Skip to main content

#aspnetcore

Log entries with this tag, newest first.

  1. Decision recordRealtime transports

    SignalR between a cloud and its sites

    A hub that pushes changes from a cloud to on-premises sites is a security boundary and a lifecycle problem: who may connect, what each connection hears, how long an admission holds, and how a client comes back after the server closes it. The design note: a service-client policy, a group per tenant, a fifteen-second sweep with the same check requests get, and a client that starts itself again because automatic reconnect does not follow a server-side Abort.

    8 min read

  2. Decision recordRealtime transports

    Server-Sent Events in ASP.NET Core 10, and when to pick them over SignalR

    When a server talks and a client listens for the length of one request, Server-Sent Events is the right transport: plain HTTP, one direction, a text protocol a proxy carries and a browser reconnects by itself. .NET 10 made it a first-class result. The parts that bite are on the client: the protocol has rules, and some servers decide per response whether to answer with JSON or with a stream.

    7 min read

  3. Decision recordMulti-tenant platforms

    The tenant comes from the token, not from the header

    In a multi-tenant API the tenant a request acts in is decided from who is calling. A header may name one; the token says whether the caller may act there. The decision record: one middleware owns the header, the status code follows the caller, and authority that arrives through a replicated directory is trusted for one token lifetime.

    9 min read

  4. Decision recordIdentity and access

    When the token store is down, the honest answer is 503

    A resource server that cannot check a token must refuse it, and a 401 is the wrong refusal: it tells the client its token is bad and signs the user out. The design: fail closed, classify the fault by what the data provider says, answer 503 with a Retry-After drawn per response, and let anonymous routes ask before they say 'not signed in'.

    7 min read

  5. Decision recordIdentity and access

    Decide from the endpoint, not from the path

    Rate limits, security headers and access gates are per-endpoint decisions. ASP.NET Core accepts several spellings of one path, so a decision made by comparing the path is a decision made on incomplete information. Put it on the endpoint, and test that every endpoint is covered.

    6 min read