Microsoft Learn

ASP.NET Core Security Fundamentals

Securing your ASP.NET Core applications is paramount to protecting user data and preventing unauthorized access. This module covers the core concepts and practical implementation strategies for building secure web applications with ASP.NET Core.

Key Security Concepts

• Authentication: Verifying the identity of users.
• Authorization: Determining what authenticated users are allowed to do.
• Data Protection: Protecting sensitive data at rest and in transit.
• Common Vulnerabilities: Understanding and mitigating threats like XSS, CSRF, SQL Injection, and more.

Authentication Strategies

ASP.NET Core provides a flexible authentication system that supports various schemes:

• Cookie Authentication: The most common method for web applications, using cookies to maintain user sessions.
• JWT Bearer Tokens: Ideal for single-page applications (SPAs) and mobile apps, stateless and commonly used with APIs.
• OAuth/OpenID Connect: Enabling users to sign in with external identity providers like Google, Facebook, or Azure AD.

Implementing Cookie Authentication

To enable cookie authentication, you need to configure the authentication services in your Startup.cs (or Program.cs in .NET 6+):

// In Program.cs (.NET 6+)
builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.LoginPath = "/Account/Login";
        options.LogoutPath = "/Account/Logout";
    });

builder.Services.AddAuthorization();

var app = builder.Build();

// ... middleware pipeline ...

app.UseAuthentication();
app.UseAuthorization();
                

Authorization Techniques

Authorization controls access to resources. ASP.NET Core offers:

• Role-Based Authorization: Granting access based on user roles (e.g., "Admin", "Editor").
• Policy-Based Authorization: Defining custom authorization policies based on claims, roles, or other requirements.
• Resource-Based Authorization: Fine-grained control over access to specific data instances.

Attribute-Based Authorization

You can protect controllers or actions using attributes:

[Authorize(Roles = "Admin")]
public class AdminController : Controller
{
    // ...
}

[HttpGet]
[Authorize(Policy = "MustBeEmployee")]
public IActionResult SensitiveData()
{
    // ...
}
                

Protecting Against Common Threats

• Cross-Site Scripting (XSS): ASP.NET Core's Razor engine automatically encodes HTML by default. Use HtmlEncoder for explicit encoding if needed.
• Cross-Site Request Forgery (CSRF): Use the built-in antiforgery token support. Add [ValidateAntiForgeryToken] to actions that modify state and render the token using @Html.AntiForgeryToken() in forms.
• SQL Injection: Always use parameterized queries or stored procedures with your data access technology (e.g., Entity Framework Core, Dapper).

Antiforgery Token Example

// In Razor View (.cshtml)
<form asp-controller="Home" asp-action="CreatePost" method="post">
    <input type="hidden" name="__RequestVerificationToken" value="@GetAntiForgeryToken()"/>
    <!-- ... form fields ... -->
    <button type="submit">Submit</button>
</form>

@functions {
    public string GetAntiForgeryToken()
    {
        var antiForgeryService = Context.RequestServices.GetService<IAntiforgery>();
        return antiForgeryService.GetAndStoreTokens(Context).RequestToken;
    }
}

// In Controller Action
[HttpPost]
[ValidateAntiForgeryToken]
public IActionResult CreatePost(PostModel model)
{
    // ... save post ...
    return RedirectToAction("Index");
}
                

Data Protection API

ASPS.NET Core provides a data protection API for cryptographic operations like encryption and signing. This is used internally for cookies and antiforgery tokens but can also be used for your own sensitive data.

Learn more about securing your applications by exploring the official Microsoft Learn documentation for detailed guides and best practices.