aspnetcore-security

ASP.NET Core Security

Security patterns for production-grade ASP.NET Core applications.

When to Activate

• Adding authentication (JWT, OAuth2, Cookie, Identity)
• Implementing authorization policies and roles
• Validating and sanitizing user input
• Configuring CORS, CSRF, or security headers
• Managing secrets and credentials
• Reviewing code for security vulnerabilities
• Running pre-deployment security checks

Authentication

JWT Bearer

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidIssuer = config["Jwt:Issuer"],
            ValidateAudience = true,
            ValidAudience = config["Jwt:Audience"],
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(
                Encoding.UTF8.GetBytes(config["Jwt:Key"]!))
        };
    });

OAuth2 / OpenID Connect

builder.Services.AddAuthentication()
    .AddOpenIdConnect("AzureAd", options =>
    {
        options.Authority = $"https://login.microsoftonline.com/{config["AzureAd:TenantId"]}/v2.0";
        options.ClientId = config["AzureAd:ClientId"];
        // Never hardcode ClientSecret - use User Secrets or Key Vault
        options.ClientSecret = config["AzureAd:ClientSecret"];
        options.ResponseType = OpenIdConnectResponseType.Code;
    });

Authorization

// ✅ Policy-based authorization
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("AdminOnly", policy =>
        policy.RequireRole("Admin").RequireClaim("department", "IT"));

    options.AddPolicy("OrderManager", policy =>
        policy.Requirements.Add(new MinimumAgeRequirement(18)));
});

// ✅ Custom requirement handler
public class MinimumAgeHandler : AuthorizationHandler<MinimumAgeRequirement>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        MinimumAgeRequirement requirement)
    {
        var birthDateClaim = context.User.FindFirst(ClaimTypes.DateOfBirth)?.Value;
        if (birthDateClaim != null &&
            DateOnly.TryParse(birthDateClaim, out var birthDate) &&
            birthDate.AddYears(requirement.MinimumAge) <= DateOnly.FromDateTime(DateTime.UtcNow))
        {
            context.Succeed(requirement);
        }

        return Task.CompletedTask;
    }
}

// ✅ Apply to endpoints
[Authorize(Policy = "AdminOnly")]
public class AdminController : ControllerBase { }

orders.MapPost("/", CreateOrder).RequireAuthorization("OrderManager");

Input Validation

// ✅ FluentValidation at API boundary
public class CreateOrderValidator : AbstractValidator<CreateOrderRequest>
{
    public CreateOrderValidator()
    {
        RuleFor(x => x.CustomerName)
            .NotEmpty().WithMessage("Customer name is required")
            .MaximumLength(200).WithMessage("Name too long")
            .Matches(@"^[a-zA-Z\s]+$").WithMessage("Name contains invalid characters");

        RuleFor(x => x.Amount)
            .GreaterThan(0).LessThanOrEqualTo(10000);
    }
}

// ✅ HtmlSanitizer for HTML content
using Ganss.Xss;
var sanitizer = new HtmlSanitizer();
var safeHtml = sanitizer.Sanitize(userSubmittedHtml);

SQL Injection Prevention

// ❌ NEVER string concatenation in SQL
context.Database.ExecuteSqlRaw($"SELECT * FROM Orders WHERE Id = {id}");

// ✅ EF Core LINQ (always parameterized)
context.Orders.Where(o => o.Id == id).FirstOrDefaultAsync(ct);

// ✅ Parameterized raw SQL when needed
context.Orders.FromSqlRaw("SELECT * FROM Orders WHERE Id = {0}", id);
// Or with FormattableString (compile-time safe)
context.Orders.FromSqlInterpolated($"SELECT * FROM Orders WHERE Id = {id}");

Password Hashing

// ✅ ASP.NET Core Identity PasswordHasher
var hasher = new PasswordHasher<ApplicationUser>();
var hashed = hasher.HashPassword(user, plainTextPassword);
var result = hasher.VerifyHashedPassword(user, hashed, inputPassword);

// ✅ Or use ASP.NET Core Identity directly (recommended)
await userManager.CreateAsync(user, password);
await signInManager.PasswordSignInAsync(email, password, isPersistent: false, false);

CSRF Protection

// ✅ Antiforgery for traditional MVC forms
builder.Services.AddAntiforgery(options =>
{
    options.Cookie.SameSite = SameSiteMode.Strict;
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    options.HeaderName = "X-CSRF-TOKEN";
});

// ✅ For SPAs: double-submit cookie pattern
app.Use(async (context, next) =>
{
    var tokens = antiforgery.GetAndStoreTokens(context);
    context.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken!,
        new CookieOptions { HttpOnly = false });
    await next(context);
});

Secrets Management

// ❌ NEVER hardcode secrets
private const string ApiKey = "sk-abc123"; // DO NOT COMMIT

// ❌ NEVER in appsettings.json
// { "Stripe": { "SecretKey": "sk-live-..." } }

// ✅ Development: User Secrets
// dotnet user-secrets set "Stripe:SecretKey" "sk-test-..."
// Automatically loaded in Development environment

// ✅ Production: Environment variables
// STRIPE__SECRETKEY=sk-live-...

// ✅ Production: Azure Key Vault
builder.Configuration.AddAzureKeyVault(
    new Uri($"https://{vaultName}.vault.azure.net/"),
    new DefaultAzureCredential());

Security Headers

// ✅ HSTS
builder.Services.AddHsts(options =>
{
    options.MaxAge = TimeSpan.FromDays(365);
    options.IncludeSubDomains = true;
});
app.UseHsts();

// ✅ Content Security Policy
app.Use(async (context, next) =>
{
    context.Response.Headers.Append("Content-Security-Policy",
        "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'");
    context.Response.Headers.Append("X-Content-Type-Options", "nosniff");
    context.Response.Headers.Append("X-Frame-Options", "DENY");
    await next();
});

CORS Configuration

// ✅ Restrictive CORS
builder.Services.AddCors(options =>
{
    options.AddPolicy("AllowFrontend", policy =>
    {
        policy.WithOrigins("https://myapp.com", "https://www.myapp.com")
              .WithMethods("GET", "POST", "PUT", "DELETE")
              .WithHeaders("Content-Type", "Authorization")
              .AllowCredentials();  // Only with explicit origins
    });
});

// ❌ NEVER: AllowAnyOrigin + AllowCredentials (CORS spec violation)
policy.AllowAnyOrigin().AllowCredentials(); // SECURITY RISK!

NuGet Vulnerability Scanning

# ✅ Run in CI and before deployment
dotnet list package --vulnerable
dotnet list package --deprecated
dotnet list package --outdated

# ✅ Fail CI on vulnerabilities
dotnet list package --vulnerable --include-transitive | grep -c "has the following vulnerable" && exit 1 || exit 0

Pre-Deployment Security Checklist

• All endpoints require [Authorize] or explicit AllowAnonymous
• No hardcoded secrets or API keys in source code
• dotnet list package --vulnerable returns no critical issues
• HTTPS enforced (UseHttpsRedirection + UseHsts)
• CORS restricted to known origins
• Input validated with FluentValidation at API boundary
• SQL queries use EF Core LINQ or parameterized raw SQL
• Passwords use PasswordHasher<T> or ASP.NET Core Identity
• Sensitive config uses User Secrets (dev) / Key Vault (prod)
• Security headers (CSP, X-Frame-Options, X-Content-Type-Options) configured