So you want to make your API secure in .NET? Well, you’ve come to the right place. In this article, we’ll be going over some tips and tricks to help you keep those pesky hackers at bay. In a previous article, we talked about “How to Build Secure Applications: A Guide to OWASP Best Practices”. Today, we’re going to dive into more specific tips and tricks for making your API secure in .NET.

But first, let’s talk about what exactly we mean by “secure.”

When we say “secure,” we’re talking about making sure that your API is protected from unauthorized access, data breaches, and other forms of cyber attacks. Basically, you want to make sure that only the right people can access your API, and that those people aren’t going to do anything nefarious with the data they get from it.

Now, let’s get into the nitty-gritty of how to make your API secure in .NET.

1. Use HTTPS

This might seem obvious, but it’s worth mentioning: you should always use HTTPS to secure your API. HTTPS encrypts all data that’s transmitted between the client and server, so even if someone intercepts the traffic, they won’t be able to read the data.

The following example permits HTTP/1.1 and HTTP/2 connections on port 8000. Connections are secured by TLS with a supplied certificate:

var builder = WebApplication.CreateBuilder(args);

builder.WebHost.ConfigureKestrel((context, serverOptions) =>
{
    serverOptions.Listen(IPAddress.Any, 8000, listenOptions =>
    {
        listenOptions.UseHttps("testCert.pfx", "testPassword");
    });
});

Read more here

2. Use Strong Passwords

Another important aspect of securing your API is to make sure that your users are using strong passwords. Weak passwords are an open invitation for hackers to try to guess them and gain access to your API.

To enforce strong password policies, you can use the built-in ASP.NET Core Identity framework. Here’s an example of how to use it:

builder.Services.Configure<IdentityOptions>(options =>
{
    // Default Password settings.
    options.Password.RequireDigit = true;
    options.Password.RequireLowercase = true;
    options.Password.RequireNonAlphanumeric = true;
    options.Password.RequireUppercase = true;
    options.Password.RequiredLength = 6;
    options.Password.RequiredUniqueChars = 1;
});

Read more here

3. Use JWTs for Authentication

JWTs (JSON Web Tokens) are a great way to handle authentication in your API. When a user logs in, they’re given a JWT, which they then send with every subsequent request. The JWT contains all the information needed to authenticate the user and make sure they have access to the resources they’re requesting.

Here’s some code that shows you how to use JWTs in .NET:

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = Configuration["Jwt:Issuer"],
            ValidAudience = Configuration["Jwt:Issuer"],
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:Key"]))
        };
    });

Read more here:

4. Use Role-Based Authorization

Role-based authorization is another important aspect of securing your API. By assigning roles to your users, you can make sure that they only have access to the resources they’re authorized to access.

Here’s a basic example of how to use role-based authorization:

[Authorize(Roles = "Admin")]
[HttpGet("{id}")]
public async Task<ActionResult<Product>> GetProduct(int id)
{
    // Here can only be accessed by users with the "Admin" role
}
``

Read more here

5. Use Logging

Logging is an essential tool for detecting and responding to security threats. By logging all user activity and system events, you can quickly identify potential threats and take action to mitigate them.

In .NET, you can use the built-in logging framework to log events and errors:

public class ProductService
{
    private readonly ILogger<ProductService> _logger;

    public ProductService(ILogger<ProductService> logger)
    {
        _logger = logger;
    }

    public async Task<Product> GetProduct(int id)
    {
        _logger.LogInformation("Getting product {Id}", id);

        // Get product from database...

        _logger.LogInformation("Got product {Name}", product.Name);

        return product;
    }
}

Read more here

6. Use Input Validation

Input validation is an essential security measure to prevent injection attacks and other exploits. Make sure to validate all user input and reject any input that doesn’t meet your requirements.

You can basically write your own input validations in the API as the following:

[HttpPost]
public IActionResult AddUser([FromBody] User user)
{
    if (string.IsNullOrWhiteSpace(user.FirstName))
    {
        return BadRequest("First name is required.");
    }

    if (string.IsNullOrWhiteSpace(user.LastName))
    {
        return BadRequest("Last name is required.");
    }

    // Add the user to the database
    return Ok();
}

Or you can use Model Validation:

public class User
{
    public int Id { get; set; }
    [Required]
    public string FirstName { get; set; }
    [Required]
    public string LastName { get; set; }
}

[HttpPost]
public IActionResult AddUser([FromBody] User user)
{
    if (ModelState.IsValid)
    {
        // Add the user to the database

        return new HttpResponseMessage(HttpStatusCode.OK);
    }
    else
    {
        return Request.CreateErrorResponse(HttpStatusCode.BadRequest, ModelState);
    }
}

Read more here:

7. Keep Your Dependencies Up to Date

Finally, it’s important to keep all your dependencies up to date. When a security vulnerability is found in a library or package that you’re using, the developers will often release a patch to fix the problem. By keeping your dependencies up to date, you can make sure that you’re using the latest, most secure version of each package.