Missing Tls in Aspnet with Cockroachdb

When an ASP.NET application connects to CockroachDB without Transport Layer Security (TLS), credentials, session tokens, and query data traverse the network in cleartext. This specific combination becomes high risk because CockroachDB supports secure connections via TLS certificates, and omitting encryption turns routine database operations into an exposure vector. An attacker who can observe or tamper with network traffic can harvest authentication information used by ASP.NET to open sessions with the database, potentially leading to unauthorized data access or manipulation.

ASP.NET typically manages database connectivity via connection strings and dependency injection. If the connection string directs the application to connect to CockroachDB on a non-TLS port (e.g., 26257 without encryption) or specifies parameters that disable certificate validation, traffic between the web application and the cluster is unencrypted. MiddleBrick scans identify this configuration as Missing TLS by inspecting unauthenticated API surfaces and runtime behavior, detecting whether connections negotiate encryption and whether certificate validation is enforced.

The risk is compounded in distributed environments where services communicate across networks. Without TLS, sensitive information such as user identities, role claims, and connection parameters can be intercepted. Furthermore, CockroachDB’s wire protocol can expose metadata about databases and tables if left unencrypted, aiding an attacker in crafting more precise follow-up attacks. By combining ASP.NET’s runtime configuration with CockroachDB’s network behavior, Missing TLS creates a pathway for eavesdropping and session hijacking.

Securing the ASP.NET and CockroachDB connection requires explicit TLS settings in the connection string and proper certificate handling in code. Use the Secure connection mode and provide paths to CA certificates to ensure encrypted communication and server identity verification.

Connection string approach

For CockroachDB clusters that provide CA certificates, configure the connection string to enforce TLS. The following example uses the Npgsql provider with parameters that require secure connections and specify certificate validation.

Host=my-cockroachdb.example.com;Port=26257;Database=mydb;User ID=appuser;Password=SuperSecretPassword;SSL Mode=Require;Trust Server Certificate=false;Root Certificate=certs/ca.pem;

Programmatic configuration in ASP.NET

In Program.cs, explicitly configure options to verify the server certificate and set command timeouts. This pattern ensures that connections fail safely if a valid certificate is not presented.

using Microsoft.EntityFrameworkCore;
using Npgsql;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddDbContext<AppDbContext>(options =
    options.UseNpgsql(
        builder.Configuration.GetConnectionString("CockroachDb"),
        npgsqlOptions =>
        {
            npgsqlOptions.EnableRetryOnFailure(
                maxRetryCount: 3,
                maxRetryDelay: TimeSpan.FromSeconds(30),
                errorCodesToAdd: null);
            npgsqlOptions.CommandTimeout(30);
        })
    .UseSnakeCaseNamingConvention());

// Ensure certificate validation is enforced
AppContext.SetSwitch("Npgsql.EnableLegacyTimestampBehavior", true);

var app = builder.Build();
// Minimal API example
app.MapGet("/healthz", async (AppDbContext db) =>
{
    var count = await db.Items.CountAsync();
    return Results.Ok(new { Count = count });
});
app.Run();

public class AppDbContext : DbContext
{
    public AppDbContext(DbContextOptions<AppDbContext> options) : base(options) { }
    public DbSet<Item> Items => Set<Item>();
}

public class Item
{
    public int Id { get; set; }
    public string Name { get; set; } = string.Empty;
}

Certificate deployment and rotation

Place the CockroachDB CA certificate at the path referenced in the connection string and ensure the ASP.NET runtime can read it. Rotate certificates as part of operational procedures; MiddleBrick can detect when TLS is missing and map findings to frameworks such as OWASP API Top 10 and PCI-DSS to highlight the need for encryption in transit.