.NET CLI native audit

gram.cs builder.Services.AddDataProtection() .SetApplicationName("MySecureApp") .PersistKeysToAzureBlobStorage(new Uri(builder.Configuration["BlobStorageUri"]), new DefaultAzureCredential()) .ProtectKeysWithCertificate("thumbprint");

// Usage var protector = provider.GetDataProtector("email-protection"); var protectedPayload = protector.Protect("sensitive@email.com");

**Rationale:** Centralized key storage prevents data loss during container restarts. Certificate protection ensures keys are never stored in plaintext. The system automatically handles algorithm agility and key expiration.

### 4. Dependency & Supply Chain Security
NuGet packages introduce transitive vulnerabilities. Integrate auditing into the build pipeline and enforce SBOM generation.

```bash
# .NET CLI native audit
dotnet restore --audit true
dotnet list package --vulnerable

# Generate SBOM
dotnet tool install -g Microsoft.Sbom.Tool
sbom-tool generate -b ./bin/Release/net8.0 -n MyApp -v 1.0.0 -ps MyCompany -pv 1.0.0

Rationale: Native audit leverages the GitHub Advisory Database and NuGet.org vulnerability feeds. SBOMs enable rapid impact analysis when zero-days emerge, satisfying executive order and enterprise compliance requirements.

5. Secure Middleware Pipeline & HTTP Headers

Middleware ordering dictates security boundaries. Place security headers, CORS, and rate limiting before authentication and endpoint routing.

// Program.cs
app.UseHsts();
app.UseHttpsRedirection();
app.UseCors(policy => policy
    .WithOrigins("https://trusted.domain.com")
    .AllowAnyMethod()
    .AllowAnyHeader()
    .SetIsOriginAllowedToAllowWildcardSubdomains()
    .Build());

app.UseRateLimiter();
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();

Rationale: HSTS prevents protocol downgrade attacks. CORS must be explicitly scoped, not wildcarded. Rate limiting mitigates credential stuffing and API abuse before they reach business logic.

Pitfall Guide

1. Conflating Authentication with Authorization Authentication verifies identity; authorization verifies permission. Teams often inject [Authorize] globally and assume claims equal access. This bypasses resource-level checks and enables horizontal privilege escalation. Fix: Implement resource-based authorization handlers that evaluate ownership or context per endpoint.

2. Overusing [Authorize] Without Policy Validation Direct role checks bypass centralized policy engines and create maintenance debt. They also fail to support dynamic claim evaluation or external authorization services. Fix: Route all access decisions through IAuthorizationService and policy definitions.

3. Hardcoding Secrets in Configuration Files appsettings.Production.json committed to repositories is a leading cause of credential leaks. Even encrypted sections are vulnerable if the decryption key is stored alongside. Fix: Use environment variables, managed identities, or external secret managers. Strip secrets from logs and error responses.

4. Disabling Anti-Forgery Tokens in Stateful APIs CSRF protection is sometimes disabled to simplify SPA integrations. This leaves state-changing endpoints vulnerable to cross-site request forgery. Fix: Implement SameSite cookie attributes, double-submit cookie patterns, or token-based validation for all POST/PUT/DELETE operations.

5. Ignoring NuGet Transitive Dependencies Direct package references are audited, but transitive dependencies often carry unpatched CVEs. Teams assume dotnet restore guarantees safety. Fix: Enable --audit in CI, pin vulnerable transitive packages via direct reference, and integrate SCA tools like Dependabot or Trivy.

6. Misconfiguring CORS for Development Convenience AllowAnyOrigin() and AllowAnyHeader() in production enable credential theft and API abuse. Browsers enforce CORS, but malicious scripts can still exploit exposed endpoints. Fix: Whitelist exact origins, restrict exposed headers, and validate preflight requests against known client certificates or tokens.

7. Logging Sensitive Data or Tokens Structured logging frameworks capture request payloads, headers, and exceptions. JWTs, PII, and connection strings frequently leak into log aggregators. Fix: Implement log scrubbing middleware, use ILogger with structured parameters, and apply data classification tags to auto-redact sensitive fields.

Production Bundle

Action Checklist

• Replace role-based [Authorize] attributes with policy-based authorization requirements
• Integrate Azure Key Vault or AWS Secrets Manager via .NET Configuration provider chain
• Enable native NuGet auditing (dotnet restore --audit true) in all CI pipelines
• Configure IDataProtection with external key storage and certificate protection
• Enforce strict CORS policies with explicit origin whitelisting and SameSite cookies
• Implement structured logging with automatic PII/token redaction middleware
• Generate SBOM artifacts on every release build for supply chain traceability
• Validate middleware ordering: security headers → CORS → rate limiting → auth → routing

Decision Matrix

Configuration Template

// appsettings.json
{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  "Security": {
    "Cors": {
      "AllowedOrigins": ["https://app.example.com"],
      "AllowedMethods": ["GET", "POST"],
      "AllowedHeaders": ["Authorization", "Content-Type"],
      "SupportsCredentials": true
    },
    "DataProtection": {
      "ApplicationName": "ProdApp",
      "KeyStorageUri": "https://storage.blob.core.windows.net/dp-keys",
      "CertificateThumbprint": "A1B2C3D4E5F6..."
    },
    "RateLimiting": {
      "PermitLimit": 100,
      "Window": "00:01:00",
      "QueueLimit": 10
    }
  }
}

// Program.cs (Security pipeline bootstrap)
builder.Services.AddDataProtection()
    .SetApplicationName(builder.Configuration["Security:DataProtection:ApplicationName"])
    .PersistKeysToAzureBlobStorage(new Uri(builder.Configuration["Security:DataProtection:KeyStorageUri"]), new DefaultAzureCredential())
    .ProtectKeysWithCertificate(builder.Configuration["Security:DataProtection:CertificateThumbprint"]);

builder.Services.AddCors(options => options.AddPolicy("ProdPolicy", policy =>
{
    var cors = builder.Configuration.GetSection("Security:Cors");
    policy.WithOrigins(cors.GetSection("AllowedOrigins").Get<string[]>() ?? Array.Empty<string>())
          .WithMethods(cors.GetSection("AllowedMethods").Get<string[]>() ?? Array.Empty<string>())
          .WithHeaders(cors.GetSection("AllowedHeaders").Get<string[]>() ?? Array.Empty<string>())
          .AllowCredentials();
}));

builder.Services.AddRateLimiter(options =>
{
    var rl = builder.Configuration.GetSection("Security:RateLimiting");
    options.AddFixedWindowLimiter("global", limiter =>
    {
        limiter.PermitLimit = rl.GetValue<int>("PermitLimit");
        limiter.Window = TimeSpan.Parse(rl.GetValue<string>("Window") ?? "00:01:00");
        limiter.QueueLimit = rl.GetValue<int>("QueueLimit");
        limiter.QueueExclusionPolicy = context => context.User.Identity?.IsAuthenticated == true;
    });
});

Quick Start Guide

1. Scaffold a new project with security defaults: dotnet new webapi --auth Individual
2. Enable native auditing and generate an initial SBOM: dotnet restore --audit true && dotnet tool install -g Microsoft.Sbom.Tool
3. Replace appsettings.json secrets with environment variables and configure DefaultAzureCredential for local/cloud parity
4. Add policy-based authorization handlers and migrate existing [Authorize] attributes to [Authorize(Policy = "...")]
5. Deploy with middleware ordering validation: run dotnet dev-certs https --trust, verify HSTS/CORS headers via browser dev tools, and confirm rate limiting triggers on rapid requests