("#truste-consent-button");
 }

 // Hover on Developers
 await page.HoverAsync("li[aria-labelledby='nav-item-Developers']");

 // Click on Quickstarts
 await page.ClickAsync("a[href='https://auth0.com/docs/quickstarts/']");

 // Hover on Regular Web App
 await page.HoverAsync("div[data-type='webapp']");

 // Click on Launch Quickstart
 await page.ClickAsync("div[data-type='webapp'] button.btn-success");

 // Search for ASP.NET Core
 await page.TypeAsync("div.quickstart-search-input input", "ASP.NET Core");

 // Click on ASP.NET Core logo
 await page.ClickAsync("div[data-name='aspnet-core']");

 // Look for "View on Github" button and get the href property
 var gitHubLink = await page.EvalOnSelectorAsync<string>("a.btn-transparent.btn-block", "e => e.getAttribute('href')");

 Assert.AreEqual(gitHubLink, "https://github.com/auth0-samples/auth0-aspnetcore-mvc-samples/tree/master/Quickstart/01-Login");
 }
 }
}

```

Let's talk about the different methods used in the test.

- We create a Playwright instance that allows us to launch a web browser.
- For this example, we launch Chromium, the core of browsers like Google Chrome and Microsoft Edge. `LaunchAsync` method has several parameters. We use `headless: true` because we don't want to see how the browser operates while executing the test. If we set `headless: false` instead, a new browser window will be opened, and we will see how each step of the test is executed. This could be helpful in case we want to debug our tests.
- We open a new page in the browser, and we go to a specific URL. In this case, the Auth0 homepage.
- We hover some elements to display different menus. We also click on links to go to other pages. `HoverAsync` and `ClickAsync` accept [CSS selectors](https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_Selectors) to look for specific elements in the web page.
- We can also type text inside an input with `TypeAsync`.
- With `EvalOnSelectorAsync`, we execute an expression and get its result. In this case, we look for the `href` property value of an `<a>` element with the specified CSS selector. We compare that value with the URL we expect, so we can say the test passed correctly.

If we run the test, it should pass (if the Auth0 page didn't change since this article was written).

![Successful Test](https://images.ctfassets.net/23aumh6u8s0i/8IlLz1hcJmRQRkMtRJX2z/d2b1104b3c134af53b4ecd19fdb5b44e/playwright-successful-test.png)

## What's Next?

We created a simple end-to-end test, so we saw how to use some of Playwright Sharp main features. If we want to create more complex UI tests or to automate another kind of browser-based task, we can take a look at the [Playwright GitHub repository](https://github.com/microsoft/playwright-sharp) for some examples. We also have the [official Playwright documentation site](https://playwright.dev/docs/intro), where we can read about different concepts and functions we have available to create our automation processes. There are various elements from a web page that we can interact with: dialogs, downloads, authentication, videos, etc. We can also generate screenshots of what's displayed in the browser or even generate PDF files.

## Summary

In this article, we talked about UI testing and how to implement that through browser automation using Playwright Sharp. If we want to create tests that cover the possible workflows of our web application and analyze the visual elements of them, a library like Playwright Sharp is a powerful tool. With it, we can create end-to-end tests supporting all modern web browsers.

<include src="asides/DotNetCore" />

End-To-End Testing With Playwright Sharp

A quick tour about five C# features that even experienced developers might not know: from variable scopes to the top-level statements and others.

Even if you are an experienced C# developer, there are features you might not be aware of. In this article, you will explore five little-known C# features that allow you to accomplish things in a slightly different way than you are used to. These features allow you to declare local variables in an unusual way, create conditions with the `switch` command and the `try/catch` block, reduce the number of lines to set up a console program, define properties that can only be initialized, and access private variables of a class instance.

Let's get started.

## Variable Scope and Braces

In C#, you can declare variables within code blocks surrounded by braces to define methods, conditional statements, loops, among others. For example, the braces define a variable scope within a method:

``` csharp 
static void Main(string[] args)
{
 Console.Write("Enter your name: ");
 var name = Console.ReadLine();

 Console.WriteLine($"Hello, {name}!");
}
```

Also, you can define a variable scope with an `if` statement:

``` csharp 
if (name.Trim() != "")
{
 var dayOfWeek = DateTime.Today.ToString("dddd");
 Console.WriteLine($"Happy {dayOfWeek}, {name}!");
}
```

And with a `while` statement as well:

``` csharp 
while (name.Trim() != "")
{
 var dayOfWeek = DateTime.Today.ToString("dddd");
 Console.WriteLine($"Happy {dayOfWeek}, {name}!");

 Console.Write("Enter your name: ");
 name = Console.ReadLine();
}
```

Regardless of the context, the braces delimit the scope of the variable. Did you know that **you can define a variable scope with braces even without a specific statement**? Consider the following code:

``` csharp 
using System;

namespace variable_scope
{
 class Program {
 static void Main(string[] args)
 {
 Console.WriteLine("Hello World!");
 {
 var theVariable = "I'm the variable";
 Console.WriteLine(theVariable);
 }
 }
 }
}
```

Here, we have a code block delimited by braces inside the `Main()` method. The code block defines and initializes the variable `theVariable` and writes its value to the console. Notice that no `if`, `while`, `for`, or any other statement stands right before the braces.
This program works as expected: it will write both strings as shown below:

``` bash 
Hello World!
I'm the variable
```

What happens if we add the following statement outside the code block, as in the following example?

``` csharp 
using System;

namespace variable_scope
{
 class Program {
 static void Main(string[] args)
 {
 Console.WriteLine("Hello World!");
 {
 var theVariable = "I'm the variable";
 Console.WriteLine(theVariable);
 }
 //👇 new statement outside the code block
 Console.WriteLine(theVariable);
 }
 }
}
```

If you attempt to run this program, you will get the following error:

``` bash 
error CS0103: The name 'theVariable' does not exist in the current context
```

As you can see, the variable defined inside the code block is not accessible outside it.

In other words, you can create a variable scope by simply using braces anywhere in your code. This feature may be useful when you have a short sequence of statements that need to share a value through a variable. You create a code block on the fly, declare the variable, and use it.
However, I suggest not to abuse it. Sometimes, it's a better idea to create a method and invoke it. It may be more readable than a code block.

## The *when* keyword

Another little-known C# feature is the `when` keyword. You can use it to apply a filter condition in the context of a `switch` statement or a `try/catch` block.
Let’s start by seeing how to use it in the context of a `switch` statement. Consider the following code:

``` csharp 
private static string evaluateScore(int score)
{
 var result = "";

 switch (score)
 {
 case int n when (n < 6):
 result = "Your score doesn't look good...";
 break;

 case int n when (n >= 6 && n <= 7):
 result = "Your score is not bad!";
 break;
 
 case int n when (n > 7 && n <= 9):
 result = "Your score is pretty good!";
 break;
 
 case int n when (n > 9):
 result = "Your score is awesome!";
 break;
 }

 return result;
}
```

Here we have the `evaluateScore()` method that evaluates an integer value (`score`) and returns a message string. As you can see, its logic is totally based on a `switch` statement. Each `case` declares a variable `n` that takes the current value of the `score` parameter. This variable is inspected in the `when` clause to determine the message to be returned. Of course, you can use any boolean expression with the `when` clause.

You can also use the `when` keyword with `catch`, as shown in this example:

