Credential Stuffing in Aspnet with Mutual Tls

Credential stuffing is a volume-based attack where attackers use lists of breached username and password pairs to sign in to applications. In an ASP.NET application protected by mutual TLS (mTLS), the presence of client certificates changes the attack surface but does not inherently prevent automated credential testing if the endpoint is reachable without additional user context checks.

Mutual TLS authenticates the client by requiring a certificate during the TLS handshake. When mTLS is used at the transport layer, the server validates the certificate before the application processes the request. If the mTLS configuration maps client certificates to identities but does not enforce additional rate limits or step-up authentication, attackers can still attempt credential stuffing by cycling through stolen credentials while presenting valid client certificates. This can expose the application to automated login abuse despite the presence of mTLS, particularly when the certificates are broadly issued or reused across multiple users.

An ASP.NET application that relies solely on mTLS for authentication may inadvertently allow credential stuffing if endpoints such as password reset or multi-factor verification are accessible without tying certificate identity to per-request rate limiting or anomaly detection. The mTLS handshake terminates TLS and provides a client identity, but if the application layer does not enforce request quotas or monitor for credential spraying patterns, attackers can leverage mTLS-authenticated sessions to probe accounts efficiently.

Consider an endpoint that accepts a username and password after a valid client certificate is presented. If the server does not correlate certificate identity with the supplied credentials, attackers can use a valid certificate to bypass IP-based restrictions and perform high-volume requests. This is especially risky when the application issues long-lived client certificates to devices or service accounts without strict lifecycle management, increasing the likelihood of compromised credentials combined with valid certificates circulating in attacker environments.

middleBrick can detect such risks by scanning the unauthenticated attack surface, including endpoints protected by mTLS, and identifying missing rate limiting, weak identity correlation, and excessive agency in API behavior. The scanner runs checks aligned with OWASP API Top 10 and maps findings to compliance frameworks, providing prioritized remediation guidance to reduce exposure without implying automated fixes.

To harden an ASP.NET application using mutual TLS, enforce strict client certificate validation, correlate identities with application-layer controls, and apply rate limiting to mitigate credential stuffing. Below are concrete code examples for configuring mTLS and augmenting it with request governance.

1. Configure mTLS in ASP.NET Core (Kestrel) with strict certificate validation:

// Program.cs
var builder = WebApplication.CreateBuilder(args);

builder.WebHost.ConfigureKestrel(serverOptions =>
{
    serverOptions.ListenAnyIP(5001, listenOptions =>
    {
        listenOptions.UseHttps(httpsOptions =>
        {
            httpsOptions.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
            httpsOptions.ServerCertificate = new X509Certificate2("server.pfx", "password");
            httpsOptions.ClientCertificateValidation = (cert, chain, errors) =>
            {
                // Enforce strict validation: check thumbprint, revocation, and policy
                if (cert == null) return false;
                if (cert.Thumbprint != "EXPECTED_CLIENT_CERT_THUMBPRINT") return false;
                // Optionally validate chain and policy
                chain.ChainPolicy.RevocationMode = X509RevocationMode.Online;
                chain.ChainPolicy.ExtraStore.Add(new X509Certificate2("ca.cer"));
                bool isValidChain = chain.Build(cert);
                if (!isValidChain) return false;
                // Implement additional policy checks as needed
                return true;
            };
        });
    });
});

builder.Services.AddAuthorization();
var app = builder.Build();
app.UseHttpsRedirection();
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();
app.Run();

This configuration requires a client certificate for every HTTPS request and validates it strictly before the request reaches the application pipeline. This reduces the risk of credential stuffing via endpoints that otherwise trust any mTLS-authenticated client.

2. Correlate certificate identity with user identity and enforce rate limiting:

// Startup or Service Registration
services.AddRateLimiter(options =>
{
    options.GlobalLimiter = PartitionedRateLimiter.Create(context =>
    {
        // Extract client certificate thumbprint as a partition key
        var cert = context.Connection.ClientCertificate;
        string key = cert?.Thumbprint ?? "unknown";
        return RateLimitPartition.GetTokenBucketLimiter(key, _ => new TokenBucketRateLimiterOptions
        {
            TokenLimit = 10,
            QueueProcessingOrder = QueueProcessingOrder.OldestFirst,
            QueueLimit = 0,
            ReplenishmentPeriod = TimeSpan.FromMinutes(1),
            TokensPerPeriod = 10,
            AutoReplenishment = true
        });
    });
});

// In a controller or minimal API
app.MapPost("/login", (LoginModel model, HttpRequest request) =>
{
    var cert = request.HttpContext.Connection.ClientCertificate;
    if (cert == null) return Results.Unauthorized();
    // Map cert to an application user, then validate model.Username / model.Password
    // Apply additional checks such as last login, geolocation, or suspicious patterns
    return Results.Ok();
});

By combining mTLS with per-partition rate limiting based on certificate thumbprint, the application limits the effectiveness of credential stuffing even when valid certificates are available to attackers.

3. Use policy-based validation and logging for suspicious activity:

// Example of policy requirement and handler
services.AddAuthorizationCore(options =>
{
    options.AddPolicy("StrictMtls", policy =>
        policy.RequireAssertion(context =>
        {
            var cert = context.Resource?.GetType().GetProperty("ClientCertificate")?.GetValue(context.Resource) as X509Certificate2;
            return cert != null && cert.Thumbprint == "EXPECTED_CLIENT_CERT_THUMBPRINT";
        }));
});

// Logging suspicious attempts
app.Use(async (context, next) =>
{
    await next();
    if (context.Response.StatusCode == 401 || context.Response.StatusCode == 403)
    {
        var cert = context.Connection.ClientCertificate;
        // Log cert thumbprint, IP, and endpoint for SIEM integration
        Console.WriteLine($"Suspicious mTLS request: Thumbprint={cert?.Thumbprint}, Path={context.Request.Path}");
    }
});

These patterns ensure that mTLS is used as a binding factor rather than a blanket trust mechanism, reducing the risk of credential stuffing while maintaining secure, bidirectional authentication.

middleBrick supports this posture by scanning for missing rate limiting, weak identity correlation, and excessive agency on endpoints using mTLS. Its findings align with OWASP API Security and common compliance frameworks, helping teams prioritize fixes and measure improvement over time.