Security, IAM & cryptography

builder.Services.AddAuthentication().AddJwtBearer(); // settings from "Authentication:Schemes:Bearer"
builder.Services.AddAuthorizationBuilder()
    .AddPolicy("orders.write", p => p.RequireRole("Orders.Writer"))
    .AddPolicy("finance", p => p.RequireClaim("department", "Finance"));

var app = builder.Build();
app.UseAuthentication();   // who are you?  no or bad token -> 401 (challenge)
app.UseAuthorization();    // what can you do?  policy fails -> 403 (forbid)

app.MapPost("/orders", CreateOrder).RequireAuthorization("orders.write");

// Protect an API with Entra ID (reads TenantId, ClientId from the "AzureAd" section)
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));

// Service-to-service with a managed identity: no passwords or secrets in config
var blobs = new BlobServiceClient(
    new Uri("https://mystore.blob.core.windows.net"), new DefaultAzureCredential());

PIM / just-in-time access, access reviews and conditional access are Entra platform features with no client library. Configure them in the portal or with Graph.

builder.Services.AddAuthentication(o =>
{
    o.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;          // session
    o.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;  // login
})
.AddCookie()
.AddOpenIdConnect(o =>
{
    o.Authority = "https://login.microsoftonline.com/{tenant-id}/v2.0";
    o.ClientId = builder.Configuration["Oidc:ClientId"];
    o.ClientSecret = builder.Configuration["Oidc:ClientSecret"];
    o.ResponseType = "code";   // authorization code flow (PKCE is on by default)
    o.SaveTokens = true;
});

// Symmetric: AES-256-GCM
byte[] key   = RandomNumberGenerator.GetBytes(32);
byte[] nonce = RandomNumberGenerator.GetBytes(12);   // unique per message, never reuse with the same key
byte[] plain = "pay 100 to Bob"u8.ToArray();
byte[] cipher = new byte[plain.Length];
byte[] tag    = new byte[16];
using (var aes = new AesGcm(key, tagSizeInBytes: 16))
    aes.Encrypt(nonce, plain, cipher, tag);          // store nonce + cipher + tag
// aes.Decrypt(nonce, cipher, tag, output) throws if anything was changed

// Asymmetric: sign with the private key, verify with the public key
using var ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP256);
byte[] signature = ecdsa.SignData(plain, HashAlgorithmName.SHA256);
bool valid = ecdsa.VerifyData(plain, signature, HashAlgorithmName.SHA256);

// Verify a webhook signature (HMAC) in constant time
byte[] expected = HMACSHA256.HashData(webhookSecret, requestBody);
bool valid = CryptographicOperations.FixedTimeEquals(expected, Convert.FromHexString(signatureHeader));

// Password storage: salted, slow key derivation
byte[] salt = RandomNumberGenerator.GetBytes(16);
byte[] hash = Rfc2898DeriveBytes.Pbkdf2(password, salt, 600_000, HashAlgorithmName.SHA256, 32);

// Server: TLS 1.2+ and require a client certificate (mTLS)
builder.WebHost.ConfigureKestrel(k => k.ConfigureHttpsDefaults(h =>
{
    h.SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls13;
    h.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
}));
builder.Services.AddAuthentication(CertificateAuthenticationDefaults.AuthenticationScheme)
    .AddCertificate(o => o.AllowedCertificateTypes = CertificateTypes.Chained);

// Client: send our certificate to a partner API
var cert = X509CertificateLoader.LoadPkcs12FromFile("client.pfx", pfxPassword);
builder.Services.AddHttpClient("partner").ConfigurePrimaryHttpMessageHandler(() =>
{
    var handler = new SocketsHttpHandler();
    handler.SslOptions.ClientCertificates = new X509CertificateCollection { cert };
    return handler;
});

Behind a load balancer or App Service, TLS often ends before your app. The client cert then arrives in a header; use AddCertificateForwarding to read it.

var credential = new DefaultAzureCredential();   // managed identity in Azure, your login locally
builder.Configuration.AddAzureKeyVault(new Uri("https://my-vault.vault.azure.net/"), credential);

// Envelope encryption: a local DEK protected by a KEK that never leaves Key Vault
var kek = new CryptographyClient(new Uri(keyId), credential);
byte[] dek = RandomNumberGenerator.GetBytes(32);           // encrypt the data with this (AesGcm)
WrapResult wrapped = await kek.WrapKeyAsync(KeyWrapAlgorithm.RsaOaep256, dek);
// store wrapped.EncryptedKey next to the data; UnwrapKeyAsync gives the DEK back

builder.Services.AddRateLimiter(o =>
{
    o.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
    o.AddFixedWindowLimiter("api", w => { w.PermitLimit = 100; w.Window = TimeSpan.FromMinutes(1); });
});
builder.Services.AddValidation();   // DataAnnotations on minimal API parameters

var app = builder.Build();
app.UseRateLimiter();

app.MapGet("/orders/{id:int}", async (int id, ClaimsPrincipal user,
    IAuthorizationService auth, AppDbContext db) =>
{
    var order = await db.Orders.FindAsync(id);
    if (order is null) return Results.NotFound();
    var result = await auth.AuthorizeAsync(user, order, "OrderOwner");   // BOLA check
    return result.Succeeded ? Results.Ok(order.ToDto()) : Results.Forbid();
}).RequireAuthorization().RequireRateLimiting("api");

<!-- Directory.Build.props: audit everything, pin everything -->
<PropertyGroup>
  <NuGetAudit>true</NuGetAudit>
  <NuGetAuditMode>all</NuGetAuditMode>        <!-- default for net10.0 -->
  <NuGetAuditLevel>moderate</NuGetAuditLevel>
  <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
  <AnalysisModeSecurity>All</AnalysisModeSecurity>
</PropertyGroup>

<!-- nuget.config: Contoso.* packages may ONLY come from the internal feed -->
<packageSourceMapping>
  <packageSource key="nuget.org">
    <package pattern="*" />
  </packageSource>
  <packageSource key="internal">
    <package pattern="Contoso.*" />
  </packageSource>
</packageSourceMapping>

With TreatWarningsAsErrors, the new transitive audit warnings (NU1901–NU1904) can break restores after upgrading to .NET 10. Fix the root package (dotnet nuget why) rather than suppressing the warning.