.NETPro #52: .NET Security Fixes, Microsoft.UI.Reactor, Ardalis Goes Commercial, JWT Revocation, and More...

Roshan from PacktNov 3, 2026

.NETPro #52: .NET Security Fixes, Microsoft.UI.Reactor, Ardalis Goes Commercial, JWT Revocation, and More...

🌏 Actionable .NET tips, the latest updates, and community insights, all in one place

Nov 3

This issue is about things that keep running longer than you’d expect, and what it takes to stop them. A JWT keeps working after a password change because ASP.NET Core never checks your database. A Brotli bug was serious enough that Microsoft shipped .NET fixes outside its regular monthly servicing schedule. And .NET 8, which plenty of teams still run in production, loses support on November 10.

For hands-on this issue, the spotlight is on Milan Jovanović’s guide to revoking a JWT before it expires, complete with load-test numbers showing what immediate revocation actually costs you.

The experts section has Steve Smith explaining why some of his widely used Ardalis packages are moving to commercial licenses, Andrew Lock introducing CBOR, a compact alternative to JSON that’s already used inside ASP.NET Core, and a practical guide to whether your team should move off .NET 8 or 10 right now. On the news side, Blazor is getting engineering help from two component vendors, and Microsoft has an experimental way to build WinUI apps without writing any XAML.

Take a look at today’s highlights first:

➡️ Patch now: out-of-band .NET fixes for a Brotli vulnerability, plus .NET 11 RC3
➡️ Syncfusion and Infragistics put their engineers to work on Blazor
➡️ Build WinUI apps in plain C#, no XAML required
➡️ Why GuardClauses, SmartEnum, and Specification are going commercial
➡️ Meet CBOR, the binary JSON alternative hiding inside ASP.NET Core
➡️ .NET 8 support ends November 10, so here's where to move

Keep reading, and when you’re done, drop us a note about what you enjoyed and how we can make the next edition more helpful.

Cheers!
Roshan Ravi Kumar
Editor-in-Chief

Thanks for reading .NETPro By Packt! Subscribe for free to receive new posts and support my work.

Subscribed

📰 What’s Happening in .NET!

The latest .NET breakthroughs are here. Haven’t explored them yet? Dive in now!

➡️ .NET Ships Out-of-Band Security Fixes and RC3: Microsoft has released out-of-band security updates for .NET 8, 9, and 10, along with .NET 11 Release Candidate 3, and recommends updating as soon as possible. The headline fix is a buffer overflow in .NET's use of the Brotli decompression algorithm that could let an unauthenticated attacker read or corrupt process memory, which matters if your app uses ASP.NET Core request decompression, HttpClient automatic decompression, or the Brotli APIs directly. There's also a fix for Linux tarball ownership, and two advisories from the October 13 release are being re-released because those fixes were incomplete.
➡️ Syncfusion and Infragistics Join Blazor Development: Two component vendors are now contributing directly to Blazor. Syncfusion has released a free, MIT-licensed Toolkit for Blazor with charts, date pickers, inputs, dialogs, and more, with no license key required even for commercial use. Its engineers have already landed fixes in ASP.NET Core and the .NET scaffolding tools, and ran more than 60 end-to-end validation scenarios for new .NET 11 Blazor features. It follows a similar announcement from Infragistics two days earlier, which brings free components and new .NET 11 analyzers.
➡️ Microsoft.UI.Reactor Brings C#-Only UI to WinUI: Microsoft has shared a longer look at Reactor, an experimental framework that brings the Model-View-Update pattern to WinUI desktop apps, with no XAML files, no code-behind, and no ViewModels. You write a C# function that describes the UI for the current state, and Reactor updates only the real WinUI controls that changed, so it isn't a new renderer or a fork. Microsoft is clear that it's not replacing XAML or MVVM, both can run side by side, and there's no support policy or API guarantee yet.

⏱️ Time for Some Hands-On .NET

Don’t miss this edition’s spotlight guide!

🔐 Changing your password doesn't log anyone out of your API

ASP.NET Core’s JWT bearer handler checks a token’s signature, issuer, audience, and expiry on every request, and never touches your database. That’s what makes JWTs stateless and easy to scale, but it also means a stolen token keeps working after the user changes their password, gets deactivated, or signs out everywhere.

