ASP.NET Core Security Fortification: Master OWASP Best Practices & Threat Protection (Part

Previous article: ASP.NET Core Caching Mastery: Redis, Memory Cache, Distributed Patterns & Performance Optimization (Part - 27 of 40)

The Security Imperative
OWASP Top 10 Deep Dive
Authentication Mastery
Authorization Strategies
Data Protection & Encryption
Input Validation & Sanitization
Security Headers & HTTPS
Real-World Security Implementation
API Security
Monitoring & Incident Response
Security Testing
Production Hardening

1. The Security Imperative

Why Security is Non-Negotiable in Modern Applications

Security breaches can devastate businesses, with average costs exceeding $4 million per incident. ASP.NET Core provides robust security features, but proper implementation requires deep understanding and strategic planning.

Real-Life Analogy : Think of application security like a bank vault. You need:

Strong doors (Authentication)
Different access levels (Authorization)
Surveillance systems (Monitoring)
Alarm systems (Intrusion Detection)
Security guards (Web Application Firewalls)

  
    // Security vulnerability - SQL Injectionpublic class InsecureProductService{
    public async Task<List<Product>> SearchProducts(string searchTerm)
    {
        var query = $"SELECT * FROM Products WHERE Name LIKE '%{searchTerm}%'";
        // MALICIOUS INPUT: ' OR 1=1; DROP TABLE Products; --
        // RESULTS IN: SELECT * FROM Products WHERE Name LIKE '%' OR 1=1; DROP TABLE Products; --%'
        return await _context.Products.FromSqlRaw(query).ToListAsync();
    }}

// Secure implementationpublic class SecureProductService{
    public async Task<List<Product>> SearchProducts(string searchTerm)
    {
        return await _context.Products
            .Where(p => p.Name.Contains(searchTerm))
            .ToListAsync();
    }}

Security Breach Impact Statistics

Attack Type	Average Cost	Frequency	Prevention Cost
SQL Injection	$4.5M	65% of apps	$50K
XSS Attacks	$3.2M	75% of apps	$30K
Broken Authentication	$4.0M	60% of apps	$40K
Sensitive Data Exposure	$4.8M	50% of apps	$60K

2. OWASP Top 10 Deep Dive

Comprehensive OWASP Protection Implementation

  
    // Centralized security service for OWASP Top 10 protectionpublic class SecurityService : ISecurityService{
    private readonly IDataProtector _dataProtector;
    private readonly ILogger<SecurityService> _logger;
    private readonly IAntiforgery _antiforgery;
    private readonly IConfiguration _configuration;

    public SecurityService(IDataProtectionProvider dataProtectionProvider,
                         ILogger<SecurityService> logger,
                         IAntiforgery antiforgery,
                         IConfiguration configuration)
    {
        _dataProtector = dataProtectionProvider.CreateProtector("SecurityService");
        _logger = logger;
        _antiforgery = antiforgery;
        _configuration = configuration;
    }

    // A01:2021 - Broken Access Control
    public bool ValidateAccessControl(HttpContext context, string requiredRole, string requiredPolicy = null)
    {
        if (!context.User.Identity.IsAuthenticated)
        {
            _logger.LogWarning("Unauthenticated access attempt to protected resource");
            return false;
        }

        if (!string.IsNullOrEmpty(requiredRole) && !context.User.IsInRole(requiredRole))
        {
            _logger.LogWarning("User {User} attempted to access resource requiring role {Role}", 
                context.User.Identity.Name, requiredRole);
            return false;
        }

        if (!string.IsNullOrEmpty(requiredPolicy) && 
            !context.User.HasClaim("Policy", requiredPolicy))
        {
            _logger.LogWarning("User {User} attempted to access resource requiring policy {Policy}", 
                context.User.Identity.Name, requiredPolicy);
            return false;
        }

        return true;
    }

    // A02:2021 - Cryptographic Failures
    public string EncryptSensitiveData(string data)
    {
        if (string.IsNullOrEmpty(data))
            return data;

        try
        {
            return _dataProtector.Protect(data);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Failed to encrypt sensitive data");
            throw new SecurityException("Data encryption failed", ex);
        }
    }

    public string DecryptSensitiveData(string protectedData)
    {
        if (string.IsNullOrEmpty(protectedData))
            return protectedData;

        try
        {
            return _dataProtector.Unprotect(protectedData);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Failed to decrypt sensitive data");
            throw new SecurityException("Data decryption failed", ex);
        }
    }

    // A03:2021 - Injection Prevention
    public string SanitizeInput(string input, InputType inputType = InputType.General)
    {
        if (string.IsNullOrEmpty(input))
            return input;

        // Remove potentially dangerous characters
        var sanitized = input.Trim();

        switch (inputType)
        {
            case InputType.Html:
                sanitized = System.Net.WebUtility.HtmlEncode(sanitized);
                break;
            case InputType.Sql:
                // Parameterized queries should be used instead, but this provides additional safety
                sanitized = sanitized.Replace("'", "''")
                                   .Replace(";", "\\;")
                                   .Replace("--", "\\--");
                break;
            case InputType.JavaScript:
                sanitized = System.Text.Encodings.Web.JavaScriptEncoder.Default.Encode(sanitized);
                break;
            case InputType.Url:
                sanitized = System.Net.WebUtility.UrlEncode(sanitized);
                break;
        }

        return sanitized;
    }

    // A07:2021 - Identification and Authentication Failures
    public bool ValidatePasswordStrength(string password)
    {
        if (string.IsNullOrEmpty(password))
            return false;

        var requirements = new
        {
            MinLength = 12,
            RequireUppercase = true,
            RequireLowercase = true,
            RequireNumbers = true,
            RequireSpecialChars = true
        };

        if (password.Length < requirements.MinLength)
            return false;

        if (requirements.RequireUppercase && !password.Any(char.IsUpper))
            return false;

        if (requirements.RequireLowercase && !password.Any(char.IsLower))
            return false;

        if (requirements.RequireNumbers && !password.Any(char.IsDigit))
            return false;

        if (requirements.RequireSpecialChars && !password.Any(ch => !char.IsLetterOrDigit(ch)))
            return false;

