Aspnet API Security

Aspnet Core provides a solid security foundation with built-in protections, but its default configuration leaves critical gaps. The framework includes anti-forgery tokens, data protection APIs, and secure defaults for HTTPS redirection, yet developers often overlook these features or misconfigure them.

The framework's model binding automatically validates data annotations, but this only scratches the surface of input validation. Aspnet's authentication middleware supports JWT, OAuth2, and cookie-based auth, but default settings often use weak signing algorithms or allow overly permissive token scopes. The authorization system with policies and roles works well, but developers frequently implement authorization checks incorrectly or forget them entirely on API endpoints.

Most critically, Aspnet's default CORS policy allows all origins, methods, and headers when you simply call AddCors() without configuration. This creates a massive attack surface for cross-origin attacks. Similarly, the default rate limiting middleware is often not enabled, leaving APIs vulnerable to brute force and DoS attacks.

1. Over-Permissive CORS Configuration
Many developers enable CORS with default settings that allow any origin:

services.AddCors(options => options.AddDefaultPolicy(builder => builder.AllowAnyOrigin()));

This exposes your API to cross-origin attacks. Attackers can host malicious sites that make authenticated requests to your API using the victim's session cookies.

2. Missing Rate Limiting
Aspnet Core 7+ includes rate limiting middleware, but it's rarely enabled by default. Without rate limiting, APIs are vulnerable to credential stuffing, brute force attacks, and resource exhaustion. The framework provides sophisticated rate limiting policies (token bucket, sliding window, concurrency) that most developers never configure.

3. Insecure Default Serialization
Aspnet's JSON serialization includes type information by default in some scenarios, creating deserialization vulnerabilities. Attackers can craft malicious payloads that trigger remote code execution when deserialized. The default JSON options should explicitly disable type information inclusion.

4. JWT Configuration Weaknesses
Common misconfigurations include using weak signing keys, allowing expired tokens, or failing to validate token audiences and issuers. Many developers use symmetric keys (HS256) instead of asymmetric keys (RS256) for JWT signing, making key compromise more likely.

5. Missing Security Headers
Aspnet doesn't enable critical security headers by default. Missing headers include Content Security Policy (CSP), X-Content-Type-Options, X-Frame-Options, and Referrer Policy. These headers prevent XSS, clickjacking, and MIME-type confusion attacks.

CORS Configuration
Instead of allowing all origins, specify exact origins and use HTTPS only:

services.AddCors(options => options.AddPolicy("Production", builder => builder.WithOrigins("https://yourdomain.com")
    .WithMethods("GET", "POST", "PUT", "DELETE")
    .WithHeaders("Content-Type", "Authorization")
    .AllowCredentials()));

Rate Limiting Implementation
Configure rate limiting in Program.cs:

services.AddRateLimiter(options => {
    options.AddPolicy("Global", context => 
        RateLimitPartition.GetSlidingWindowLimiter(
            partitionKey: context.HttpContext.Connection.RemoteIpAddress.ToString(),
            factory: _ => new SlidingWindowRateLimitOptions {
                PermitLimit = 100,
                Window = TimeSpan.FromMinutes(1),
                AutoReplenishment = true
            }));
});

Security Headers
Add security headers middleware:

app.Use((context, next) => {
    context.Response.Headers["X-Content-Type-Options"] = "nosniff";
    context.Response.Headers["X-Frame-Options"] = "DENY";
    context.Response.Headers["X-XSS-Protection"] = "1; mode=block";
    context.Response.Headers["Referrer-Policy"] = "strict-origin-when-cross-origin";
    return next(context);
});

JWT Security
Use asymmetric keys and validate all claims:

services.AddAuthentication(options => {
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddJwtBearer(options => {
    options.TokenValidationParameters = new TokenValidationParameters {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,
        ValidIssuer = Configuration["Jwt:Issuer"],
        ValidAudience = Configuration["Jwt:Audience"],
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:Key"])),
        ClockSkew = TimeSpan.Zero
    };
});

Serialization Security
Disable type information in JSON options:

services.AddControllersWithViews().AddJsonOptions(options => {
    options.JsonSerializerOptions.IncludeFields = false;
    options.JsonSerializerOptions.IncludeProperties = false;
    options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter());
});