JWT

Apply rate limits and abuse throttles to APIs

Explains rate-limit identity, endpoint cost, login and suggestion throttles, Redis counters, user experience, and observability.

Audit privileged admin actions

Explains why sensitive admin actions need authorization, reason capture, before/after context, and tamper-resistant audit records.

Authenticate service-to-service API calls

Explains API keys, client credentials, managed identity, mTLS, scopes, rotation, and per-client observability.

Authentication vs authorization in ASP.NET Core APIs

Separates identity establishment from permission decisions and applies ASP.NET Core schemes, policies, tenant boundaries, ownership checks, and correct challenge or forbid behavior.

Authorize tenant-scoped API requests

Explains trusted tenant context, membership checks, tenant-scoped queries, cache keys, and background job propagation.

Compare access tokens and refresh tokens

Explains short-lived access tokens, refresh-token rotation, revocation, storage choices, and replay detection.

API Security & Auth

Authentication, authorization, tokens, tenant boundaries, and API protection.

A practical API security track covering login flows, JWT validation, refresh tokens, session revocation, external identity providers, roles and capabilities, resource ownership, tenant isolation, policy authorization, admin audit, stale claims, service-to-service auth, CORS, CSRF, rate limiting, overposting, safe errors, secrets, and browser-facing security controls.