Milan Jovanović fixes this in two steps.

First, short-lived access tokens (he uses five minutes) paired with refresh tokens stored as hashes, with rotation and reuse detection, so a refresh token that comes back a second time is treated as stolen and every token from that login gets revoked.
Second, for cases where even a few minutes is too long, a token_version claim is checked against the user row in OnTokenValidated, which kills old tokens the moment a password changes or an account is deactivated.

He also shows how a sid claim lets you log out one device without signing out all the others.

Read this article if your API uses JWTs and your current answer to “what happens if a token leaks?” is “it expires eventually.”

Why it’s worth exploring

Most JWT revocation posts stop at "add a blocklist." This one load-tests the tradeoff. With 64 concurrent users, the Postgres version check dropped an otherwise empty endpoint from about 160,000 to 21,000 requests per second, while a Redis cache in front of it kept roughly 76,000. That gives you real numbers for deciding whether immediate revocation is worth it for your app, instead of guessing.

What you need before diving in

Familiarity with JWT bearer authentication in ASP.NET Core and TokenValidationParameters

Working knowledge of EF Core, since the examples use ExecuteUpdateAsync and ExecuteDeleteAsync for revocation

A relational database such as PostgreSQL, plus Redis if you want to cache the version check

✒️ Got a Minute?

Tell us what you loved, what you want more of, and how we can make .NETPro even better in 2026. This quick 1-minute survey helps shape future issues around what matters most to you.

🧑🏼‍💻 What .NET Experts Are Talking About

Inside the minds of .NET pros: Real-world experience, real insights!

➡️ Some Ardalis Packages Are Going Commercial: Steve Smith announces that Ardalis.GuardClauses, Ardalis.SmartEnum, and Ardalis.Specification will move to commercial licensing as a suite, no earlier than mid-December 2026 and possibly not before 2027. Individuals, open source projects, and organizations under $5M in annual revenue get a free community license, Ardalis.Result stays free, and each package gets one more free release in 2026. The more interesting part is the reasoning: he's candid about no longer having time to maintain the projects, shares a risk assessment he ran on his own repos, and places the move alongside IdentityServer, MediatR, MassTransit, and Fluent Assertions. Worth reading if any of these packages are in your dependency tree, or if you've wondered how sustainable the .NET libraries you rely on really are.
➡️ An Introduction to CBOR in .NET: Andrew Lock introduces CBOR, an IETF standard that encodes the same data types as JSON in a binary form, with native support for binary data and streaming. He compares it with Protobuf and MessagePack, then walks through the low-level CborWriter and CborReader APIs in the System.Formats.Cbor package, including conformance modes and skipping unknown fields for forward compatibility. His honest verdict is that JSON will still do the job for most APIs, but he points to a real use inside ASP.NET Core's Device Bound Session Credentials support in .NET 11. Worth reading if you send a lot of binary or numeric data and are tired of base64-encoding it into JSON.
➡️ Should You Upgrade From .NET 8 or 10 Right Now?: Anup Karanjkar skips the release candidate hype and gives you a decision table based on where you are today. .NET 8 and .NET 9 both reach end of support on November 10, 2026, so his advice is to move .NET 8 apps to .NET 10, the current LTS, rather than jumping to an STS release just to beat the deadline. If you're already on .NET 10, he suggests staying put and adding a CI job that builds against .NET 11 so the breaking changes are a known quantity before GA. He also flags the breaking change most likely to bite services: IHost.RunAsync now throws when a BackgroundService fails.

👋 Advertise With Us

Interested in sponsoring this newsletter and reaching a highly engaged audience of tech professionals? Take a look at our sponsorship page to explore available options. If it’s a good fit, contact [email protected] to get started with the next steps.

And That’s a Wrap 🎬

Thanks for diving in. I hope this issue sparked an idea or two that could help fuel your next big project.

Got a minute? We’d love your feedback. Just take this quick 1-minute survey to help us improve future editions.

Keep learning, keep building, and we’ll see you next time!

Subscribe for More and Share with a Friend