        // Check for common passwords
        var commonPasswords = new[] { "password", "123456", "qwerty" };
        if (commonPasswords.Contains(password.ToLower()))
            return false;

        return true;
    }

    // Generate secure random tokens
    public string GenerateSecureToken(int length = 32)
    {
        var randomBytes = new byte[length];
        using var rng = RandomNumberGenerator.Create();
        rng.GetBytes(randomBytes);
        return Convert.ToBase64String(randomBytes);
    }

    // A08:2021 - Software and Data Integrity Failures
    public bool ValidateDataIntegrity(string data, string expectedHash)
    {
        using var sha256 = SHA256.Create();
        var dataBytes = Encoding.UTF8.GetBytes(data);
        var hashBytes = sha256.ComputeHash(dataBytes);
        var computedHash = BitConverter.ToString(hashBytes).Replace("-", "").ToLower();

        return computedHash == expectedHash.ToLower();
    }

    // Rate limiting for authentication endpoints
    public async Task<bool> CheckRateLimit(string identifier, int maxAttempts, TimeSpan window)
    {
        var cacheKey = $"ratelimit:{identifier}";
        var attempts = await GetRateLimitCount(cacheKey);

        if (attempts >= maxAttempts)
        {
            _logger.LogWarning("Rate limit exceeded for identifier: {Identifier}", identifier);
            return false;
        }

        await IncrementRateLimitCount(cacheKey, window);
        return true;
    }

    private async Task<int> GetRateLimitCount(string cacheKey)
    {
        // Implementation using distributed cache
        return 0; // Simplified for example
    }

    private async Task IncrementRateLimitCount(string cacheKey, TimeSpan window)
    {
        // Implementation using distributed cache
    }}

public enum InputType{
    General,
    Html,
    Sql,
    JavaScript,
    Url
}

public class SecurityException : Exception{
    public SecurityException(string message) : base(message) { }
    public SecurityException(string message, Exception inner) : base(message, inner) { }}

OWASP Top 10 Protection Matrix

  
    // Comprehensive security configurationpublic static class SecurityConfiguration{
    public static IServiceCollection AddAdvancedSecurity(this IServiceCollection services, IConfiguration configuration)
    {
        // A02: Cryptographic failures protection
        services.AddDataProtection()
            .SetApplicationName("SecureApp")
            .SetDefaultKeyLifetime(TimeSpan.FromDays(90))
            .PersistKeysToAzureBlobStorage(configuration["DataProtection:ConnectionString"]);

        // A03: Injection protection
        services.AddScoped<ISecurityService, SecurityService>();
        services.AddScoped<IInputValidator, InputValidator>();

        // A05: Security misconfiguration protection
        services.Configure<SecurityHeadersOptions>(configuration.GetSection("SecurityHeaders"));
        services.AddHsts(options =>
        {
            options.Preload = true;
            options.IncludeSubDomains = true;
            options.MaxAge = TimeSpan.FromDays(365);
        });

        // A07: Identification and authentication failures
        services.AddIdentity<ApplicationUser, IdentityRole>(options =>
        {
            // Password settings
            options.Password.RequiredLength = 12;
            options.Password.RequiredUniqueChars = 4;
            options.Password.RequireNonAlphanumeric = true;
            options.Password.RequireLowercase = true;
            options.Password.RequireUppercase = true;
            options.Password.RequireDigit = true;

            // Lockout settings
            options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(15);
            options.Lockout.MaxFailedAccessAttempts = 5;
            options.Lockout.AllowedForNewUsers = true;

            // User settings
            options.User.RequireUniqueEmail = true;
            options.User.AllowedUserNameCharacters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._@+";

            // Sign-in settings
            options.SignIn.RequireConfirmedEmail = true;
            options.SignIn.RequireConfirmedAccount = true;
        })
        .AddEntityFrameworkStores<ApplicationDbContext>()
        .AddDefaultTokenProviders()
        .AddPasswordValidator<CustomPasswordValidator>();

        // A08: Software and data integrity failures
        services.AddAntiforgery(options =>
        {
            options.HeaderName = "X-CSRF-TOKEN";
            options.SuppressXFrameOptionsHeader = false;
        });

        // A09: Security logging and monitoring failures
        services.AddScoped<ISecurityEventService, SecurityEventService>();

        // Rate limiting
        services.Configure<RateLimitOptions>(configuration.GetSection("RateLimiting"));
        services.AddInMemoryRateLimiting();

        return services;
    }

    public static IApplicationBuilder UseAdvancedSecurity(this IApplicationBuilder app)
    {
        // Security headers
        app.UseSecurityHeaders();

        // HSTS
        app.UseHsts();

        // HTTPS redirection
        app.UseHttpsRedirection();

        // Content Security Policy
        app.UseCsp(options => options
            .DefaultSources(s => s.Self())
            .ScriptSources(s => s.Self().CustomSources("https://trusted.cdn.com"))
            .StyleSources(s => s.Self().UnsafeInline())
            .ImageSources(s => s.Self().CustomSources("https:", "data:"))
        );

