ASP.NET Core  

Key Security Rules & Best Practices for ASP.NET Core Projects

Introduction


In this article, we will see the key security rules & best practices for ASP.NET Core projects.

Before we start, please take a look at my last article on ASP.NET Core.

Now, let's get started.

1. Use HTTPS Everywhere

  • Enforce HTTPS

  
    app.UseHttpsRedirection();

  • Add HSTS (HTTP Strict Transport Security)

  
    app.UseHsts();

  • Redirect all HTTP to HTTPS in reverse proxies (NGINX, IIS, Azure).

2. Authentication & Authorization

  • Use ASP.NETCore Identity or external providers (OAuth2, OpenID Connect).

  • Never roll your own auth.

  • Role-based & policy-based authorization:

  
    services.AddAuthorization(options =>
{
    options.AddPolicy("AdminOnly", policy => policy.RequireRole("Admin"));
});

  • Secure API endpoints with [Authorize]

3. Protect Against XSS (Cross-Site Scripting)

  • Razor automatically HTML-encodes output:

  
    @Html.DisplayFor(model => model.Name)   //  safe
 @Model.Name   //  safe
 @Html.Raw(Model.Name)  //  unsafe unless sanitized

  • Use libraries like Ganss.XSS to sanitize user input.

  • Set Content Security Policy (CSP) headers.

4. Prevent CSRF (Cross-Site Request Forgery)

  • MVC & Razor Pages have anti-forgery tokens built-in:

  
    <form asp-action="PostData">
    @Html.AntiForgeryToken()
</form>

  • In controllers:

  
    [ValidateAntiForgeryToken]
 public IActionResult PostData(MyModel model) { ... }

  • For APIs: use JWT or the Double Submit Cookie pattern instead.

5. Secure Cookies

  • Use cookie options :

  
    options.Cookie.HttpOnly = true;   // JS can’t access
 options.Cookie.SecurePolicy = CookieSecurePolicy.Always; // Only HTTPS
 options.Cookie.SameSite = SameSiteMode.Strict; // Prevent CSRF

6. Store Secrets Securely

  • Never hardcode secrets (DB passwords, API keys) in appsettings.json .

  • Use:

    • User Secrets (for development).

    • Azure Key Vault / AWS Secrets Manager / HashiCorp Vault (for production).

  
    builder.Configuration.AddUserSecrets<Program>();

7. Secure Database Access

  • Always use parameterized queries (EF Core does this by default).

  • Apply least privilege principle to DB accounts.

  • Validate and sanitize all user input before queries.

8. Use Strong Authentication for APIs

  • Use JWT or OpenID Connect for APIs.

  • Short-lived tokens + refresh tokens.

  • Store tokens securely in HttpOnly cookies or secure storage (not localStorage).

9. Logging & Error Handling

  • Don’t expose stack traces to users:

  
    if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Home/Error");
}

  • Use structured logging with Serilog, Seq, or Application Insights.

  • Log security events (login attempts, access denials).

10. Disable Dangerous Features

  • Turn off directory browsing.

  • Don’t expose detailed errors in production.

  • Limit CORS :

  
    services.AddCors(options =>
{
    options.AddPolicy("DefaultPolicy", builder =>
        builder.WithOrigins("https://yourapp.com")
               .AllowAnyHeader()
               .AllowAnyMethod());
});

11. Keep Framework & Dependencies Updated

  • Always patch to the latest ASP.NET Core version.

  • Use tools like Dependabot, dotnet list package --outdated.

  • Remove unused dependencies (minimize attack surface).

12. Apply Principle of Least Privilege

  • Separate environments (Dev/Test/Prod).

  • Don’t run the app as admin/root.

  • Limit file system & DB access to only what’s required.

Note: Following these rules will cover 80–90% of common attack vectors (XSS, CSRF, SQL injection, weak cookies, leaked secrets, etc.).

Conclusion

In this article, I have tried to cover key security rules & best practices for ASP.NET Core projects.

Membership not found