Duende Software Official Site

Defending against credential stuffing attacks is a critical component of modern IdentityServer best practices, yet many developers rely on outdated password policies. A password like Tr0ub4dor&3 passes every complexity rule you can think of: uppercase, lowercase, digits, and a symbol. But if it appeared in a single data breach three years ago, attackers have it in their lists ri...

On July 14, 2026, Microsoft released the .NET July 2026 security updates, shipping .NET 10.0.10, 9.0.18, and 8.0.29. This is a big one: 17 security advisories in a single Patch Tuesday, covering the runtime, ASP.NET Core, and the SDK.

You've written reloadOnChange: true more times than you can count. You've used IOptionsMonitor to pick up fresh configuration without restarting your app. Maybe you've tied a cache entry's lifetime to a file on disk. All of those features share a common mechanism under the hood: ChangeToken, a type in Microsoft.Extensions.Primitives package that has been quietly running your rea...

Every test you write needs a place to run. Before the assertions fire, before the snapshots compare, before a single line of application code gets exercised, something has to discover your tests, spin up the runtime, manage parallelism, and report results. For most .NET developers, that something is xUnit.net, and it’s so good at its job that you probably never think about it.

If you're building OAuth 2.0 authentication for a Model Context Protocol (MCP) server, you've likely hit a wall: your server binds to a random port at startup, but IdentityServer's default redirect URI validation requires an exact match. http://127.0.0.1:12345/callback is not the same as http://127.0.0.1:54321/callback, and the authorization request fails.