Start Debugging

Tag: security

18 posts · Page 1 of 2

2026-07-26 ai-agents claude-code cursor

How to Lock Down a Coding Agent's Network Egress With a Strict Host Allowlist

Claude Code, Cursor, and the GitHub Copilot coding agent all ship host allowlists for outbound traffic, and all three default to something looser than you want. The exact settings keys, a policy you can copy, and the four surfaces the allowlist does not cover.

2026-07-17 aspnetcore dotnet-11 security

ASP.NET Core 11 Preview 6 turns on automatic CSRF protection

Preview 6 rejects unsafe cross-origin browser requests by default, reading the Sec-Fetch-Site header instead of an antiforgery token. Here is what it blocks and how to opt out.

2026-07-03 cursor ai-agents security

DuneSlide: Two Cursor Bugs That Turn Prompt Injection Into Zero-Click RCE

Cato AI Labs disclosed CVE-2026-50548 and CVE-2026-50549, a pair of 9.8 CVSS flaws in Cursor's terminal sandbox. A poisoned MCP response or web result can escape the sandbox and run code. Cursor 3.0 is the fix.

2026-07-03 csharp dotnet dotnet-11

How to set up JWT bearer authentication in a minimal API in ASP.NET Core 11

A complete, working setup for JWT bearer authentication in an ASP.NET Core 11 minimal API: install the package, wire up AddAuthentication().AddJwtBearer(), issue a token, protect endpoints with RequireAuthorization, add role and claim policies, and test the whole thing with dotnet user-jwts.

2026-06-26 comparison aspnetcore dotnet

JWT vs cookie authentication in ASP.NET Core 11: which should you pick?

Use cookie authentication for any app where the browser is the only client, and reserve JWT bearer tokens for APIs called by mobile apps, other services, or third parties. Here is the full decision matrix.

2026-06-25 claude-code ai-agents security

Claude Code 2.1.187 Stops the Sandbox From Reading Your AWS Keys

The new sandbox.credentials setting in Claude Code v2.1.187 denies reads of credential files and unsets secret env vars before sandboxed Bash commands run. Here is why the default read policy was a hole, and how to close it.

2026-06-25 errors csharp dotnet

Fix: 405 Method Not Allowed instead of 401 with JWT bearer in ASP.NET Core

A protected endpoint returning 405 instead of 401 almost always means routing rejected the HTTP verb before auth ran, or a cookie scheme stole the challenge. Here is how to tell which.

2026-06-25 csharp dotnet dotnet-11

Why your ASP.NET Core JWT returns 401 even with a valid token

A valid token that still 401s almost always means the bearer handler never ran or ran under the wrong scheme. Check middleware order, the default scheme, the scheme name, and whether the header even reached the handler.

2026-06-25 microsoft-agent-framework ai-agents dotnet

How to add policy enforcement and audit logging to a Microsoft Agent Framework agent

Wire the Agent Governance Toolkit into a Microsoft Agent Framework 1.0 agent so every tool call is checked against a YAML policy and written to a tamper-evident audit trail. Full C# middleware, policy file, and a hash-chained audit sink.

2026-06-22 csharp dotnet dotnet-11

How to validate a JWT's issuer, audience, and lifetime in ASP.NET Core 11

A complete guide to TokenValidationParameters in ASP.NET Core 11: how ValidateIssuer, ValidateAudience, and ValidateLifetime work, what the defaults actually are, why Authority auto-configures the issuer and signing keys, the 5-minute ClockSkew trap, and how to read the IDX error codes when a valid-looking token is rejected.