2 weeks ago, I went to sleep at the same time as my 2 kids.
It sounded good on paper:

1. Fall asleep before 9 PM.
2. Wake up in the morning full of energy like a young bull.

But in reality?

I couldn’t sleep.

I was tossing and turning in bed like a fish out of water.
I resisted the temptation of using my phone until 10 PM. But then I started to scroll on Reddit.

As I was scrolling, I found this question:

“What are some of the craziest security vulnerabilities you've uncovered?”

And this in particular stood out:

“I can manually create a dummy client that shares the target's email address and … I can use the switch account feature to jump into the target account. From there, the billing information is easily accessible, with the full card number shown and everything.”

​

Sigh.

Of all the sins a .NET developer can commit, neglecting security is the deadliest.

But it's even worse if you implement everything on your own.

Why?

Because it can hurt the most.

Every mistake you make while building a custom security solution can lead to:

• Data breaches
• Financial losses
• Reputation damage
• Legal consequences
• Intellectual property theft

Depending on a company's size, a screw-up related to security can cost the company millions of dollars.

Security is hard. But it’s bloody important.

​

My recommendation?

Use existing authentication libraries. ASP.NET Identity, Auth0, Azure AD…

Some of the biggest companies and many developers continuously maintain, test, and upgrade them. Those libraries also come with built-in protections against common security attacks.

You benefit in a few ways:

• Security - Teams who specialize in security develop these libraries.
• Time - You don’t have to spend weeks building something and covering all edge cases.
• Compliance - Auth libraries often follow the latest security and compliance standards.
• Scalability - They can support a growing number of users with little or no issues.

Using proven solutions means you can focus on delivering real business value.

Instead of battling complex security problems.

Enjoy your weekend.

Kristijan

​

​
​P.S.

The only downside of picking an existing solution?

There are so many of them. And the whole implementation process can be overwhelming.

But even when you turn to Microsoft internal solutions, the documentation doesn’t show you all the steps in an easy, clear, and organized way.
​

That’s why security is one of the main pillars of the Backend Brilliance: Architect and Build Professional .NET Applications course I’ve recently published.

In fact, there is a whole module dedicated to the Web API security.

Throughout the course, you will gradually build an e-commerce app with the following features:

• Enhanced product functionality
• Shopping cart functionality
• Order checkout
• User registration and login

But I also cover in the above-mentioned module 3:

• What is the simplest, and yet feature-powerful auth library you can pick?
• How to implement authentication and authorization?
• How to write API tests for protected endpoints that require user registration and login?
• How to manage user roles and restrict access based on them?
• What is the easiest and most effective way to prevent one user from accessing another user’s sensitive information?

​

Read more about the course here: https://www.backendbrilliance.net/​

​
​