ASP.NET Core and MVC is a mature and modern platform to build secure web applications and APIs. This session is a survey of the components provided by the platform to provide security including hosting, data protection, authentication, authorization, and identity. We will also discuss features that are missing that are needed for a modern security architecture, and how open source components fill those gaps and how Microsoft is using them.