Using Certificates For API Authentication In .NET 5

Next, add a new class called “CertificateValidation” and add the below code to it,

using System;
using System.Linq;
using System.Security.Cryptography.X509Certificates;
namespace WebAppCerts {
    public class CertificateValidation {
        public bool ValidateCertificate(X509Certificate2 clientCertificate) {
            string[] allowedThumbprints = {
                "7ED035ABAB1B8CCDFF561935D3C55BE91EAB3DFB"
            };
            if (allowedThumbprints.Contains(clientCertificate.Thumbprint)) {
                return true;
            }
            return false;
        }
    }
}

You will need to replace the client certificate thumbnail in the string array called “allowedThumprints” above.

Next, add the below Nugget package.

Next, update the Startup.cs file as below,

using Microsoft.AspNetCore.Authentication.Certificate;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.HttpsPolicy;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Logging;
using Microsoft.OpenApi.Models;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
namespace WebAppCerts {
    public class Startup {
        public Startup(IConfiguration configuration) {
            Configuration = configuration;
        }
        public IConfiguration Configuration {
            get;
        }
        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services) {
            services.AddControllers();
            services.AddTransient < CertificateValidation > ();
            services.AddAuthentication(CertificateAuthenticationDefaults.AuthenticationScheme).AddCertificate(options => {
                options.AllowedCertificateTypes = CertificateTypes.SelfSigned;
                options.Events = new CertificateAuthenticationEvents {
                    OnCertificateValidated = context => {
                            var validationService = context.HttpContext.RequestServices.GetService < CertificateValidation > ();
                            if (validationService.ValidateCertificate(context.ClientCertificate)) {
                                context.Success();
                            } else {
                                context.Fail("Invalid certificate");
                            }
                            return Task.CompletedTask;
                        },
                        OnAuthenticationFailed = context => {
                            context.Fail("Invalid certificate");
                            return Task.CompletedTask;
                        }
                };
            });
            services.AddSwaggerGen(c => {
                c.SwaggerDoc("v1", new OpenApiInfo {
                    Title = "WebAppCerts", Version = "v1"
                });
            });
        }
        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env) {
            if (env.IsDevelopment()) {
                app.UseDeveloperExceptionPage();
                app.UseSwagger();
                app.UseSwaggerUI(c => c.SwaggerEndpoint("/swagger/v1/swagger.json", "WebAppCerts v1"));
            }
            app.UseHttpsRedirection();
            app.UseRouting();
            app.UseAuthentication();
            app.UseAuthorization();
            app.UseEndpoints(endpoints => {
                endpoints.MapControllers();
            });
        }
    }
}

As we will be using Kestrel to run this application, let us set it to use certificates. Update the Program.cs file as below,

using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Server.Kestrel.Https;
using Microsoft.Extensions.Hosting;
namespace WebAppCerts {
    public class Program {
        public static void Main(string[] args) {
            CreateHostBuilder(args).Build().Run();
        }
        public static IHostBuilder CreateHostBuilder(string[] args) => Host.CreateDefaultBuilder(args).ConfigureWebHostDefaults(webBuilder => {
            webBuilder.UseStartup < Startup > ();
            webBuilder.ConfigureKestrel(o => {
                o.ConfigureHttpsDefaults(o => o.ClientCertificateMode = ClientCertificateMode.AllowCertificate);
            });
        });
    }
}

Finally, let us create two Controller endpoints. One will require a certificate to work and the other will not. Create a new empty API controller called “TestController” as below,

Add the below code to the new controller,

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
namespace WebAppCerts.Controllers {
    [Route("api/[controller]")]
    [ApiController]
    public class TestController: ControllerBase {
        [HttpGet]
        public string Get() => "The action works fine without a certificate";
        [Authorize]
        [HttpPost]
        public string Post() => "The action works fine only with a certificate";
    }
}

The code is now done, and we will test it using Postman. Run the application using Kestrel (The project name)

Let us now test using Postman,

The Get action works fine as this does not need a certificate.

However, the POST call will give a 403 Forbidden message as it requires a certificate.

Let us attach the client certificate to the POST request.

Select the grid on the top right corner and then select “Certificates” and add Certificate.

Here, add the client certificate as below:

The certificate is now added as below,

Now, when we make the POST request, all works fine as below,

Summary

In this article, we looked at how to generate a self-signed certificate for the Certification Authority and then how to generate a client certificate from it. Next, we saw how to protect our .NET 5 WEB API endpoints using these certificates. This provides a way to secure our endpoints. I tested it using Postman and in a future article, I will demonstrate how to attach the client certificate and make this call using a .NET 5 client. Happy coding!