``` csharp 
public static async Task<string> MakeRequest()
{
 var client = new System.Net.Http.HttpClient();
 var streamTask = client.GetStringAsync("https://auth0.com/this-page-doesnt-exist");

 try
 {
 var responseText = await streamTask;
 return responseText;
 }
 catch (HttpRequestException e) when (e.StatusCode == HttpStatusCode.MovedPermanently)
 {
 return "The page moved.";
 }
 catch (HttpRequestException e) when (e.StatusCode == HttpStatusCode.NotFound)
 {
 return "The page was not found";
 }
 catch (HttpRequestException e)
 {
 return e.Message;
 }
}
```

Here, you catch an `HttpRequestException` and analyze its status code through a `when` clause.

In both cases, the `when` keyword is extremely useful when you need to match a complex condition since it allows you to keep your code pretty readable.

## Top-Level Statements

Typically, a minimal console application has at least the following code:

``` csharp 
using System;

namespace standard_console
{
 class Program
 {
 static void Main(string[] args)
 {
 Console.WriteLine("Hello World!");
 }
 }
}
```

This program is composed of eleven lines of code, but only one line is actually operative. All the other lines are needed to set up the program infrastructure: a namespace, a class, and a method.

Do you know that you can get rid of this stuff and focus on just one line? In fact, you can replace the code shown above with just the following:

``` csharp 
System.Console.WriteLine("Hello World!");
```

This is possible thanks to the top-level statement feature introduced by C# 9. You can try it [starting with .NET 5](https://auth0.com/blog/dotnet-5-whats-new/).

Of course, you can use multiple top-level statements to create your console application, as in this example.

``` csharp 
using System;

Console.Write("Enter your name: ");
var userName = Console.ReadLine();

Console.WriteLine($"Hello {userName}!");
```

However, remember that you can have only one file using this feature in your .NET project.

Using the top-level statements feature enables a script-oriented approach for C# programming. This may be a more friendly approach for new C# learners or a handy alternative to quickly set up a small console application. For complex applications, you may feel the top-level statements approach is inappropriate because of the lack of a structure.

## The *init* Setter

Assume you have the following `Person` class:

``` csharp 
public class Person
{
 public string FirstName { get; set; }
 public string LastName { get; set; }
 public string Address { get; set; }
}
```

It's a very simple class with just `FirstName`, `LastName`, and `Address` properties. As it *usually* happens in the real world, once you assign a first name and last name to a person, you do not want anyone to change it anymore. So, you would like to assign the values for the `FirstName` and the `LastName` properties to a `Person` instance at the creation time, and those values should not be changed anymore. How can you accomplish this behavior?
If you define the `Person` class by using the usual `get` and `set` accessors, you will not be able to get the expected result. After creating an instance of the `Person` class, you can change the value of its `FirstName` and `LastName` properties whenever you want, as in the following example:

``` csharp 
var person = new Person
{
 FirstName = "John",
 LastName = "Doe",
 Address = "124 Conch Street, Bikini Bottom, Pacific Ocean"
};

person.Address = "17 Cherry Tree Lane";
person.FirstName = "Jack";

Console.WriteLine($"Hello {person.FirstName} {person.LastName}!");
```

Fortunately, C# 9 provides you with the `init` accessor. If you apply the `init` accessor to the `FirstName` and `LastName` properties in place of `set`, you will achieve your goal:

``` csharp 
public class Person
{
 public string FirstName { get; init; } //👈 changed code
 public string LastName { get; init; } //👈 changed code
 public string Address { get; set; }
}
```

This way, after the instance is created, the `FirstName` and `LastName` properties become read-only.
Remember that this feature is supported only starting with C# 9.

## Accessing Private Variables

Of course, you know that a private variable is not accessible from outside a class. In the following example, you have a `Life` class that defines the `birthTime` private variable:

``` csharp 
public class Life
{
 private DateTime birthTime;

 public Life()
 {
 birthTime = DateTime.Now;
 }

 public int GetLength()
 {
 return DateTime.Now.Subtract(birthTime).Milliseconds;
 }
}
```

The `birthTime` private variable is assigned in the class constructor and is used within the `GetLength()` method. Normally, the `birthTime` variable is not accessible from outside the `Life` class. However, there is a special case where you can access the `birthTime` private variable. Take a look at this new `YoungerThan()` method:

``` csharp 
public class Life
{
 // ...other code...

