Phishing Api Keys in Aspnet with Mutual Tls

Mutual Transport Layer Security (mTLS) in an ASP.NET application adds client certificate authentication on top of standard server authentication. When implemented incorrectly, it can create a phishing surface where an attacker captures or tricks a client into revealing its API key, often embedded in request headers or certificates, even though the channel is encrypted.

In an ASP.NET Core app, mTLS is commonly configured via Kestrel or IIS, requiring a client certificate for certain endpoints. Developers may assume mTLS alone prevents phishing, but if the application uses an API key as a secondary credential—for example, passing it in an Authorization: ApiKey {key} header—and does not adequately validate the origin of the request, a phishing site can lure a user’s client (browser or service) into presenting its certificate and sending the API key to a malicious endpoint.

Consider an ASP.NET service that accepts mTLS client certificates and also requires an API key header for authorization. If a user’s client is tricked into connecting to a phishing server (e.g., via a forged link or compromised DNS), the client may present its certificate and include the API key in the request. Because the phishing server controls the TLS termination point, it can harvest both the client certificate (if not stored securely client-side) and the API key header. This is especially risky when the API key is long-lived and lacks additional binding to the mTLS certificate or session context.

Another scenario involves insecure storage of API keys on the client side. For instance, a SPA or mobile client using ASP.NET backend endpoints with mTLS might embed the API key in JavaScript or configuration files. A phishing site that compromises the client can read the key and replay it, even when mTLS is in place, unless strict anti-phishing controls—such as certificate pinning, origin checks, and short-lived tokens—are applied.

Real-world parallels include CVE-2021-34473 and similar authentication bypass patterns in frameworks where trust is assumed based on channel encryption rather than request-level validation. OWASP API Security Top 10 items such as Broken Object Level Authorization (BOLA) and Security Misconfiguration are relevant here: improper mapping of mTLS identities to API keys can lead to privilege escalation or unauthorized access.

To mitigate these risks, ASP.NET applications should bind API keys to mTLS identities, validate origins rigorously, and avoid embedding long-lived secrets in client-side contexts. Continuous scanning with tools that probe for API key leakage and weak mTLS configurations—such as active LLM security checks and unauthenticated surface testing—helps detect phishing-prone setups before attackers exploit them.

Remediation focuses on tightly coupling API key usage with mTLS certificate information and enforcing strict validation in ASP.NET Core. Below are concrete, working examples.

1. Configure mTLS in Kestrel with client certificate validation

// Program.cs
var builder = WebApplication.CreateBuilder(args);

builder.WebHost.ConfigureKestrel(serverOptions =>
{
    serverOptions.ListenAnyIP(5001, listenOptions =>
    {
        listenOptions.UseHttps(httpsOptions =>
        {
            httpsOptions.ServerCertificate = new X509Certificate2("server.pfx", "password");
            httpsOptions.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
            httpsOptions.AllowedCipherSuites = new[]
            {
                // restrict to strong ciphers
                System.Security.Authentication.CipherSuite.Tls13Aes256GcmSha384,
                System.Security.Authentication.CipherSuite.Tls13ChaCha20Poly1305Sha256
            };
            httpsOptions.ClientCertificateValidation = (cert, chain, errors) =>
            {
                // Validate the client certificate thumbprint or subject
                var allowedThumbprint = "A1B2C3D4E5F6...";
                if (cert == null) return false;
                return errors == System.Security.Cryptography.X509Certificates.X509ChainStatusFlags.NoError
                       && cert.Thumbprint != null
                       && cert.Thumbprint.Equals(allowedThumbprint, StringComparison.OrdinalIgnoreCase);
            };
        });
    });
});

var app = builder.Build();
app.UseHttpsRedirection();
app.UseAuthorization();
app.MapControllers();
app.Run();

2. Validate API key against client certificate in an authorization handler

// ApiKeyWithMtlsRequirement.cs
public class ApiKeyWithMtlsRequirement : IAuthorizationRequirement { }

public class ApiKeyWithMtlsHandler : AuthorizationHandler<ApiKeyWithMtlsRequirement, HttpContext>
{
    private readonly IConfiguration _config;
    public ApiKeyWithMtlsHandler(IConfiguration config) => _config = config;

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, ApiKeyWithMtlsRequirement requirement, HttpContext resource)
    {
        // Extract API key from header
        if (!resource.Request.Headers.TryGetValue("ApiKey", out var apiKeyValues))
        {
            context.Fail();
            return Task.CompletedTask;
        }
        var apiKey = apiKeyValues.FirstOrDefault();

        // Extract client certificate from the TLS connection
        var clientCert = resource.Connection.ClientCertificate as X509Certificate2;
        if (clientCert == null)
        {
            context.Fail();
            return Task.CompletedTask;
        }

        // Bind API key to certificate thumbprint (example lookup)
        var allowedThumbprint = _config["AllowedClientThumbprint"];
        if (clientCert.Thumbprint != allowedThumbprint)
        {
            context.Fail();
            return Task.CompletedTask;
        }

        // Validate API key format and value (e.g., from secure store)
        var validKey = _config["ValidApiKey"];
        if (apiKey != validKey)
        {
            context.Fail();
            return Task.CompletedTask;
        }

        context.Succeed(requirement);
        return Task.CompletedTask;
    }
}

// Startup or minimal API registration
// In Program.cs after builder.Build()
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("MtlsApiKeyPolicy", policy =>
        policy.Requirements.Add(new ApiKeyWithMtlsRequirement()));
    builder.Services.AddSingleton

// In middleware or controller
app.Use(async (context, next) =>
{
    // Reject requests with missing or suspicious Origin/Referer in sensitive endpoints
    var origin = context.Request.Headers.Origin.ToString();
    var referer = context.Request.Headers.Referer.ToString();
    if (!string.IsNullOrEmpty(origin) && !IsOriginAllowed(origin))
    {
        context.Response.StatusCode = 403;
        return;
    }
    await next(context);
});

bool IsOriginAllowed(string origin) => origin.StartsWith("https://trusted.example.com");