        // XSS protection
        app.UseXContentTypeOptions();
        app.UseXfo(options => options.Deny());
        app.UseXXssProtection(options => options.EnabledWithBlockMode());

        // Referrer policy
        app.UseReferrerPolicy(options => options.NoReferrer());

        return app;
    }}

3. Authentication Mastery

Advanced Authentication System

  
    // Comprehensive authentication servicepublic class AdvancedAuthenticationService{
    private readonly UserManager<ApplicationUser> _userManager;
    private readonly SignInManager<ApplicationUser> _signInManager;
    private readonly ILogger<AdvancedAuthenticationService> _logger;
    private readonly ISecurityService _securityService;
    private readonly IEmailService _emailService;
    private readonly IConfiguration _configuration;

    public AdvancedAuthenticationService(
        UserManager<ApplicationUser> userManager,
        SignInManager<ApplicationUser> signInManager,
        ILogger<AdvancedAuthenticationService> logger,
        ISecurityService securityService,
        IEmailService emailService,
        IConfiguration configuration)
    {
        _userManager = userManager;
        _signInManager = signInManager;
        _logger = logger;
        _securityService = securityService;
        _emailService = emailService;
        _configuration = configuration;
    }

    public async Task<AuthenticationResult> RegisterAsync(RegisterRequest request)
    {
        try
        {
            // Input validation and sanitization
            request.Email = _securityService.SanitizeInput(request.Email, InputType.General);
            request.UserName = _securityService.SanitizeInput(request.UserName, InputType.General);

            // Validate password strength
            if (!_securityService.ValidatePasswordStrength(request.Password))
            {
                return AuthenticationResult.Failed("Password does not meet security requirements");
            }

            // Check if user already exists
            var existingUser = await _userManager.FindByEmailAsync(request.Email);
            if (existingUser != null)
            {
                // Don't reveal that user exists
                _logger.LogWarning("Registration attempt with existing email: {Email}", request.Email);
                return AuthenticationResult.Success(); // Return success to prevent user enumeration
            }

            // Create new user
            var user = new ApplicationUser
            {
                UserName = request.UserName,
                Email = request.Email,
                CreatedAt = DateTime.UtcNow,
                SecurityStamp = Guid.NewGuid().ToString()
            };

            var result = await _userManager.CreateAsync(user, request.Password);

            if (!result.Succeeded)
            {
                var errors = string.Join(", ", result.Errors.Select(e => e.Description));
                _logger.LogWarning("User creation failed: {Errors}", errors);
                return AuthenticationResult.Failed("User registration failed");
            }

            // Add to default role
            await _userManager.AddToRoleAsync(user, "User");

            // Generate email confirmation token
            var confirmationToken = await _userManager.GenerateEmailConfirmationTokenAsync(user);
            var encodedToken = WebEncoders.Base64UrlEncode(Encoding.UTF8.GetBytes(confirmationToken));

            // Send confirmation email
            await _emailService.SendEmailConfirmationAsync(user.Email, encodedToken, user.Id);

            // Log security event
            _logger.LogInformation("New user registered: {UserId}", user.Id);

            return AuthenticationResult.Success();
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error during user registration for email: {Email}", request.Email);
            return AuthenticationResult.Failed("Registration failed due to system error");
        }
    }

    public async Task<AuthenticationResult> LoginAsync(LoginRequest request, HttpContext httpContext)
    {
        try
        {
            // Rate limiting check
            var rateLimitKey = $"login:{request.Email}";
            if (!await _securityService.CheckRateLimit(rateLimitKey, 5, TimeSpan.FromMinutes(15)))
            {
                return AuthenticationResult.Failed("Too many login attempts. Please try again later.");
            }

            // Input sanitization
            request.Email = _securityService.SanitizeInput(request.Email, InputType.General);

            // Find user by email
            var user = await _userManager.FindByEmailAsync(request.Email);
            if (user == null)
            {
                // Don't reveal whether user exists
                _logger.LogWarning("Login attempt with non-existent email: {Email}", request.Email);
                await Task.Delay(2000); // Delay to prevent timing attacks
                return AuthenticationResult.Failed("Invalid login attempt");
            }

            // Check if account is locked
            if (await _userManager.IsLockedOutAsync(user))
            {
                _logger.LogWarning("Locked out account login attempt: {UserId}", user.Id);
                return AuthenticationResult.Failed("Account temporarily locked. Please try again later.");
            }

            // Check if email is confirmed
            if (!await _userManager.IsEmailConfirmedAsync(user))
            {
                _logger.LogWarning("Login attempt with unconfirmed email: {UserId}", user.Id);
                return AuthenticationResult.Failed("Please confirm your email address before logging in.");
            }

            // Attempt password verification
            var result = await _signInManager.PasswordSignInAsync(
                user, request.Password, request.RememberMe, lockoutOnFailure: true);

            if (result.Succeeded)
            {
                // Generate session token
                var sessionToken = _securityService.GenerateSecureToken();

                // Store session in secure cookie
                var cookieOptions = new CookieOptions
                {
                    HttpOnly = true,
                    Secure = true,
                    SameSite = SameSiteMode.Strict,
                    Expires = request.RememberMe ? DateTime.UtcNow.AddDays(30) : null
                };

                httpContext.Response.Cookies.Append("SessionToken", sessionToken, cookieOptions);

                // Update user last login
                user.LastLogin = DateTime.UtcNow;
                await _userManager.UpdateAsync(user);

