Andrea Chiarelli

Software Engineer and Technical Author i.e. Continuous Learner @auth0 by @okta | Microsoft MVP | Identity, .NET, API, Web, JavaScript, DevRel, DX

[Andrea Chiarelli @andychiare]

It's not easy to describe what a developer advocate does, so I wrote this booklet to explain it to anyone who's interested (and to clarify it for myself, too).

Download it now and let me know what you think! It's free! 👇

https://t.co/gKiFeyyD45

[Carla Urrea Stabile @CarlaStabile]

this month's in the last episode for this season of the Making Software podcast.

i have an idea of what topic i'd like to discuss but i'd love to hear from folks here:

who should be the last guest of the year?
what should we talk about?

[Dmitry Pavlov @dr_dimaka]

Learn what’s new in .NET 11 regarding authentication and authorization.

https://t.co/RRD9QNFPnA by @andychiare via @auth0 #Authentication #Authorization #dotNET

[Andrea Chiarelli @andychiare]

Your SignalR connection outlives your access token.

.NET 11 finally lets the client refresh it without reconnecting.

See that and the rest of what's new for auth* in .NET 11: https://t.co/5nTY2zgwEA

[Andrea Chiarelli @andychiare]

Your SignalR connection outlives your access token.

.NET 11 finally lets the client refresh it without reconnecting.

See that and the rest of what's new for auth* in .NET 11: https://t.co/5nTY2zgwEA

[Andrea Chiarelli @andychiare]

Blog post series: https://t.co/Kn6Z247JDM

Video playlist: https://t.co/UoGhKwoOvd

[Andrea Chiarelli @andychiare]

Some time ago, I launched 'The Confused Developer' series on the @auth0 blog to demystify key tech concepts:

- ID vs. access tokens
- URLs vs. URIs
- AI tools, skills, & MCP

My team also produced great video adaptations! 🎥

Links to the series and videos below👇

[Carla Urrea Stabile @CarlaStabile]

frontier model plans, local model builds, feature costs €1 instead of €20 and more in the conversation i had with @deepu105, where he also explains his whole setup

[Auth0 @auth0]

An attacker chains a few small flaws and mints an admin token out of thin air. No password.

Five minutes later: one plugin, one backdoor, gone.

The team patches fast. Does everything right.

It doesn't matter. 🎃

[Auth0 @auth0]

OAuth and OIDC got you drawing arrows on a whiteboard?

Identiflows puts identity flow diagrams and walkthroughs in one place.

Check it out: https://t.co/QyVGBXavYQ

[Andrea Chiarelli @andychiare]

The AI version of Murphy's law:

"An AI agent that can do something, sooner or later it will do that (and it will go wrong)"

[Andrea Chiarelli @andychiare]

New tutorial: Secure your ASPNET Core Minimal API with the @auth0 API SDK!

Get custom domains, DPoP support, and full JwtBearer flexibility.

Check it out: https://t.co/gL3fDZiidh

[Andrea Chiarelli @andychiare]

@CarlaStabile Curious to learn about its answer :-)

[Tore Nestenius @Tndata]

Many developers treat OpenID Connect as a black box until something breaks.

My second Dometrain course is live. It breaks apart the flows, JWTs, token signing and PKCE.

Thanks @nickchapsas and @dometrain

https://t.co/tiTuvzcHM2

#OpenIDConnect #OAuth #OIDC #Dometrain #MVPBuzz

[Andrea Chiarelli @andychiare]

"On-Behalf-Of" (OBO) names a pattern.
OAuth Token Exchange (RFC 8693) is the standard that formalizes it.
Microsoft's OBO flow predates it and isn't RFC 8693-compliant.

Why that distinction matters for AI agents: https://t.co/wINywKcuzC

[Andrea Chiarelli @andychiare]

I’ve just released a new version of https://t.co/nESxmPs1VS (even though it’s Friday).

A new look and feel, new diagrams (though many are still missing).
As always, your feedback is very welcome.
Enjoy!
https://t.co/9YLZfJ2y70

[International Cyber Digest @IntCyberDigest]

Regarding the Danfoss refrigeration systems hacked in France:

The username is `admin`, and the password automatically changes every day to... the current date.

Yes, today's date.

The French supermarkets affected in today's attacks had exposed all its refrigeration controllers directly to the internet.

Every single device reportedly used the same password: today's date...

There's also a documented authentication bypass: sending a POST request to /xml.cgi can bypass the login entirely.

Via: GossiTheDog

[Andrea Chiarelli @andychiare]

@thdxr If you'd like more details, take a look at this article: https://t.co/tUif7g16cQ

[Andrea Chiarelli @andychiare]

@thdxr - Dynamic Client Registration (DCR), which, however, presents security and performance issues.
- Client ID Metadata Document (CIMD), a mechanism currently being standardized that makes registration much more streamlined.

[Andrea Chiarelli @andychiare]

I shared this "little sad story" in a meetup to point out that the core of AI agent security comes down to one rule: don't grant permissions it shouldn't have.