{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity/", "slug": "dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity", "url": "https://update.dsesecurity.com/updates/dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity/" }, "title": "Re-resolve Service Fabric endpoints after the listener rejects a stale identity", "summary": "How should an internal client respond when a reused address no longer belongs to its intended Service Fabric service?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:23:54+00:00", "modified_at": "2026-09-10T02:08:05+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 235, "potentially_affected": "ASP.NET Core Service Fabric services using dynamic endpoints in a trusted, non-hostile-tenant environment.", "dse_recommendation": "DSE recommends checking the listener's identity validation and the client's endpoint refresh behavior together.", "primary_source": { "name": "Service communication with the ASP.NET Core - Azure Service Fabric | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-reliable-services-communication-aspnetcore", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Service Fabric’s ASP.NET Core integration middleware adds a unique identifier to the registered service address and checks it on requests. A mismatch returns HTTP 410 Gone. Clients should then resolve the service endpoint again. This cooperative protection is intended for a trusted environment; it does not authenticate a service securely against a hostile tenant. Microsoft Learn.

\n

Applicability

\n

Focus this review on internal clients caching dynamically assigned endpoints. Distinguish an address that is reachable from an address that still represents the intended service. Do not extend this mechanism into a claim that tenant authentication, authorization or transport security has been established.

\n

DSE recommendation

\n

DSE recommends checking the listener’s identity validation and the client’s endpoint refresh behavior together. Have the application owner trace where a resolved address is cached and what happens after an identity rejection. Keep this error path separate from ordinary application failures: the proposed response is to refresh the destination, not repeatedly submit the same request to an unchanged cached address.

\n

Verification

\n

In an isolated integration test, exercise a stale endpoint and inspect the listener response. Confirm that the client performs a fresh resolution after the documented rejection and subsequently addresses the intended service. Retain the old and refreshed endpoint identities without collecting sensitive request payloads. Test the application’s separate authentication controls through their own acceptance criteria; passing this routing test is not a substitute.

\n

Official references

\n

Microsoft Learn. Source retrieved September 9, 2026.

", "content_text": "Source facts\nService Fabric’s ASP.NET Core integration middleware adds a unique identifier to the registered service address and checks it on requests. A mismatch returns HTTP 410 Gone. Clients should then resolve the service endpoint again. This cooperative protection is intended for a trusted environment; it does not authenticate a service securely against a hostile tenant. Microsoft Learn.\nApplicability\nFocus this review on internal clients caching dynamically assigned endpoints. Distinguish an address that is reachable from an address that still represents the intended service. Do not extend this mechanism into a claim that tenant authentication, authorization or transport security has been established.\nDSE recommendation\nDSE recommends checking the listener’s identity validation and the client’s endpoint refresh behavior together. Have the application owner trace where a resolved address is cached and what happens after an identity rejection. Keep this error path separate from ordinary application failures: the proposed response is to refresh the destination, not repeatedly submit the same request to an unchanged cached address.\nVerification\nIn an isolated integration test, exercise a stale endpoint and inspect the listener response. Confirm that the client performs a fresh resolution after the documented rejection and subsequently addresses the intended service. Retain the old and refreshed endpoint identities without collecting sensitive request payloads. Test the application’s separate authentication controls through their own acceptance criteria; passing this routing test is not a substitute.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nService Fabric’s ASP.NET Core integration middleware adds a unique identifier to the registered service address and checks it on requests. A mismatch returns HTTP 410 Gone. Clients should then resolve the service endpoint again. This cooperative protection is intended for a trusted environment; it does not authenticate a service securely against a hostile tenant. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-reliable-services-communication-aspnetcore).\n\n## Applicability\n\nFocus this review on internal clients caching dynamically assigned endpoints. Distinguish an address that is reachable from an address that still represents the intended service. Do not extend this mechanism into a claim that tenant authentication, authorization or transport security has been established.\n\n## DSE recommendation\n\nDSE recommends checking the listener’s identity validation and the client’s endpoint refresh behavior together. Have the application owner trace where a resolved address is cached and what happens after an identity rejection. Keep this error path separate from ordinary application failures: the proposed response is to refresh the destination, not repeatedly submit the same request to an unchanged cached address.\n\n## Verification\n\nIn an isolated integration test, exercise a stale endpoint and inspect the listener response. Confirm that the client performs a fresh resolution after the documented rejection and subsequently addresses the intended service. Retain the old and refreshed endpoint identities without collecting sensitive request payloads. Test the application’s separate authentication controls through their own acceptance criteria; passing this routing test is not a substitute.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-reliable-services-communication-aspnetcore). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity/", "url": "https://update.dsesecurity.com/updates/dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Re-resolve Service Fabric endpoints after the listener rejects a stale identity", "item": "https://update.dsesecurity.com/updates/dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity/", "url": "https://update.dsesecurity.com/updates/dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity/", "headline": "Re-resolve Service Fabric endpoints after the listener rejects a stale identity", "description": "How should an internal client respond when a reused address no longer belongs to its intended Service Fabric service?", "abstract": "How should an internal client respond when a reused address no longer belongs to its intended Service Fabric service?", "articleBody": "Source facts\nService Fabric’s ASP.NET Core integration middleware adds a unique identifier to the registered service address and checks it on requests. A mismatch returns HTTP 410 Gone. Clients should then resolve the service endpoint again. This cooperative protection is intended for a trusted environment; it does not authenticate a service securely against a hostile tenant. Microsoft Learn.\nApplicability\nFocus this review on internal clients caching dynamically assigned endpoints. Distinguish an address that is reachable from an address that still represents the intended service. Do not extend this mechanism into a claim that tenant authentication, authorization or transport security has been established.\nDSE recommendation\nDSE recommends checking the listener’s identity validation and the client’s endpoint refresh behavior together. Have the application owner trace where a resolved address is cached and what happens after an identity rejection. Keep this error path separate from ordinary application failures: the proposed response is to refresh the destination, not repeatedly submit the same request to an unchanged cached address.\nVerification\nIn an isolated integration test, exercise a stale endpoint and inspect the listener response. Confirm that the client performs a fresh resolution after the documented rejection and subsequently addresses the intended service. Retain the old and refreshed endpoint identities without collecting sensitive request payloads. Test the application’s separate authentication controls through their own acceptance criteria; passing this routing test is not a substitute.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:23:54+00:00", "dateModified": "2026-09-10T02:08:05+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-482-re-resolve-service-fabric-endpoints-after-the-listener-rejects-a-stale-identity/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Re-resolve Service Fabric endpoints after the listener rejects a stale identity" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 235, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Service communication with the ASP.NET Core - Azure Service Fabric | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-reliable-services-communication-aspnetcore" } } ] } }