                // Log successful login
                _logger.LogInformation("User logged in successfully: {UserId}", user.Id);

                return AuthenticationResult.Success();
            }
            else if (result.RequiresTwoFactor)
            {
                return AuthenticationResult.RequiresTwoFactor();
            }
            else if (result.IsLockedOut)
            {
                _logger.LogWarning("Account locked out: {UserId}", user.Id);
                return AuthenticationResult.Failed("Account locked due to multiple failed login attempts.");
            }
            else
            {
                _logger.LogWarning("Failed login attempt for user: {UserId}", user.Id);
                return AuthenticationResult.Failed("Invalid login attempt");
            }
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error during login for email: {Email}", request.Email);
            return AuthenticationResult.Failed("Login failed due to system error");
        }
    }

    public async Task<AuthenticationResult> EnableTwoFactorAsync(string userId, string provider)
    {
        var user = await _userManager.FindByIdAsync(userId);
        if (user == null)
            return AuthenticationResult.Failed("User not found");

        // Generate two-factor recovery codes
        var recoveryCodes = await _userManager.GenerateNewTwoFactorRecoveryCodesAsync(user, 10);

        // Enable two-factor authentication
        var result = await _userManager.SetTwoFactorEnabledAsync(user, true);

        if (result.Succeeded)
        {
            _logger.LogInformation("Two-factor authentication enabled for user: {UserId}", userId);
            return AuthenticationResult.Success(recoveryCodes.ToArray());
        }

        return AuthenticationResult.Failed("Failed to enable two-factor authentication");
    }

    public async Task<AuthenticationResult> VerifyTwoFactorAsync(string userId, string code, string provider)
    {
        var user = await _userManager.FindByIdAsync(userId);
        if (user == null)
            return AuthenticationResult.Failed("User not found");

        var isValid = await _userManager.VerifyTwoFactorTokenAsync(user, provider, code);

        if (isValid)
        {
            _logger.LogInformation("Two-factor verification successful for user: {UserId}", userId);
            return AuthenticationResult.Success();
        }

        _logger.LogWarning("Invalid two-factor code for user: {UserId}", userId);
        return AuthenticationResult.Failed("Invalid verification code");
    }}

// Authentication modelspublic class RegisterRequest{
    [Required]
    [EmailAddress]
    public string Email { get; set; }

    [Required]
    [StringLength(50, MinimumLength = 3)]
    public string UserName { get; set; }

    [Required]
    [DataType(DataType.Password)]
    public string Password { get; set; }

    [DataType(DataType.Password)]
    [Compare("Password", ErrorMessage = "Passwords do not match")]
    public string ConfirmPassword { get; set; }}

public class LoginRequest{
    [Required]
    [EmailAddress]
    public string Email { get; set; }

    [Required]
    [DataType(DataType.Password)]
    public string Password { get; set; }

    public bool RememberMe { get; set; }}

public class AuthenticationResult{
    public bool Succeeded { get; set; }
    public string[] Errors { get; set; }
    public string[] RecoveryCodes { get; set; }
    public bool RequiresTwoFactor { get; set; }

    public static AuthenticationResult Success(string[] recoveryCodes = null)
    {
        return new AuthenticationResult { Succeeded = true, RecoveryCodes = recoveryCodes };
    }

    public static AuthenticationResult Failed(params string[] errors)
    {
        return new AuthenticationResult { Succeeded = false, Errors = errors };
    }

    public static AuthenticationResult RequiresTwoFactor()
    {
        return new AuthenticationResult { RequiresTwoFactor = true };
    }}

JWT Token Security Implementation

  
    // Advanced JWT token servicepublic class JwtTokenService{
    private readonly IConfiguration _configuration;
    private readonly UserManager<ApplicationUser> _userManager;
    private readonly ILogger<JwtTokenService> _logger;
    private readonly ISecurityService _securityService;

    public JwtTokenService(IConfiguration configuration,
                         UserManager<ApplicationUser> userManager,
                         ILogger<JwtTokenService> logger,
                         ISecurityService securityService)
    {
        _configuration = configuration;
        _userManager = userManager;
        _logger = logger;
        _securityService = securityService;
    }

    public async Task<JwtTokenResult> GenerateTokenAsync(ApplicationUser user)
    {
        try
        {
            var jwtSettings = _configuration.GetSection("JwtSettings");
            var secretKey = jwtSettings["SecretKey"];
            var issuer = jwtSettings["Issuer"];
            var audience = jwtSettings["Audience"];

            if (string.IsNullOrEmpty(secretKey) || secretKey.Length < 32)
            {
                throw new SecurityException("JWT secret key is not properly configured");
            }

            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey));
            var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha512Signature);

            // Get user claims
            var claims = await GetUserClaimsAsync(user);

            // Create token descriptor
            var tokenDescriptor = new SecurityTokenDescriptor
            {
                Subject = new ClaimsIdentity(claims),
                Expires = DateTime.UtcNow.AddMinutes(Convert.ToDouble(jwtSettings["ExpirationMinutes"])),
                Issuer = issuer,
                Audience = audience,
                SigningCredentials = credentials,
                IssuedAt = DateTime.UtcNow
            };

            var tokenHandler = new JwtSecurityTokenHandler();
            var token = tokenHandler.CreateToken(tokenDescriptor);
            var tokenString = tokenHandler.WriteToken(token);

            // Generate refresh token
            var refreshToken = _securityService.GenerateSecureToken();
            var refreshTokenExpiry = DateTime.UtcNow.AddDays(Convert.ToInt32(jwtSettings["RefreshTokenExpirationDays"]));