 public bool YoungerThan(Life livingBeing)
 {
 return livingBeing.birthTime < birthTime;
 }
}
```

Within this new method, you are actually accessing the `birthTime` private variable of a `Life` instance!

You may be scared by the consequences of accessing a private variable. Don’t panic! Only instances of a class can access private variables of other instances of the same class. In other words, the context of this access possibility is limited to one specific class.

This feature is useful when you need to implement some sort of internal comparison methods like the one shown above. However, you should use this approach **only when you don't want to expose a private value**. Otherwise, you should expose the private variable through a public property or method and use it for any processing. This way, you keep the idiomatic Object-Oriented Programming approach.

## Summary

In this article, you discovered five C# features that maybe you didn't know. The C# language and [the .NET platform](https://auth0.com/blog/what-is-dotnet-platform-overview/) are growing and evolving very quickly to adapt to developers' needs and simplify their work. So there's nothing bad with missing some feature.

If you know other little-known C# features, please share them with us in the comments below.

<include src="asides/DotNetCore" />

Five C# Features You Might Not Know

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

U.S. Navy veteran and former security leader from Nike joins Auth0 C-Suite

**BELLEVUE, Wash. – March 1, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that [Jameeka Green Aaron](https://www.linkedin.com/in/jameeka/) has joined the company as Chief Information Security Officer (CISO). Aaron brings more than 20 years of industry experience and will be responsible for the holistic security and compliance of Auth0’s platform, products, and corporate environment. 

Aaron is a recognized industry thought leader and has dedicated two decades to managing and improving information security systems at each of her previous positions, including Nike, Hurley, Lockheed Martin, and the U.S. Navy. She is also committed to advancing women and people of color in Science, Technology, Engineering, and Mathematics (STEM) fields, and she participated in the U.S. State Department’s TechWomen program and the National Urban League of Young Professionals. She currently sits on the board of the California Women Veterans Leadership Council, is an advisor for U.C. Riverside Design Thinking Program, and is a member of Alpha Kappa Alpha Sorority, Inc.

“Jameeka is an incredible addition to our executive team, not only for her deep experience and leadership but for her leadership outside of the security industry as well,” said Eugenio Pace, CEO, and co-founder of Auth0. “As a company with a mission of inclusivity and access to technology, we were taken by Jameeka’s stewardship to her causes and looked forward to driving lasting positive change together. Her unmatched security expertise and dedication is an inspiration and invaluable asset to Auth0.”

The web of complexity involved in managing a competitive digital business broadens each day. Auth0 continues to innovate and evolve its identity management platform to make security, privacy, and compliance easier for global enterprises. The company is solving complex and large-scale identity use cases for global companies, and Aaron will help Auth0 and its customers ensure that they meet the highest levels of security and compliance. 

“In addition to the amazing roster of customers that puts their trust in Auth0 and fuels its growth, I was very much struck by the humanity of everyone I met with—a level of empathy that has been a rarity throughout my career,” said Aaron. “Being a CISO is a very unique job and is one that largely centers around accountability. I am approaching this position at Auth0 with a mission to ensure the optimal security of our platform, as well as be a strong collaborator and partner to both customers and employees alike.”

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Names Jameeka Green Aaron as Chief Information Security Officer

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

Executives are being held to account by regulators and seeking to shape the law

In January 2020, the FTC released a [statement](https://www.ftc.gov/news-events/blogs/business-blog/2020/01/new-improved-ftc-data-security-orders-better-guidance) defining its new position on data security orders, to give companies a clearer understanding of the FTC’s expectations for security practices. The new orders specifically emphasize the role of executives in taking responsibility for overseeing policy, in the hopes that C-Suite and board-level buy-in will improve compliance.

Under the new orders, companies must present their board with an annual report on their security program, and senior officers must directly provide the FTC with certifications of compliance. According to the FTC’s statement, “This will force senior managers to gather detailed information about the company’s information security program, so they can personally corroborate compliance with an order’s key provisions each year.”

The FTC asserts that requiring high-ranking executives to provide certifications under oath has been effective in other sectors, such as securities law since it creates direct accountability for individual executives. They cite two studies that correlate executive involvement in data security with a decrease in breaches, including one that found a 35% decrease in the probability of breaches when a company’s Chief Information Security Officer is in the top management team and has access to the board.

<include src="TweetQuote" quoteText="Find out why the @FTC’s new data security orders will require the C-suite and board to strengthen data security strategies."/>

## Executives Are Influenced by Policy and Are Influencing It

PWC’s [Top Policy Trends 2020](https://www.pwc.com/us/toppolicytrends) report surveyed over 400 CEOs, CFOs, and COOs, and concluded that data is “the unifying thread” across all the major policy areas the C-Suite is concerned within 2020. Specifically, the report highlighted data privacy as a central concern for the C-Suite, with 44% of CEOs listing it as one of the top three policies impacting their business the most.

For the past two years, organizations have been forced to adapt their data policies to a rapidly evolving regulatory landscape, most notably the EU’s [General Data Protection Regulation (GDPR)](https://auth0.com/docs/compliance/gdpr) and the [California Consumer Protection Act (CCPA)](https://auth0.com/resources/whitepapers/simple-guide-CCPA-compliance). Most executives recognize the need for greater regulation on how businesses collect, store, share, and protect sensitive personal data. However, many are also worried that a global patchwork of contradictory regulations could hamstring their ability to operate their businesses across various jurisdictions and hope to work toward more universal standards for data privacy and security. Indeed, of the C-Suite executives PWC surveyed, close to 70% say their organization is “very actively” seeking to shape data privacy policy.

While it’s healthy for executives to help create laws that are informed by the reality of doing business, business leaders must exercise care in attempting to influence legislation, or risk a backlash. A prime example is CCPA, which in its current form is significantly weaker than the original ballot referendum, which would have granted Californians more rights.

While fines under CCPA can still be significant, one of the initiative’s drafters, [Mary Stone Ross](https://www.fastcompany.com/90444501/i-helped-draft-californias-new-privacy-law-heres-why-it-doesnt-go-far-enough), publicly criticized corporate lobbyists for their role in drafting the final legislation. Ross voiced the hope that new laws at the state and federal level would “learn from California and guard against the relentless efforts of corporations to weaken people’s rights.” In the long-term, this negative perception of corporate influence erodes public trust and makes it more difficult for businesses to wield their influence responsibly. Already, [CCPA 2.0](https://www.barrons.com/articles/california-consumer-privacy-act-alastair-mactaggarts-51576779571), which gives consumers more rights and increased enforcement powers, is set to be a ballot initiative in 2020. 
Policy aside, the public at large is increasingly sensitive to businesses whose actions don’t live up to their professed values. When Facebook’s stock tumbled 7% in January, despite strong quarterly revenue, [_The Guardian_](https://www.theguardian.com/technology/2020/jan/29/facebook-fourth-quarter-earnings-stock) suggested that “continuing scandals and regulatory roadblocks may finally be catching up with the social media giant.”

## Strategies for the C-Suite to Lead on Data Privacy
In the second edition of [_Navigating the Digital Age_](http://securityroundtable.org/ndte/ndte2.pdf), published by Palo Alto Networks and the NYSE, experts and executives from across various tech sectors joined together in a clarion call for greater innovation, collaboration, and leadership on issues of privacy and security. Their advice ranges from big picture ideas (the word “moonshot” appears 28 times) to small but crucial suggestions for improvement.

In his chapter, security advisory Marc Goodman advises leaders to pay attention to the UX of cybersecurity, since the design of many legacy security programs is “abysmal and painful.” The design of a pop-up security warning window might seem insignificant, but if it’s all that’s standing between your employee and a catastrophic security mistake, it’s a big deal. Says Goodman: “It’s not enough that our security protocols work in theory; they have to work where the rubber meets the road at the end of a keyboard... And that requires a good understanding of human behavior—something infrequently accounted for in organizational cybersecurity strategies.”

<include src="TweetQuote" quoteText="@FTC ordered the C-Suite and board to get more involved with data security. Why IAM is a strong place to start."/>

One subject that many experts mention as a lynchpin in transforming cybersecurity is authentication. Ann Johnson, Microsoft’s Corporate Vice President of Cybersecurity Solutions, writes that one of the most encouraging current developments in cybersecurity is “the imminent demise of passwords.” This outdated and breach-prone form of authentication is “giving way to biometrics and other steps in multi-factor authentication, making it harder for bad actors to penetrate our firewalls and grab our personally identifiable information, intellectual property, and digital assets of every format.” Of course, experts have been predicting the demise of passwords for ages, but until that day actually comes, it’s crucial to do a better job of securing usernames and passwords.

