A stolen session cookie passes every auth check you have. The signal that something is wrong isn’t in the token — it’s in the pattern: a login from Brussels, then São Paulo, eight minutes later. Here’s how to catch it in .NET.
Turning a client IP into a city has two answers in .NET — a local MaxMind database or a remote lookup API — and each hides a trap. Here is the honest trade-off between offline speed and online freshness, the GDPR problem nobody mentions, and how to run both behind one resolver.
FAPI 2.0 is the security profile required by Open Banking, healthcare APIs, and government identity systems. Most teams think conformance takes months. Granit’s OpenIddict server, BFF, and resource server implement every requirement — one flag enables the full profile.
Auth0 costs $240/month past 7 500 users. Keycloak needs its own VM and JVM tuning. Granit.OpenIddict ships as NuGet packages and runs in the same process as your API — full OIDC compliance, zero external services.
Shipping to the EU means opt-in. Shipping to California means opt-out. Shipping to Brazil means opt-in again. Most teams hardcode GDPR and call it done. Here is how Granit resolves the right consent model automatically — per tenant, per request, without a line of conditional logic in your application code.
Your strict Content Security Policy breaks the moment one ASP.NET Core route serves HTML — Scalar, an admin page, a Keycloak iframe. The usual band-aid weakens every other endpoint. Granit’s per-endpoint CSP composition keeps strict defaults strict and lets the package that mounts the UI declare its own relaxation.
Wire Keycloak JWT Bearer authentication into a Granit API in five minutes — claims transformation, role mapping, back-channel logout, and an Admin authorization policy, all from one DependsOn.
Hardcoded connection strings and static API keys are a breach waiting to happen. HashiCorp Vault gives you dynamic credentials, transit encryption, and per-entity key isolation — and Granit integrates all three as a single module dependency.
Enterprise customers ask for a SOC 2 Type 2 report before signing. Here is how Granit’s modules map to the five Trust Service Criteria — and what the framework cannot replace.
NIS 2 is now law across the EU. Here is what it requires from your .NET stack — and how Granit’s supply chain pipeline and embedded security modules cover the key obligations out of the box.
The new Granit.Tools.Mcp module family wraps the MCP C# SDK to expose your application capabilities to AI agents, with auto-discovery, RBAC authorization, and GDPR-compliant output sanitization.
Physical deletion breaks audit trails, conflicts with legal holds, and fails on append-only systems. Crypto-shredding solves all three: destroy the key, and the ciphertext becomes random noise. Here is how Granit implements it.
Your React app stores access tokens in localStorage. A compromised npm package reads them. Game over. Granit.Bff moves token handling to the server, so the browser only sees an HttpOnly cookie it cannot read.
GDPR compliance is not a checkbox. It is an architectural constraint that must be enforced at the framework level. Here is how Granit implements data minimization, right to erasure, and pseudonymization by default.