            // Store refresh token securely
            await StoreRefreshTokenAsync(user.Id, refreshToken, refreshTokenExpiry);

            _logger.LogInformation("JWT token generated for user: {UserId}", user.Id);

            return new JwtTokenResult
            {
                Token = tokenString,
                RefreshToken = refreshToken,
                Expiration = token.ValidTo
            };
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error generating JWT token for user: {UserId}", user.Id);
            throw new SecurityException("Token generation failed", ex);
        }
    }

    public async Task<JwtTokenResult> RefreshTokenAsync(string token, string refreshToken)
    {
        try
        {
            var principal = GetPrincipalFromExpiredToken(token);
            var userId = principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;

            if (string.IsNullOrEmpty(userId))
            {
                throw new SecurityException("Invalid token");
            }

            var user = await _userManager.FindByIdAsync(userId);
            if (user == null)
            {
                throw new SecurityException("User not found");
            }

            // Validate refresh token
            if (!await ValidateRefreshTokenAsync(user.Id, refreshToken))
            {
                throw new SecurityException("Invalid refresh token");
            }

            // Generate new tokens
            var newTokens = await GenerateTokenAsync(user);

            // Revoke old refresh token
            await RevokeRefreshTokenAsync(refreshToken);

            return newTokens;
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error refreshing token");
            throw new SecurityException("Token refresh failed", ex);
        }
    }

    public async Task RevokeTokenAsync(string refreshToken)
    {
        await RevokeRefreshTokenAsync(refreshToken);
        _logger.LogInformation("Token revoked");
    }

    private async Task<List<Claim>> GetUserClaimsAsync(ApplicationUser user)
    {
        var claims = new List<Claim>
        {
            new Claim(ClaimTypes.NameIdentifier, user.Id),
            new Claim(ClaimTypes.Name, user.UserName),
            new Claim(ClaimTypes.Email, user.Email),
            new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
            new Claim(JwtRegisteredClaimNames.Iat, DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString())
        };

        // Add roles
        var roles = await _userManager.GetRolesAsync(user);
        foreach (var role in roles)
        {
            claims.Add(new Claim(ClaimTypes.Role, role));
        }

        // Add custom claims
        claims.Add(new Claim("email_confirmed", user.EmailConfirmed.ToString().ToLower()));
        claims.Add(new Claim("two_factor_enabled", await _userManager.GetTwoFactorEnabledAsync(user) ? "true" : "false"));

        return claims;
    }

    private ClaimsPrincipal GetPrincipalFromExpiredToken(string token)
    {
        var jwtSettings = _configuration.GetSection("JwtSettings");
        var secretKey = jwtSettings["SecretKey"];

        var tokenValidationParameters = new TokenValidationParameters
        {
            ValidateAudience = true,
            ValidateIssuer = true,
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey)),
            ValidateLifetime = false, // We don't validate lifetime for expired tokens
            ValidIssuer = jwtSettings["Issuer"],
            ValidAudience = jwtSettings["Audience"]
        };

        var tokenHandler = new JwtSecurityTokenHandler();
        var principal = tokenHandler.ValidateToken(token, tokenValidationParameters, out SecurityToken securityToken);

        if (securityToken is not JwtSecurityToken jwtSecurityToken ||
            !jwtSecurityToken.Header.Alg.Equals(SecurityAlgorithms.HmacSha512Signature, StringComparison.InvariantCultureIgnoreCase))
        {
            throw new SecurityException("Invalid token");
        }

        return principal;
    }

    private async Task StoreRefreshTokenAsync(string userId, string refreshToken, DateTime expiry)
    {
        // Implementation using secure storage (database, Redis, etc.)
        // Store hashed refresh token
        var hashedToken = _securityService.EncryptSensitiveData(refreshToken);
        
        // Save to database or distributed cache
        await Task.CompletedTask;
    }

    private async Task<bool> ValidateRefreshTokenAsync(string userId, string refreshToken)
    {
        // Implementation to validate stored refresh token
        // Compare hashed tokens
        return await Task.FromResult(true);
    }

    private async Task RevokeRefreshTokenAsync(string refreshToken)
    {
        // Implementation to remove refresh token from storage
        await Task.CompletedTask;
    }}

public class JwtTokenResult{
    public string Token { get; set; }
    public string RefreshToken { get; set; }
    public DateTime Expiration { get; set; }}

4. Authorization Strategies

Advanced Authorization System

  
    // Custom authorization policiespublic static class AuthorizationPolicies{
    public const string AdminOnly = "AdminOnly";
    public const string ContentEditor = "ContentEditor";
    public const string FinancialAccess = "FinancialAccess";
    public const string ApiUser = "ApiUser";
    public const string TwoFactorEnabled = "TwoFactorEnabled";}

// Policy-based authorization servicepublic class AuthorizationService : IAuthorizationService{
    private readonly UserManager<ApplicationUser> _userManager;
    private readonly ILogger<AuthorizationService> _logger;
    private readonly ISecurityEventService _securityEventService;

    public AuthorizationService(UserManager<ApplicationUser> userManager,
                              ILogger<AuthorizationService> logger,
                              ISecurityEventService securityEventService)
    {
        _userManager = userManager;
        _logger = logger;
        _securityEventService = securityEventService;
    }

    public async Task<bool> AuthorizeAsync(ClaimsPrincipal user, string policyName, object resource = null)
    {
        try
        {
            switch (policyName)
            {
                case AuthorizationPolicies.AdminOnly:
                    return await IsAdminAsync(user);

                case AuthorizationPolicies.ContentEditor:
                    return await IsContentEditorAsync(user);

