API Security and Auth

Apply rate limits and abuse throttles to APIs

Explains rate-limit identity, endpoint cost, login and suggestion throttles, Redis counters, user experience, and observability.

ASP.NET Core authentication schemes, challenge, and forbid

Explains how ASP.NET Core schemes select handlers and why authenticate, challenge, and forbid produce different security behavior.

Audit privileged admin actions

Explains why sensitive admin actions need authorization, reason capture, before/after context, and tamper-resistant audit records.

Authenticate service-to-service API calls

Explains API keys, client credentials, managed identity, mTLS, scopes, rotation, and per-client observability.

Authorize tenant-scoped API requests

Explains trusted tenant context, membership checks, tenant-scoped queries, cache keys, and background job propagation.

Compare access tokens and refresh tokens

Explains short-lived access tokens, refresh-token rotation, revocation, storage choices, and replay detection.

API Security & Auth

Authentication, authorization, tokens, tenant boundaries, and API protection.

A practical API security track covering login flows, JWT validation, refresh tokens, session revocation, external identity providers, roles and capabilities, resource ownership, tenant isolation, policy authorization, admin audit, stale claims, service-to-service auth, CORS, CSRF, rate limiting, overposting, safe errors, secrets, and browser-facing security controls.