There’s a growing consensus that sophisticated Identity and Authentication Management (IAM) platforms offer executives a fast and comprehensive way to get control of data and step up security. That consensus is largely responsible for [Auth0’s explosive](https://auth0.com/blog/auth0-closes-103m-in-funding-passes-1b-valuation/) growth in recent years. As [Auth0 customer Rolf Bekkstrand](https://auth0.com/blog/the-real-roi-of-auth0-part-3-security/) attested, “As a CTO, I really don't want to be responsible for a data leak that showed passwords and user logins and those kinds of things. I'm 100% sure that Auth0, a company that is built around this, will have better ability to take care of the security than I'm able to do — your entire business depends on it.”

## To Get Involved With Data Privacy, Start by Getting Educated
For the C-Suite, taking the lead on issues of data privacy and cybersecurity begins with listening. Executives must listen to their users’ concerns, and they must also seek out opportunities for expert education so that they can make informed decisions for their companies.

At Auth0, we pride ourselves on providing not just a cutting-edge IAM platform, but also advice for leaders (whether they’re our customers or not) who are interested in stepping up their approach to security. If you’d like to explore strategies to get your C-Suite up to speed, [reach out to an Auth0 resource](mailto:sales@auth0.com).

The FTC Orders the C-Suite to Get Involved in Data Security

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Pace honored at Washington’s most acclaimed C-Suite executive leadership awards

**BELLEVUE, Wash. – January 30, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced its CEO and Co-founder, Eugenio Pace, was honored at Seattle Business magazine’s [Executive Excellence Awards](http://seattlebusinessmag.com/executive-profiles/winners-2020-executive-excellence-awards), one of the Pacific Northwest’s most prestigious business leadership events, for his exceptional leadership practices and successes in the business community. 

[Pace](http://seattlebusinessmag.com/executive-profiles/2020-executive-excellence-awards-eugenio-pace-co-founder-chief-executive-officer), one of 16 award recipients – along with some of the state’s most respected business leaders from corporations and nonprofits including Zillow Group Inc., Rosetta Stone Inc., Textio, and Washington Women’s Foundation – was honored for his principled leadership practices, and commitment to his team and business community. 

“I am truly humbled to receive this prestigious award and be recognized alongside such a distinguished lineup of professionals, who I look up to for their exemplary leadership,” said Pace. “This award is truly the accomplishment of my entire team – a team that pushes me to be a better leader day in and day out, and never stops pushing boundaries to innovate and deliver only the best to our valued team, customers, and communities.” 

The eighth annual awards ceremony held on January 23, 2020, received nearly 100 applicants this year, a record-breaking year for entries. After a lengthy review process, only 16 individuals were selected by a judging panel based on which leaders have shown outstanding leadership in guiding their companies to success.

“Regardless of industry, successful executives share several traits,” said Seattle Business magazine Editor in Chief Rob Smith. “According to ghSMART's 10-year study of 17,000 C-suite executives, called the CEO Genome Project – featured in Harvard Business Review – top-level leaders excel at four behaviors: the ability to make quick decisions with conviction; achieving buy-in from employees and stakeholders; the ability to adjust to a rapidly changing environment; and producing results.”

The 2020 Executive Excellence Awards are featured in the magazine’s February print issue and online: [http://seattlebusinessmag.com/executive-profiles/winners-2020-executive-excellence-awards](http://seattlebusinessmag.com/executive-profiles/winners-2020-executive-excellence-awards).

## About the Executive Excellence Awards 

The Executive Excellence Awards is considered to be one of the Pacific Northwest’s most prestigious business leadership events of the year. Over the years, this awards program has hosted C-suite executives from companies and organizations such as Starbucks, Amazon, Alaska Airlines, Expedia, Seattle Seahawks, Seattle Symphony, Ste. Michelle Wine Estates, the Bill & Melinda Gates Foundation, and many more.

<include src="asides/AboutAuth0" />

### Media Contacts:
Kaycie East 
Auth0 Communications 
[press@auth0.com](mailto:press@auth0.com)
 
Alexandria Plew 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Eugenio Pace of Auth0 Honored for Executive Excellence by Seattle Business Magazine

joan-pepin

As CSO, Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She brings 20 years of experience to the role, with a career that has spanned a wide variety of industries, including healthcare, manufacturing, defense, ISPs, and MSSPs. Previously, Joan served as Business Information Security Officer (BISO) at Nike, Inc, CISO, and VP of Security at Sumo Logic, and held different positions at Guardent/Verisign/Secureworks organization. Joan holds a patent for developing the methodology to assess whether a communication contains an attack. She is also is a well-recognized thought leader and has spoken at major events, such as RSA, WhiteHat Security Summit, and Forrester Security Summit, and is frequently called upon for her expertise and commentary in Cloud Security and Compliance in large-scale and DevOps/CI environments.

Chief Security Officer (CSO)

Joan Pepin

Auth0 CISO Joan D. Pepin on how we can still apply the security principles that helped Alexander the Great conquer the world

**TL;DR:**
InfoSec hasn't changed in 3,000 years.

## Battle Scene

Imagine an ancient battlefield. One side's general stands on a hill and observes the flow of battle below. He decides he needs one of his chariot commanders to flank around to the west to pin the enemy against a cavalry group coming in from the south.

He takes out his [scytale](https://en.wikipedia.org/wiki/Scytale) (basically an ancient secret encoder/decoder ring) and encodes a message to the commander on a piece of papyrus. He then rolls it up and seals it with his personal seal and a mixture of wax and bitumen and hands it to a trusted messenger.

The messenger runs down the hill, finds the chariot commander and hands him the scroll. The commander checks the seal to authenticate the message and verify it has not been intercepted and then uses his scytale to decrypt it, which also serves as a secondary means of authentication. He then sets fire to the papyrus, and finally, before executing his orders, stabs the messenger, tearing down the session.

And 3,000 years later, that’s still what we care about.

What we saw in the battlefield example was **confidentiality** and **integrity** — the two fundamental principles of security that we care about today. The cipher (or code) helps ensure confidentiality and the wax seal provided integrity.

My point about security is that it's actually very simple in theory. People forget that. The fundamentals of integrity and confidentiality are very straightforward. Viewed through that lens, > 99.999% of infosec is an execution and OpSec problem. We've known the basics for millennia, and we tend to overcomplicate it.

## Modern Examples

Let’s look at two more modern examples, one from the 1980s, which would get us up to the time period of the hit TV show [Stranger Things](https://www.netflix.com/title/80057281) and the other from present day.

![InfoSec Separator 1](https://images.ctfassets.net/23aumh6u8s0i/V1aXIVNxxxsI3quOD96ko/bdeb0616ec5e90edf3cb71eadca0b9fb/infosec-separator-1)

### Stranger Things Era

Back in the 1980s, a kid (Alice) is sick with mononucleosis (mono), so she can’t head to her neighbor Bobby’s house to play chess. Instead, she gets a ball of string from the kitchen junk drawer, ties one end around her bedpost and throws the rest through her neighbor’s screenless (and open) window. Based on past behavior this is a clear invitation for communication. Each kid already has a tin can with a hole in the bottom so they can [create their own telephone.](https://www.wikihow.com/Make-a-Play-Telephone)

The first kid threads her end of the string through the hole and ties a knot. The other kid does the same and then, they each reset their chess boards. Using their tin can phone system, they’ll share moves. Each kid moves their pieces on their board, but only Alice keeps a written log of what gets said. And, because her mom has told her she’s supposed to be resting in bed, she’s going to use a special coder ring, not unlike the one used in Alexander’s time, to make sure her mom can’t read her notes. 

### The Present Day

If that same kid wanted to play chess now, she’d probably grab her smartphone and engage with a friend on the other side of the world via an app — and she could encrypt herself, using the app, or just rely on the phone’s passcode that she’s changed since the LAST time her mother tried to get into her phone.

But either scenario is just like Alexander’s time. 

Confidential and integrity still matter.

In the Stranger Things Era, the chess moves travel from tin can to tin can along a string. If the girl’s mother, Eve, were to tie another string to the middle, maybe she could intercept the conversation, but she’d still have to crack the code.

In the present day, chess moves travel from phone to phone through an app that uses an internet connection. The moves can be discovered if not encrypted or the entire phone could be breached if Alice’s mother discovers the right passcode (say if she had used something easily known, like her own birthday). 

What Alice and Bobby care about is keeping the game secret from Eve — they want confidentiality and they want integrity, just like Alexander. We’ll come back to both examples throughout the series.

![InfoSec Separator 2](https://images.ctfassets.net/23aumh6u8s0i/10fK6PRBFsiPJ1VStd7sKB/7d4db42a36c6aa67290ca15e9f3c7f9b/infosec-separator-2)

## The Pizza Approach to InfoSec Decisions — Next Post

Now once that we’ve secured the information, we can get into who needs to use it, who has a right to use it, and why. And for that, we’ll take a look at “Please Do Not Throw Sausage Pizza Away” and why this is the phrase that tells you all you need to make effective InfoSec decisions, but that’s for the next post.

<include src="asides/AboutAuth0" />

The Alexander the Great Guide to InfoSec for the C-Suite

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

How to protect customer data from internal and external attacks

On September 30, [American Express sent letters](https://media.dojmt.gov/wp-content/uploads/Consumer.pdf) to some of its cardholders, informing them that their personal information had been improperly accessed by a former employee, who apparently tried to use that data to open fraudulent accounts at other financial institutions. Amex has not disclosed how many accounts were compromised but told victims that their account numbers, addresses, dates of birth, and Social Security numbers had been stolen.