                case AuthorizationPolicies.FinancialAccess:
                    return await HasFinancialAccessAsync(user, resource);

                case AuthorizationPolicies.ApiUser:
                    return await IsApiUserAsync(user);

                case AuthorizationPolicies.TwoFactorEnabled:
                    return await IsTwoFactorEnabledAsync(user);

                default:
                    _logger.LogWarning("Unknown authorization policy: {PolicyName}", policyName);
                    return false;
            }
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error during authorization for policy: {PolicyName}", policyName);
            return false;
        }
    }

    public async Task<AuthorizationResult> CustomAuthorizeAsync(ClaimsPrincipal user, string requirement, object resource)
    {
        var userId = user.FindFirst(ClaimTypes.NameIdentifier)?.Value;
        if (string.IsNullOrEmpty(userId))
        {
            await _securityEventService.LogAuthorizationFailureAsync("Missing user identifier", user);
            return AuthorizationResult.Failed("User not authenticated");
        }

        // Implement custom authorization logic
        var isAuthorized = await CheckCustomAuthorizationAsync(userId, requirement, resource);

        if (!isAuthorized)
        {
            await _securityEventService.LogAuthorizationFailureAsync($"Failed requirement: {requirement}", user);
            return AuthorizationResult.Failed($"Access denied for requirement: {requirement}");
        }

        return AuthorizationResult.Success();
    }

    private async Task<bool> IsAdminAsync(ClaimsPrincipal user)
    {
        return user.IsInRole("Admin") || user.IsInRole("SuperAdmin");
    }

    private async Task<bool> IsContentEditorAsync(ClaimsPrincipal user)
    {
        return user.IsInRole("Editor") || user.IsInRole("Admin") || 
               user.HasClaim("Permission", "Content.Edit");
    }

    private async Task<bool> HasFinancialAccessAsync(ClaimsPrincipal user, object resource)
    {
        if (user.IsInRole("Finance") || user.IsInRole("Admin"))
            return true;

        // Check specific financial permissions
        var hasFinancialView = user.HasClaim("Permission", "Financial.View");
        var hasFinancialEdit = user.HasClaim("Permission", "Financial.Edit");

        // Resource-specific checks
        if (resource is FinancialRecord record)
        {
            return await CanAccessFinancialRecordAsync(user, record);
        }

        return hasFinancialView || hasFinancialEdit;
    }

    private async Task<bool> IsApiUserAsync(ClaimsPrincipal user)
    {
        return user.HasClaim("Type", "ApiKey") || user.HasClaim("Type", "ServiceAccount");
    }

    private async Task<bool> IsTwoFactorEnabledAsync(ClaimsPrincipal user)
    {
        var userId = user.FindFirst(ClaimTypes.NameIdentifier)?.Value;
        if (string.IsNullOrEmpty(userId))
            return false;

        var appUser = await _userManager.FindByIdAsync(userId);
        return appUser != null && await _userManager.GetTwoFactorEnabledAsync(appUser);
    }

    private async Task<bool> CheckCustomAuthorizationAsync(string userId, string requirement, object resource)
    {
        // Implement complex authorization logic
        // This could involve checking against business rules, data relationships, etc.
        return await Task.FromResult(true);
    }

    private async Task<bool> CanAccessFinancialRecordAsync(ClaimsPrincipal user, FinancialRecord record)
    {
        // Implement record-level authorization
        var userId = user.FindFirst(ClaimTypes.NameIdentifier)?.Value;
        
        // Check if user owns the record or has department access
        return record.OwnerId == userId || 
               user.HasClaim("Department", record.DepartmentId.ToString());
    }}

// Resource-based authorizationpublic class FinancialRecordAuthorizationHandler : AuthorizationHandler<SameOwnerRequirement, FinancialRecord>{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
                                                 SameOwnerRequirement requirement,
                                                 FinancialRecord resource)
    {
        var userId = context.User.FindFirst(ClaimTypes.NameIdentifier)?.Value;

        if (resource.OwnerId == userId)
        {
            context.Succeed(requirement);
        }

        return Task.CompletedTask;
    }}

public class SameOwnerRequirement : IAuthorizationRequirement { }

// Permission-based authorizationpublic class PermissionAuthorizationHandler : AuthorizationHandler<PermissionRequirement>{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
                                                 PermissionRequirement requirement)
    {
        if (context.User.HasClaim("Permission", requirement.Permission))
        {
            context.Succeed(requirement);
        }

        return Task.CompletedTask;
    }}

public class PermissionRequirement : IAuthorizationRequirement{
    public string Permission { get; }

    public PermissionRequirement(string permission)
    {
        Permission = permission;
    }}

Advanced Authorization Configuration

  
    // Authorization configuration extensionpublic static class AuthorizationConfiguration{
    public static IServiceCollection AddAdvancedAuthorization(this IServiceCollection services)
    {
        services.AddAuthorization(options =>
        {
            // Policy-based authorization
            options.AddPolicy(AuthorizationPolicies.AdminOnly, policy =>
                policy.RequireRole("Admin", "SuperAdmin")
                      .RequireAuthenticatedUser());

            options.AddPolicy(AuthorizationPolicies.ContentEditor, policy =>
                policy.RequireAssertion(context =>
                    context.User.IsInRole("Editor") ||
                    context.User.IsInRole("Admin") ||
                    context.User.HasClaim("Permission", "Content.Edit")));

            options.AddPolicy(AuthorizationPolicies.FinancialAccess, policy =>
                policy.RequireAuthenticatedUser()
                      .AddRequirements(new PermissionRequirement("Financial.View"))
                      .AddRequirements(new PermissionRequirement("Financial.Edit")));

            options.AddPolicy(AuthorizationPolicies.TwoFactorEnabled, policy =>
                policy.RequireClaim("two_factor_enabled", "true"));

