Browse .NET Blogs (15)

Andrew Lock introduces CBOR as a compact binary alternative to JSON and explains where it fits compared to formats like Protobuf and MessagePack. He then demonstrates how to read and write CBOR in .NET using the low-level System.Formats.Cbor APIs, including conformance modes and practical decoding patterns.

Khalid Abuhakmeh shows how ASP.NET Core 11 can localize Minimal API validation errors using Microsoft.Extensions.Validation and standard resx resources, without FluentValidation or custom endpoint filters. The post includes a working Program.cs setup, resource key conventions, and an integration test harness that verifies responses across multiple cultures.

Khalid Abuhakmeh shows how to replace ASP.NET Core Minimal API JSON output with the REDox serializer by implementing a custom IResult, then benchmarks REDox vs System.Text.Json to see whether serializer speedups translate into faster HTTP endpoints.

Khalid Abuhakmeh explains how C# 15 extends collection expressions with a new `with(...)` element, letting you pass constructor arguments (like comparers and capacity) without giving up the `[a, b, c]` syntax.

Khalid Abuhakmeh shows how to use C# 15 union types on .NET 11 to model a workflow as a single state value plus one Next method, with exhaustive switch expressions and typed inputs/results. He also covers how to persist and rehydrate workflow state using System.Text.Json with an explicit discriminator.

Khalid Abuhakmeh explains how Directory.Build.props lets you set shared MSBuild defaults (like Nullable, LangVersion, and analyzers) once for an entire .NET solution, how nested files behave, and when to switch to Directory.Build.targets or Directory.Packages.props for late-bound logic and centralized package versions.

Andrew Lock shows how to shrink a .NET NativeAOT binary by using ILLink.Substitutions.xml to replace a runtime-only property with a compile-time constant, letting the linker remove an otherwise “reachable” dependency chain (including Azure.Identity and MSAL) and cutting output size by roughly 22–25%.

Khalid Abuhakmeh breaks down three built-in ways to convert strings to integers in C#: int.TryParse, int.Parse, and Convert.ToInt32. He explains when each is appropriate, what exceptions to expect, and how culture and number formatting (like thousands separators) can make parsing fail.

Khalid Abuhakmeh maps familiar Ruby on Rails concepts (conventions, Action Pack, Hotwire, Active Record, Sidekiq, and the Rails CLI) to their closest ASP.NET Core and .NET equivalents, with practical guidance on choosing MVC vs Razor Pages vs Minimal APIs, EF Core patterns, and background job options.

Andrew Lock walks through the new experimental Device Bound Session Credentials (DBSC) support in ASP.NET Core for .NET 11, showing how to harden cookie authentication (including ASP.NET Core Identity) against session hijacking and what the registration/refresh protocol looks like in practice.

Rick Strahl explains why files under ASP.NET Core’s wwwroot are public by default, and how to protect dynamically generated “static” files (like admin logs) so they still respect authentication and authorization rules.

Andrew Lock digs into .NET 11 preview 7’s new union types and closed class hierarchies, focusing on where System.Text.Json serialization and deserialization fall over. He shows the default behavior, the exceptions you’ll hit with inferred polymorphism, and the workarounds using JsonDerivedType and custom union type classifiers.

Andrew Lock shows how to get the total logical CPU count on a host machine (not just the CPUs available to the current process) in modern .NET. The post compares `Environment.ProcessorCount` behavior across runtimes and provides a cross-platform helper using P/Invoke on Windows/macOS and file parsing on Linux.

Andrew Lock explains the new CSRF protection in ASP.NET Core (.NET 11 preview 6) that uses Fetch Metadata HTTP headers instead of synchronizer tokens, including how the middleware decides to allow or deny requests and what changes (if any) app authors need to make.

Andrew Lock explains the browser Fetch Metadata request headers (Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, and Sec-Fetch-User), what their values mean, and how servers can use them to spot suspicious cross-origin requests and add another layer of CSRF defense alongside tokens and SameSite cookies.