ASP.NET Core

Identity, passkeys, authorization and antiforgery in ASP.NET Core. Write-ups of my merged pull requests to dotnet/aspnetcore.

All my PRs to dotnet/aspnetcore on GitHub

• ES256 doesn't mean P-256 (unless you check): fixing passkey key validation in ASP.NET Core

  21 Oct, 2026

  A passkey public key carries an algorithm and a curve, and WebAuthn says they have to agree. ASP.NET Core Identity didn't check that. Notes on PR #68834: where the gap comes from, what a mismatched key actually does in .NET, and the fix.