While the full scope of this crime is not yet clear, the implications are potentially serious, and not just for Amex. Incidents of data theft and mismanagement are on the rise—just days after the Amex story broke, [Twitter found itself](https://www.forbes.com/sites/emmawoollacott/2019/10/09/twitter-inadvertently-gives-user-security-data-to-advertisers/#29e3e2ea5f63) embroiled in its own user data scandal—and the costs are mounting.

These costs can take the form of lost revenue, lost customer trust, fines issued under new data privacy laws, and the increasing potential for credentials stolen in one attack to be used against other businesses.

Corporate titans such as American Express can weather the storm of a data breach, but SMBs can ill-afford the cost of a breach on their revenue and reputation. Yet despite the risks, many SMBs drastically underestimate the cost of a breach. [According to AppRiver's Q3 Cyberthreat Index for Business Survey](https://www.appriver.com/cyberthreatindexforbusiness/), 67% of respondents estimated a breach would cost less than $25,000. In reality, the average cost is $149,000.

Executives in every industry should take note of this breach and use it as an opportunity to examine their own data security. With that in mind, let’s take a look at what we know about the American Express data theft, how businesses can protect themselves from employee malfeasance, and the potential for stolen data to lead to further breaches

![Image of a credit card secured by a lock](https://images.ctfassets.net/23aumh6u8s0i/3dRPHqHpQRLsWibR1AWvgd/f67cb7415472656e0b9206f5bc071249/credit_lock)

## The Facts (So Far) about the Amex Breach

According to American Express, the employee accused of using cardholder data for identity theft no longer works for the company and is under investigation by law enforcement.

In its letter, Amex assured victims that they won’t be liable for fraudulent charges and offered two years of free Experian identity monitoring. (Ironically, to use that service, victims must disclose their SSNs and addresses to Experian, and some customers may feel uncomfortable trusting that information to credit monitoring services in the wake of the [Equifax breach](https://www.teampay.co/insights/b2b-fraud-schemes/).)

It bears mentioning that this [isn’t the first time](https://www.theregister.co.uk/2016/03/17/american_express_cardholder_data_breach/) American Express customers have had their personal information compromised. However, this breach is somewhat unusual in that it isn’t the result of [accidentally exposed data](https://www.pymnts.com/news/security-and-risk/2018/american-express-india-database-data-breach/) or a malicious intruder posing as a trusted third party but of an actual employee improperly accessing sensitive information.

## How Businesses Can Protect Themselves from Employee Fraud

American Express hasn’t revealed whether the employee responsible for this breach had the appropriate credentials to access unencrypted customer data or how they copied that data for their personal use. Whatever the specific circumstances, identity professionals know the most effective tactics for deterring employee fraud are carefully controlling and monitoring access to sensitive data.

![An image of a consumer using his credit card to buy online](https://images.ctfassets.net/23aumh6u8s0i/5qKdbPEP8YnwRPYcXwTE0x/a5f28025bbad3b6efd01988f2ef393da/creditcard)

[Cloud Identity and Access Management (IAM)](https://auth0.com/learn/cloud-identity-access-management/) is an effective way for cloud-based enterprises to manage access to resources. A good cloud IAM solution functions as a single, centralized resource for admins to grant access to data. With the flip of a switch, you can assign permissions based on what an employee needs for their current task and then revoke it when that task is completed, so valuable information is exposed as little as possible.

All cloud IAM solutions aren’t created equally, however, and you should look at one that lets you proactively keep an eye on employees and identify suspicious behavior. In its report on MFA for e-commerce, [NIST specifically recommends](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/) that businesses “enable system-activity situational awareness by providing dashboards that display account lockout and authentication activity.”

[Auth0’s dashboard](https://auth0.com/docs/dashboard) gives you a comprehensive, bird’s-eye view of user behavior, including customers, third parties, and employees.

[Using Auth0’s Rules](https://auth0.com/docs/rules), you can configure your dashboard to alert admins in the event of suspicious behavior, which you can define according to your needs. For example, you might want to be alerted if an employee continually tries to access sensitive resources unrelated to their work or logs in from a new device or at an unusual time of day.

## Guarding against the Ripple Effects of Data Breaches

The American Express data breach is unlikely to be the last scandal involving credit card companies since they are such high-value targets for thieves. But executives across every industry should understand that breaches such as this don’t just harm the individual company involved; they threaten the entire e-commerce landscape.

Data breaches like this have a spillover effect since hackers often use data stolen in one breach to impersonate users on other sites, a type of attack known as [credential stuffing](https://auth0.com/resources/whitepapers/credential-stuffing-attacks). The best protection against this is [multi-factor authentication (MFA)](https://auth0.com/docs/multifactor-authentication). MFA requires users to prove their identity via means that are more difficult to fake than simple data, such as a fingerprint scan or a one-time code sent to a personal device.

Auth0’s MFA comes with the added security of [breached password detection](https://auth0.com/breached-passwords). Auth0 keeps a constantly updated collection of breached credentials and alerts users if their login information may have been compromised. 

## Don’t Be the Next Casualty of an Amex-Style Breach

For executives, there are already valuable lessons to be learned from the American Express data breach. However, those lessons are unlikely to comfort the victims of this breach or restore their faith in their credit card company. So for now, one truth about this attack is already abundantly clear: when it comes to customer data, it’s better to invest in vigilance than damage control.

<include src="asides/AboutAuth0" />

What the American Express Data Breach Should Teach the C-Suite

Chief Financial Officer and Chief Product Officer join company to support hypergrowth

**BELLEVUE, Wash., Sept. 17, 2019 —** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced Barry Plaga as chief financial officer (CFO) and Shiven Ramji as chief product officer (CPO), two key appointments to the senior leadership team.

[Plaga](https://www.linkedin.com/in/barry-plaga-97204b14/) joins Auth0 as a seasoned CFO with more than two decades of experience overseeing financial and operational functions. Previously, Plaga served as the CFO and COO of Guidance Software, where he oversaw the financial planning, accounting, and treasury functions of the company worldwide, as well as managing investor relations, IT, legal, and operations.

As CPO, [Ramji](https://www.linkedin.com/in/shivenramji) will guide Auth0's product vision, innovation, design, and strategy, and brings more than 15 years of experience in B2B and B2C product management, and business development. Before joining Auth0, Ramji served as the SVP of Product at DigitalOcean, where he led the strategy of DigitalOcean's products, pricing, and partnerships.

"Barry and Shiven bring incredibly deep experience and a proven history of taking fast-growing technology companies to the next level," said Auth0 CEO and co-founder Eugenio Pace. "We are very excited to welcome them to the team, and will leverage their collective expertise to propel Auth0 through its next phase of growth."

<include src="asides/AboutAuth0" />

### Media Contacts

Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Meghan Gardner 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Expands C-Suite with New Executive Appointments

A practical tutorial showing how to use JSON Web Tokens in ASP.NET Core 2 applications.

Securing ASP.NET Core 2.0 Applications with JWTs

685342d5e7f42c3ab8d251d7d4a53308?s=100&d=mm&r=g avatar

685342d5e7f42c3ab8d251d7d4a53308?s=100&d=mm&r=g

Former Auth0 Employee

Robin Percy

Crystal Language claims to be as fast as C and as easy to learn as Ruby.  Here, I put it to the test and give my 2 cents!

Crystal is a statically-typed, compiled, systems programming language with the aims of being as fast as c/c++, while having a syntax as readable as Ruby. This article is an introduction to the Crystal Language, through the eyes of a polyglot programmer. Being a former programmer of both C and Ruby, I have been able to explore the ins-and-outs of Crystal with an objective mindset and give an unbiased opinion on its features; from it's low-level primitives to its familiar syntax, and much in-between.

I first came across Crystal when I saw [@sferik](https://twitter.com/sferik) giving a talk on it in Poland back in 2015. [Video here.](https://www.youtube.com/watch?v=Ysm4IU4aWoQ) It was a great talk, and sparked my interest to Crystal right there and then. When I initially checked out Crystal, I thought it looked awesome but I was too busy with all the other languages I was using on a daily basis to be able to focus my time properly on it.

Alongside being too busy, I couldn't really see why I'd use Crystal instead of using C/Erlang/Go/Ruby - languages that I already knew. What I can say with confidence now though; is that whilst those languages may all be able to achieve the same end-goal they're all *better* in their own, different ways entirely.

When I want to build distributed apps, like my *Fist/Bump Heartbeat Monitor* - I use Erlang/Elixir. When I want to build an API backend I use Golang. When I want to spend the day with my brains scattered, and most probably in tears - I use C. For readibility and demonstrations, I use Ruby. When it comes to writing low-level systems such as daemons and obtuse Kernels, while it would be most performant to turn to C - it'd also take me a **LONG** time to achieve relatively little and the aforementioned tears would be very-likely flowing. *This is where Crystal comes in.*

Having a syntax *very* similar to Ruby means that the familiarity of Crystal is incredibly enticing. Since the world is obsessed with web apps now, let's take a look at the code required to build a minimal web server in both Crystal and Ruby.

In **Ruby**, using *Sinatra*, the code is as follows:

~~~ ruby
require "sinatra"
 
set :logging, false
 
get "/" do
 content_type "text/plain"
 "Hello, Auth0!"
end
~~~

Now in **Crystal**, check out the equivalent code:

~~~ ruby
require "kemal"
 
logging false
 
get "/" do |ctx|
 ctx.response.content_type = "text/plain"
 "Hello, Auth0!"
end
 
Kemal.run
~~~

The fact that you can use Ruby syntax highlighting natively for Crystal says everything! Coming from Ruby to Crystal is a remarkably easy adaptation. The fact is; one copy and paste code from Ruby to Crystal and 90% of the time it will run with no errors. The creators of Crystal understand that Ruby is undoubtedly the most visually appealing language, and therefore built Crystal to take as much influence as possible from a design perspective. You can even run Crystal programs using the `Ruby` shell command and vice versa since the syntax is valid for both languages!


## Binding C

One of the big selling points for Crystal is the ease with which you can interface with C libraries. "Crystal allows you to bind to existing C libraries without writing a single line in C. Additionally, it provides some conveniences like `out` and `to_unsafe` so writing bindings is as painless as possible."

Let's build a simple script in C that says "hi!". We'll then write a Crystal app to bind to our C library. This is a great starting point for anyone who wants to know about binding C in Crystal.

First off, let's create a project with Crystal's scaffolding tool (I'll cover this feature later). Run:

~~~ bash
$ crystal init app sayhi_c
~~~

Then head into the directory `sayhi_c/src/sayhi_c` and let's create a file `sayhi.c` with the following contents:

~~~ c
#include <stdio.h>

void hi(const char * name){
 printf("Hi %s!\n", name);
}
~~~

Now we need to compile our C file into an object. On Ubuntu or Mac using `gcc` we can run:

~~~ bash
$ gcc -c sayhi.c -o sayhi.o
~~~

Using the `-o` flags allow us to create an Object filetype. Once we've got our Object file, we can bind it from within our Crystal app. Open up our `sayhi_c.cr` file, and have it reflect the following:

~~~ ruby
require "./sayhi_c/*"

@[Link(ldflags: "#{__DIR__}/sayhi_c/sayhi.o")]

lib Say
 fun hi(name : LibC::Char*) : Void
end


Say.hi("Auth0")
~~~ 

I'll mention now that there are no implicit type conversions except `to_unsafe` - [explained here](https://crystal-lang.org/docs/syntax_and_semantics/c_bindings/to_unsafe.html) when invoking a C function: you must pass the exact type that is expected.

Also worth noting at this point is that since we have built our C file into an object file, we can include it in the project directory and link from there. When we want to link dynamic libraries or installed C packages, we can just link them without including a path.

So, if we build our project file and run it, we get the following:

~~~ bash
$ crystal build --release src/sayhi_c.cr

$ ./sayhi_c

 > Hi Auth0!
~~~

It's really easy to bind to C in Crystal, and is definitely one of the features that attracts me most to the language. I'm really looking forward to writing a C binding for a useful library and being able to utilise this functionality in production!


## Concurrency Primitives

One of my favourite parts of *Golang* is the `goroutine` threading system. Working in the Database industry, I got a real passion for concurrency &amp; parallelism and when looking to a new language, one of the first things I explore are the concurrency primitives. In Crystal, we can use the `Spawn` functionality in a very similar way to `Goroutines` in Golang, `core.async` in Clojure, or the lightweight threading in Elixir/Erlang.

For a simple test, I wrote two quick scripts to test the Spawn functionality in Crystal alongside Ruby. We all know that Ruby is **not** a great language for threading, so I'm interested to see how much better Crystal is in small experiments. Let's take the following example in ***Ruby***:

~~~ ruby
1000.times.map do
 Thread.new do
 puts "Hello?"
 end
end.each(&:join)
~~~

Running this from terminal I got the following results:

~~~ bash
$ time ruby spawntest.rb

real	0m0.288s
user	0m0.132s
sys	0m0.116s
~~~

I ran this little script on one of my ancient laptops that runs only 2gb of RAM and a terrible, *terrible* processor. Now, porting this script to ***Crystal***, we can write:

~~~ ruby
channel = Channel(String).new
1000.times do
 spawn {
 channel.send "Hello?"
 }
 puts channel.receive
end
~~~

Running this script with the `crystal` command, I got the following results:

~~~ bash
$ time crystal spawntest.cr

real	0m1.129s
user	0m0.952s
sys	0m0.276s
~~~

Hmmmm, very interesting indeed! Well, seen as Crystal is a compiled language and meant to be used to build small binaries that are easily distributed, it'd be a good idea to compile this small script and use *that* data instead! I compiled the script using the `--release` flag - this tells the Crystal compiler to optimise the bytecode.

~~~ bash
$ crystal build --release spawntest.cr

$ time ./spawntest

real	0m0.008s
user	0m0.004s
sys		0m0.000s
~~~

As you can see, this result is markedly different. Using the `--release` flag when building the Crystal executable cuts out a lot of bloating and optimises the executable to be as efficient as possible. Obviously, the above test is a very naive use of the Spawn functionality, and unfortunately, I haven't had the opportunity to test in a load-heavy production environment. But soon I fully intend to, and I'll write another article benchmarking this in detail when I have a good usecase and get the chance to!


## Built-in Tooling in Crystal

One of the things I like most about Crystal is the excellent built-in tooling available. When I look at new languages, especially relatively immature languages; it's always very reassuring when the language has extensive built-in tooling available to help developers stay productive &amp; happy! In Crystal, there are a bunch of tools that make hacking around in the language super fun, but also help us to stay on the right track with semantics etc.

#### Testing

If you're coming from a Ruby/Rails background, I think you'll be ***very*** happy with the built-in testing framework that ships with Crystal. It's rather reminiscent of *RSpec*, and will be really easy to use for anyone coming from a similar background. Even if you're not from a Ruby/Rails background, it's a great testing tool and is super effective.

Using the `Greeter` demo app from the Crystal docs, we could write our Specs as follows:

~~~ ruby
require "spec"
require "../lib/greeter" # demo greeter class

describe Greeter do
 describe "#shout" do
 it "returns upcased string" do
 Greeter.new.shout('hello auth0').should eq "HELLO AUTH0"
 end
 end

 describe ".hello" do
 it "returns a static Hello string" do
 Greeter.hello.should eq "Hello"
 end
 end
end
~~~

As you can see, this spec should look *very* familiar to any Rubyists, and is becoming the more preferred syntax for application testing across many languages - there being RSpec clone libraries across most languages now!

#### Project Scaffold

Much the same as Elixir having the `Mix` manager, and Erlang the `Rebar` manager, Crystal has it's own built-in project scaffolder &amp; package manager. I'd recommend using this at all times to ensure sematics are followed. We can use it with the following:

~~~ bash
$ crystal init lib my_cool_lib
 create my_cool_lib/.gitignore
 create my_cool_lib/LICENSE
 create my_cool_lib/README.md
 create my_cool_lib/.travis.yml
 create my_cool_lib/shard.yml
 create my_cool_lib/src/my_cool_lib.cr
 create my_cool_lib/src/my_cool_lib/version.cr
 create my_cool_lib/spec/spec_helper.cr
 create my_cool_lib/spec/my_cool_lib_spec.cr
Initialized empty Git repository in ~/my_cool_lib/.git/
~~~

#### Sharding

No - not creating Database Shards (luckily)! Shards are Crystal's packages distributed in the same way as Ruby Gems, Elixir Libs or Golang packages. Each application we create contains a file in the root directory named `shard.yml`. This file contains project details and external dependencies. The `shard.yml` file in my `sayhi_c` app above looks like this:

~~~ yml
name: sayhi_c
version: 0.1.0

authors:
 - Robin Percy <robin@percy.pw>

targets:
 sayhi_c:
 main: src/sayhi_c.cr

crystal: 0.22.0

license: MIT
~~~

The app I built has no dependencies to use, but if we want to include external packages we can do so by adding them at the bottom of the file:

~~~ yml
dependencies:
 github:
 github: felipeelias/crystal-github
 version: ~> 0.1.0
~~~

#### Documentation & Formatting

Crystal has a great built-in tool for generating documentation and formatting files. The documentation that is generated is excellent - built-in html/css and almost instantly ready to deploy.

To generate documentation, from the project root directory we can simply run:

~~~ bash
$ crystal doc
~~~

This will create a docs directory, with a doc/index.html entry point. All files inside the root src directory of the project from which we ran the command will be considered.

Alongside this, the built-in *Formatter* tool is a great feature of the language. We can run the formatter over our project by running:

~~~ bash
$ crystal tool format
~~~

We can use this tool to unify code styles and to submit documentation improvements to Crystal itself. The formatter is also very fast, so very little time is lost if you format the entire project's codebase instead of just a single file.

*Both of these features are very cool, and highly useful!*

## What I don't like

Like anything in this world, Crystal can't possibly be perfect! There are two ***very*** small issues that I find with it...

As a Polyglot programmer, I've had to learn a bunch of different programming paradigms. While this isn't a fault in Crystal, the fact that it's object orientated is pretty much the only thing I'm not too keen on in Crystal. Other than that; being a relatively young &amp; immature language, there's often a lack of documentation available when you want to do something incredibly specific.

Seeing this as an opportunity instead of a foible - it's actually kind of cool, because this means we can write documentation ourselves and hack sample apps together to become early adopters and decent contributors in the Crystal community!


## Aside - Auth0 & JWTs in Crystal 

**Update:** - I have written about [securing a Crystal web app with Auth0 &amp; JWT's here.](https://auth0.com/blog/building-your-first-crystal-app-with-jwt-authentication/)

At the moment, there is no Crystal-Auth0 library to use for end-to-end application securing. However, there *is* a JWT library available for Crystal already [here](https://github.com/greyblake/crystal-jwt).

One thing to note here is that the Crystal-JWT library does not yet support the `RS256` algorithm, which is the preffered algorithm and only supports the `HS256` algorithm. When setting up your application in the Auth0 control panel, make sure to select the `HS256` algorithm to reflect this.

In my next series of articles, I will be writing specifically about using Auth0 in a ***NON-jwt*** context, and I'll make sure I demonstrate this in Crystal!

Of course, if you're looking to secure a Crystal-based web app, you can always simply use the [Auth0 Centralised Login](https://auth0.com/docs/hosted-pages/login). The Centralised Login will allow you to have immediate drop-in user management functionality.

## Conclusion

**I really rather like it!**

Although relatively immature, Crystal is a promising language with a growing Dev community surrounding it. In my previous article about Auth0 Lock / Iris Image Recognition, I mentioned the fact that it'd be better to use the pHash / Blockhash libraries for a production environment. If I was to build that system, I would most definitely use Crystal to bind to those C libraries. I know that I'd be getting fantastically close-to-C speeds, and with the ease and joy of writing Crystal!

I am very much looking forward to seeing where this language goes. I think the adoption rate will rapidly increase and I'm excited to see startups using it in production systems. I am currently experimenting in building a Crystal library for the Auth0 API. I will write another article on building an API client in Crystal when I'm finished.

I do hope this article has inspired you to give Crystal a try, and look forward to hearing your feedback if/when you do! If you need any help and want to ask questions, [reach out to me via email](mailto:robin@percy.pw) and [@rbin](http://twitter.com/rbin) on twitter, I'm happy to help!

## Handy Resources

 - [https://github.com/veelenga/awesome-crystal](https://github.com/veelenga/awesome-crystal) 
 - [https://play.crystal-lang.org/#/cr](https://play.crystal-lang.org/#/cr) 
 - [https://www.reddit.com/r/crystal_programming/](https://www.reddit.com/r/crystal_programming/) 
 - [http://kemalcr.com/](http://kemalcr.com/)

The Highs & Lows of Crystal - an Introduction to Crystal Lang

Jon Gelsey

Company revenue grows 3x year-over-year as customer base extends across multiple industries. Auth0 will use the new funds to double down on security, extensibility and simplicity.

**BELLEVUE, WA** — (Marketwire, June 27, 2017) - [Auth0](https://auth0.com/about), the leading Identity as a Service platform, today announced it has raised $30 million in a Series C financing led by late-stage investor [Meritech Capital Partners](http://www.meritechcapital.com/) and that George Bischof, Managing Director at Meritech Capital Partners, has joined Auth0’s Board of Directors. All existing major investors also participated, including Bessemer Venture Partners, Trinity Ventures, and K9 Ventures. NTT DOCOMO Ventures, Japan’s largest mobile carrier, and [Telstra Ventures](https://telstraventures.com/), the venture capital arm of Australia’s largest mobile carrier, participated as well, endorsing the easy-to-integrate enterprise scale platform that secures billions of logins every year. Auth0 will use the funds to further expand its geographic footprint, and to accelerate the growth of its identity platform with an increased subscriber and talent acquisition focus. 

“Identity has become even more mission critical as businesses become increasingly digital. In our dozens of calls with customers, it was clear that Auth0’s value proposition is resonating in the market. Developers can leverage Auth0’s extensible and easy to integrate identity platform and free up their cycles to work on the core application,” said George Bischof, Managing Director at Meritech Capital Partners. ”Auth0 subscriber adoption is exponentially expanding and we are excited to support their rapid growth.”

![Auth0 Board of Directors](https://images.ctfassets.net/23aumh6u8s0i/4Q2T2wz8ufCArbORCAeowl/3a9966211a214369b99e4baa258ebfe3/about-bod)

Funding comes as Auth0 caps off a yet another year of record growth, which saw revenue increase by nearly 3x year-over-year as the company added 1,250 new companies to its worldwide subscriber base across multiple industries. New customers include Atlassian (SaaS), News Corp (Media) and Houghton Mifflin Harcourt (Publishing). The company has also opened an office in London to serve the EMEA region, announced that it will open an office in Sydney, doubled employee headcount, and launched the [Auth0 Extend](https://auth0.com/extend/) product line, a new Serverless extensibility platform. The Series C funding will help Auth0 further extend its reach as an identity-as-a-service platform, offering deep identity security features, doubling down on simplicity and extensibility, as well as adding new features to the platform to better suit the needs of modern enterprises.

“At this time of constant threats and data breaches, modern enterprises require the strongest possible identity solution. Furthermore, in these new times, companies are racing to bring new products to market and facing both intense pressure to grow revenue and customers as well as fierce competition. They need to consolidate all their identity needs in one single end-to-end platform that works out of the box and can be easily extended to support all applications and use cases,” said Jon Gelsey, Auth0 CEO. “We are honored by the confidence placed in us by our investors, as well as by the trust displayed by our subscriber base as we seek to accelerate their business goals. Our subscribers are among the [most sophisticated enterprises](https://auth0.com/customers) in the world, and they continually drive and inspire us to create an even better set of services.”

Auth0 is an enterprise-grade platform for modern identity. It provides companies with a service that eliminates the complexity of authentication for applications and APIs, all accessible through a developer friendly dashboard. Their technology makes it easy to implement even the most complex identity solutions for their web, mobile, and internal applications and APIs.

<include src="asides/AboutAuth0" />

## About Meritech Capital Partners

Meritech Capital Partners is a leading provider of late-stage venture capital to category- defining private technology companies, and has been one of the top performing venture firms of the past decade. With over $3 billion under management, Meritech leads investments into companies with proven and differentiated technology, rapidly-growing revenue and experienced management teams. Meritech investments in industry-leading companies include Box, Cloudera, Cornerstone OnDemand, Coupa, Facebook, Fortinet, Mulesoft, NetSuite, Proofpoint, PopCap, Salesforce.com, Sourcefire, Tableau and Zulily. Meritech is located in Palo Alto, CA and can be found at [www.meritechcapital.com](http://www.meritechcapital.com). 

For more information visit [https://auth0.com](https://auth0.com) or follow [@auth0 on Twitter](https://twitter.com/auth0).

Cloud Identity Leader Auth0 Adds $30 Million Series C

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Learn how to handle authentication on ASP.NET Core applications

ASP.NET Core Authentication Tutorial

7752008352217db815996ab04aec46e6?s=80 avatar

7752008352217db815996ab04aec46e6?s=80

Guest Author

Matias Quaranta

Document your ASP.NET Core Web APIs with Swagger and auto-generate authenticated clients quickly and easily with Autorest.

ASP.NET Core APIs in the fast lane with Swagger and Autorest

6222081fd7dcea7dfb193788d138c457?s=60 avatar

6222081fd7dcea7dfb193788d138c457?s=60

Jerrie Pelser

Learn how to use the new OAuth middleware in ASP.NET Core to authenticate a user.

Authenticating a user with LinkedIn in ASP.NET Core

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Prosper Otemuyiwa

Learn how to build a Native Desktop C# app and easily get up and running with JWT authentication.

Adding Authentication to a Native Desktop C# App with JWTs

f7144da08aeb41a93256f8ae88f507d2?s=64 avatar

f7144da08aeb41a93256f8ae88f507d2?s=64

Ajden Towfeek

This is a guest post by Ajden Towfeek. Ajden is a full-stack developer with focus on Microsoft technologies with 10+ years of experience in commercial software development.

_This is a guest post by Ajden Towfeek. Ajden has worked on everything from embedded devices to large scale enterprise systems during his 10+ years in commercial software development. Since 2007, Ajden has focused on Microsoft technologies and more lately on web technologies. Ajden is also a speaker at conferences and has a passion for teaching. He is a frequent blogger on [http://towfeek.se](http://www.towfeek.se), and you can follow him on twitter [@ajtowf](https://twitter.com/ajtowf). For screencasts on the latest web technology, make sure to check out his [youtube channel](https://www.youtube.com/c/AjdenTowfeek)._

-------------

# Pluralsight Course

I've created a [pluralsight course](http://www.pluralsight.com/courses/authenticating-angular-spa-aspnet-webapi-auth0) on how to implement Auth0 in an AngularJS application going against an ASP.NET WebAPI backend. Using Auth0 is a pluralsight first and so far it's performing well with good rating. Make sure to [check it out](http://www.pluralsight.com/courses/authenticating-angular-spa-aspnet-webapi-auth0) if you have a pluralsight subscription, otherwise I'm hoping the promotional video below can make you get one. 

-------------

<iframe width="640" height="480" src="https://www.youtube.com/embed/gPkhM1GwVYA?rel=0&vq=hd720" frameborder="0" allowfullscreen></iframe>

# Table of contents

The course is split into the following three modules:

* **An Introduction**: Course introduction with brief overview of Auth0, where we also register for a free developer account.
* **Building the Back-end API**: In this module we create the back-end and secure it with Auth0, we also test our API by making secure calls with postman.
* **Building the Front-end SPA**: In this module we create the front-end using AngularJS to communicate securely with our back-end. We use Auth0Lock to get a professional looking login dialog that displays well on any resolution and device.

# Why do a course on Auth0?

First of all, I'm new to using Auth0 as a service, I stumbled upon it when trying to find a quick to implement solution for a client I was working with a couple of months ago. I was amazed by how fast we were up and running and could move on to writing the business logic. Unfortunately, that particular client didn't end up using Auth0 in production for various reasons but I'm currently discussing the possibility of using Auth0 for user management with a new client. 

Aside from consulting I also teach and speak at conferences and to strengthen my brand I decided to try out for becoming a pluralsight author. The [audition](https://youtu.be/QjAfgfTZfho) went well, but angular 2 was off the table since it's still in alpha. When browsing the pluralsight library I noticed there was nothing on Auth0 there, so why not be the first one to contribute with an Auth0 course?

I've also added an Auth0 session to my ASP.NET classroom training after going through ASP.NET Identity to show how identity can be implemented even simpler, and the student reactions to how simple it is to use has been really positive. 

# Working with the Pluralsight team

From the initial contact with the audition to working close with my editor on the course, pluralsight was super professional. I really enjoyed the experience, and I definitely encourage other developers to go through the experience of creating a course. Even if I have some experience from creating [screencasts on youtube](https://www.youtube.com/c/AjdenTowfeek) this was something entirely different.

# Conclusion

After 30 hours of recording and editing the course was finished and it's now live, make sure to [check it out](http://www.pluralsight.com/courses/authenticating-angular-spa-aspnet-webapi-auth0). Auth0 is an awesome service and I'll definitely recommend it to future clients and keep teaching it in my class room training.

<include src="TweetQuote" quoteText="Auth0 is an awesome service and I'll definitely recommend it to future clients."/>

Pluralsight Course on using Auth0 with AngularJS and ASP.NET WebAPI

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

In this tutorial learn how to integrate LDAP and Active Directory (AD) with your C# projects

"c#"