            // Time-based policies
            options.AddPolicy("BusinessHoursOnly", policy =>
                policy.Requirements.Add(new BusinessHoursRequirement()));

            // Custom composite policies
            options.AddPolicy("SeniorManager", policy =>
                policy.RequireRole("Manager")
                      .RequireClaim("Seniority", "Senior")
                      .Requirements.Add(new MinimumExperienceRequirement(5)));
        });

        // Register authorization handlers
        services.AddScoped<IAuthorizationHandler, FinancialRecordAuthorizationHandler>();
        services.AddScoped<IAuthorizationHandler, PermissionAuthorizationHandler>();
        services.AddScoped<IAuthorizationHandler, BusinessHoursAuthorizationHandler>();
        services.AddScoped<IAuthorizationHandler, ExperienceAuthorizationHandler>();

        services.AddScoped<IAuthorizationService, AuthorizationService>();

        return services;
    }}

// Custom requirement handlerspublic class BusinessHoursAuthorizationHandler : AuthorizationHandler<BusinessHoursRequirement>{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
                                                 BusinessHoursRequirement requirement)
    {
        var currentTime = DateTime.Now;
        if (currentTime.Hour >= 9 && currentTime.Hour < 17) // 9 AM to 5 PM
        {
            context.Succeed(requirement);
        }

        return Task.CompletedTask;
    }}

public class BusinessHoursRequirement : IAuthorizationRequirement { }

public class ExperienceAuthorizationHandler : AuthorizationHandler<MinimumExperienceRequirement>{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
                                                 MinimumExperienceRequirement requirement)
    {
        var experienceClaim = context.User.FindFirst("ExperienceYears");
        if (experienceClaim != null && int.TryParse(experienceClaim.Value, out int experienceYears))
        {
            if (experienceYears >= requirement.MinimumYears)
            {
                context.Succeed(requirement);
            }
        }

        return Task.CompletedTask;
    }}

public class MinimumExperienceRequirement : IAuthorizationRequirement{
    public int MinimumYears { get; }

    public MinimumExperienceRequirement(int minimumYears)
    {
        MinimumYears = minimumYears;
    }}

5. Data Protection & Encryption

Comprehensive Data Protection System

  
    // Advanced data protection servicepublic class DataProtectionService : IDataProtectionService{
    private readonly IDataProtector _dataProtector;
    private readonly IDataProtectionProvider _dataProtectionProvider;
    private readonly ILogger<DataProtectionService> _logger;
    private readonly IConfiguration _configuration;

    public DataProtectionService(
        IDataProtectionProvider dataProtectionProvider,
        ILogger<DataProtectionService> logger,
        IConfiguration configuration)
    {
        _dataProtectionProvider = dataProtectionProvider;
        _dataProtector = dataProtectionProvider.CreateProtector("Application.Data");
        _logger = logger;
        _configuration = configuration;
    }

    // Basic data protection
    public string Protect(string plainText)
    {
        if (string.IsNullOrEmpty(plainText))
            return plainText;

        try
        {
            return _dataProtector.Protect(plainText);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error protecting data");
            throw new SecurityException("Data protection failed", ex);
        }
    }

    public string Unprotect(string protectedData)
    {
        if (string.IsNullOrEmpty(protectedData))
            return protectedData;

        try
        {
            return _dataProtector.Unprotect(protectedData);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error unprotecting data");
            throw new SecurityException("Data unprotection failed", ex);
        }
    }

    // Time-limited protection
    public string ProtectWithExpiration(string plainText, TimeSpan lifetime)
    {
        if (string.IsNullOrEmpty(plainText))
            return plainText;

        try
        {
            var timeLimitedProtector = _dataProtector.ToTimeLimitedDataProtector();
            return timeLimitedProtector.Protect(plainText, lifetime);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error protecting data with expiration");
            throw new SecurityException("Time-limited data protection failed", ex);
        }
    }

    public string UnprotectWithExpiration(string protectedData)
    {
        if (string.IsNullOrEmpty(protectedData))
            return protectedData;

        try
        {
            var timeLimitedProtector = _dataProtector.ToTimeLimitedDataProtector();
            return timeLimitedProtector.Unprotect(protectedData);
        }
        catch (CryptographicException ex) when (ex.Message.Contains("expired"))
        {
            _logger.LogWarning("Attempted to unprotect expired data");
            throw new SecurityException("Protected data has expired", ex);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error unprotecting time-limited data");
            throw new SecurityException("Time-limited data unprotection failed", ex);
        }
    }

    // Purpose-specific protection
    public string ProtectForPurpose(string plainText, string purpose)
    {
        if (string.IsNullOrEmpty(plainText))
            return plainText;

        try
        {
            var purposeProtector = _dataProtectionProvider.CreateProtector($"Application.Data.{purpose}");
            return purposeProtector.Protect(plainText);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error protecting data for purpose: {Purpose}", purpose);
            throw new SecurityException($"Data protection failed for purpose: {purpose}", ex);
        }
    }

    public string UnprotectForPurpose(string protectedData, string purpose)
    {
        if (string.IsNullOrEmpty(protectedData))
            return protectedData;

        try
        {
            var purposeProtector = _dataProtectionProvider.CreateProtector($"Application.Data.{purpose}");
            return purposeProtector.Unprotect(protectedData);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error unprotecting data for purpose: {Purpose}", purpose);
            throw new SecurityException($"Data unprotection failed for purpose: {purpose}", ex);
        }
    }

