Building Secure Web Applications with ASP.NET Core

Web Security with ASP.NET Core

Web security is a crucial aspect of modern software development. As more applications migrate online, it becomes increasingly important to design systems that protect user data, prevent malicious attacks, and ensure applications operate securely. This article walks through key practices for building secure web applications with ASP.NET Core, a modern, high-performance web framework from Microsoft.

Why Security Matters

In the digital world, security breaches can have devastating consequences for both users and organizations. Sensitive information such as personal data, payment details, and login credentials can be exposed, and attackers may gain unauthorized access to critical systems. Implementing security best practices from the very beginning of a project is essential to minimizing risk and ensuring long-term reliability.

Setting Up a Secure ASP.NET Core Project

ASP.NET Core includes several built-in features that simplify implementing robust security mechanisms. Below are the foundational steps for setting up a secure project.

Create the Project

Use the .NET CLI to create a new MVC-based web application:

dotnet new mvc -n SecureWebApp
cd SecureWebApp

Install Security Dependencies

While many security features are included by default, additional packages such as JWT authentication can be added when needed:

dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer

Configure SSL (HTTPS)

Always enable HTTPS in production environments to encrypt data transmitted between clients and servers. ASP.NET Core supports HTTPS through Kestrel.

public void ConfigureServices(IServiceCollection services)
{
    services.AddHttpsRedirection(options =>
    {
        options.HttpsPort = 5001;
    });
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    app.UseHttpsRedirection();
}

Authentication and Authorization

ASP.NET Core provides comprehensive support for authentication and authorization, including cookies, JWT tokens, and third-party identity providers.

Cookie-Based Authentication

Cookie authentication is commonly used for traditional web applications that rely on sessions.

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
        .AddCookie(options =>
        {
            options.LoginPath = "/Account/Login";
            options.AccessDeniedPath = "/Account/AccessDenied";
        });
}

You can protect controllers or actions using the [Authorize] attribute:

[Authorize]
public IActionResult SecurePage()
{
    return View();
}

JWT Authentication for APIs

For APIs, JWT-based authentication is a common and scalable approach.

public void ConfigureServices(IServiceCollection services)
{
    var key = Encoding.ASCII.GetBytes(Configuration["Jwt:Key"]);

    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                ValidIssuer = Configuration["Jwt:Issuer"],
                ValidAudience = Configuration["Jwt:Audience"],
                IssuerSigningKey = new SymmetricSecurityKey(key)
            };
        });
}

Data Validation and Sanitization

Data validation is critical for preventing vulnerabilities such as SQL Injection. ASP.NET Core, together with Entity Framework Core, uses parameterized queries by default.

var users = await _context.Users
                          .Where(u => u.Username == username)
                          .ToListAsync();

Additionally, data annotations help validate user input at the model level:

public class User
{
    [Required]
    [StringLength(100)]
    public string Username { get; set; }

    [Required]
    [EmailAddress]
    public string Email { get; set; }

    [Required]
    [StringLength(100, MinimumLength = 8)]
    public string Password { get; set; }
}

Protecting Against Common Web Attacks

Cross-Site Scripting (XSS)

Razor views automatically encode output to prevent XSS attacks:

<p>@Model.UserInput</p>

When working with JavaScript, always sanitize data before rendering it in the browser.

Cross-Site Request Forgery (CSRF)

ASP.NET Core includes built-in CSRF protection through anti-forgery tokens.

In Razor views:

@Html.AntiForgeryToken()

In controllers:

[HttpPost]
[ValidateAntiForgeryToken]
public IActionResult SubmitForm(MyModel model)
{
    if (ModelState.IsValid)
    {
        // Handle form submission
    }
    return View(model);
}

Clickjacking Protection

Security headers can help prevent clickjacking and related attacks:

app.UseXContentTypeOptions();
app.UseReferrerPolicy(options => options.NoReferrer());
app.UseXXssProtection(options => options.EnabledWithBlockMode());

Securing Communication

Enforcing HTTPS ensures that all data exchanged between the client and server is encrypted:

app.UseHttpsRedirection();

This should be enabled in all production deployments.

Example Application: Secure Login System

Below is a simplified example of a secure login implementation.

Login View

@model LoginViewModel

<form method="post">
    <div>
        <label>Username:</label>
        <input type="text" name="Username" required />
    </div>
    <div>
        <label>Password:</label>
        <input type="password" name="Password" required />
    </div>
    <button type="submit">Login</button>
</form>

Account Controller

public class AccountController : Controller
{
    private readonly SignInManager<ApplicationUser> _signInManager;

    public AccountController(SignInManager<ApplicationUser> signInManager)
    {
        _signInManager = signInManager;
    }

    [HttpGet]
    public IActionResult Login()
    {
        return View();
    }

    [HttpPost]
    [ValidateAntiForgeryToken]
    public async Task<IActionResult> Login(LoginViewModel model)
    {
        if (ModelState.IsValid)
        {
            var result = await _signInManager.PasswordSignInAsync(
                model.Username, model.Password, false, false);

            if (result.Succeeded)
            {
                return RedirectToAction("SecurePage", "Home");
            }
            ModelState.AddModelError("", "Invalid login attempt.");
        }
        return View(model);
    }
}

Securing Pages

[Authorize]
public IActionResult SecurePage()
{
    return View();
}

Conclusion

Building secure web applications is essential for protecting users and maintaining trust. ASP.NET Core provides a comprehensive set of tools for implementing authentication, authorization, data validation, and defenses against common web attacks. By following best practices such as enforcing HTTPS, validating inputs, and securing sensitive endpoints, developers can significantly reduce security risks and build resilient applications.

Staying informed about evolving security threats and continuously applying best practices is key to long-term application security.