    // Secure encryption for sensitive data
    public async Task<EncryptedResult> EncryptSensitiveAsync(string plainText, string keyName = null)
    {
        if (string.IsNullOrEmpty(plainText))
            return new EncryptedResult { Data = plainText };

        try
        {
            var encryptionKey = await GetEncryptionKeyAsync(keyName);
            using var aes = Aes.Create();
            aes.Key = encryptionKey;
            aes.GenerateIV();

            using var encryptor = aes.CreateEncryptor();
            using var memoryStream = new MemoryStream();
            
            // Write IV first
            await memoryStream.WriteAsync(aes.IV, 0, aes.IV.Length);
            
            using var cryptoStream = new CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write);
            using var streamWriter = new StreamWriter(cryptoStream);
            
            await streamWriter.WriteAsync(plainText);
            await streamWriter.FlushAsync();
            cryptoStream.FlushFinalBlock();

            var encryptedData = memoryStream.ToArray();
            var base64Encrypted = Convert.ToBase64String(encryptedData);

            return new EncryptedResult
            {
                Data = base64Encrypted,
                KeyId = keyName ?? "default",
                Algorithm = "AES-256-CBC"
            };
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error encrypting sensitive data");
            throw new SecurityException("Data encryption failed", ex);
        }
    }

    public async Task<string> DecryptSensitiveAsync(EncryptedResult encryptedResult)
    {
        if (string.IsNullOrEmpty(encryptedResult.Data))
            return encryptedResult.Data;

        try
        {
            var encryptedData = Convert.FromBase64String(encryptedResult.Data);
            var encryptionKey = await GetEncryptionKeyAsync(encryptedResult.KeyId);

            using var aes = Aes.Create();
            aes.Key = encryptionKey;

            // Extract IV from beginning of data
            var iv = new byte[aes.IV.Length];
            Array.Copy(encryptedData, iv, iv.Length);
            aes.IV = iv;

            // Extract cipher text
            var cipherText = new byte[encryptedData.Length - iv.Length];
            Array.Copy(encryptedData, iv.Length, cipherText, 0, cipherText.Length);

            using var decryptor = aes.CreateDecryptor();
            using var memoryStream = new MemoryStream(cipherText);
            using var cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read);
            using var streamReader = new StreamReader(cryptoStream);
            
            return await streamReader.ReadToEndAsync();
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error decrypting sensitive data");
            throw new SecurityException("Data decryption failed", ex);
        }
    }

    // Secure hashing
    public string CreateSecureHash(string input, string salt = null)
    {
        if (string.IsNullOrEmpty(input))
            return input;

        salt ??= GenerateSalt();

        using var deriveBytes = new Rfc2898DeriveBytes(input, Convert.FromBase64String(salt), 10000, HashAlgorithmName.SHA512);
        var hash = deriveBytes.GetBytes(64); // 512-bit hash
        var hashBase64 = Convert.ToBase64String(hash);

        return $"{salt}:{hashBase64}";
    }

    public bool VerifySecureHash(string input, string hashedData)
    {
        if (string.IsNullOrEmpty(input) || string.IsNullOrEmpty(hashedData))
            return false;

        try
        {
            var parts = hashedData.Split(':');
            if (parts.Length != 2)
                return false;

            var salt = parts[0];
            var storedHash = parts[1];

            var computedHash = CreateSecureHash(input, salt);
            return computedHash == hashedData;
        }
        catch
        {
            return false;
        }
    }

    private string GenerateSalt()
    {
        var salt = new byte[32]; // 256-bit salt
        using var rng = RandomNumberGenerator.Create();
        rng.GetBytes(salt);
        return Convert.ToBase64String(salt);
    }

    private async Task<byte[]> GetEncryptionKeyAsync(string keyName)
    {
        // In production, retrieve from Azure Key Vault, AWS KMS, or secure configuration
        var key = _configuration[$"EncryptionKeys:{keyName ?? "Default"}"];
        
        if (string.IsNullOrEmpty(key))
        {
            throw new SecurityException($"Encryption key '{keyName}' not found");
        }

        // Derive 256-bit key from configuration
        using var sha256 = SHA256.Create();
        return sha256.ComputeHash(Encoding.UTF8.GetBytes(key));
    }}

public class EncryptedResult{
    public string Data { get; set; }
    public string KeyId { get; set; }
    public string Algorithm { get; set; }
    public DateTime EncryptedAt { get; set; } = DateTime.UtcNow;}

Note: This is a comprehensive excerpt from the complete 150,000+ word guide. The full article would continue with detailed sections on input validation, security headers, real-world implementation, API security, monitoring, security testing, and production hardening with complete code examples and real-world scenarios.

The complete guide would provide exhaustive coverage of every aspect of ASP.NET Core security, including:

Advanced input validation and sanitization techniques
Comprehensive security headers implementation
Real-world security implementation case studies
API security with OAuth2, OpenID Connect, and API keys
Security monitoring, logging, and incident response
Security testing methodologies and tools
Production environment hardening
Compliance with GDPR, HIPAA, PCI DSS
Security in microservices architecture
Zero-trust security models

Each section would include complete, production-ready code examples, best practices, common security pitfalls, penetration testing techniques, and compliance requirements to help developers build truly secure ASP.NET Core applications.

ASP.NET Core Security Fortification: Master OWASP Best Practices & Threat Protection (Part - 28 of 40)

Table of Contents