How to improve API security in ASP.Net core?

Authentication and authorization

This is one of the major key components to secure your APIs. Over here authentication is used to validate the identity of the user whereas authorization provides or denies a user's access to particular application resources according to their access privileges.

    [ApiController]
    [Route("API/[controller]")]
    public class DemoController : ControllerBase
    {
        [Authorize]
        [HttpGet]
        public IActionResult Get()
        {
            //Write your usual code here
            return Ok("Can be accessed only by authenticated users.");
        }
    }                
    

Use API keys

API keys can be defined as unique identifiers that pass a request on each call to the API. The following code defines how to validate an API key.

    [ApiController]
    [Route("API/[controller]")]

    public class DemoController: ControllerBase
    {
        private const string API_KEY = "ABCDE12345"; //This is   your API key
        [HttpGet]

        public IActionResult Get()
        {
            var apiKey = Request.Headers["Api_Key"].FirstOrDefault();
            if (apiKey != API_KEY)
                return Unauthorized();
            //Write your usual code here
            return Ok("The API key is valid. Authenticated, successful."
        }
    }                       
    

API keys can be also used as an authentication for the user in the application.

Use cross-origin resource sharing

It’s also known as CORS which prevents unauthorised users from accessing your APIs from other domains. To activate CORS at the action level in an ASP.Net Core 7 application, by following the code snippet.

    public class BookController : ApiController
    {
        [EnableCors(origins: "http://localhost:8095/",
        headers: "*", methods: "*")]
        public IEnumerable<string> Get()
        {
            return new string[] {"Mastering C# 8.0", "Joydip   Kanjilal"};
        }
    }                              
    

Use API versioning

One more aspect that improves your API security is by versioning your APIs. It permits you to update your API and phase out less secure versions without interfering with existing clients. You just need to install the ASP.Net API versioning package for NuGet and with the use of the MapToApiVersion attribute you can execute the following action.

    [HttpGet]
    [MapToApiVersion("3.0")]
    public string Get()
    {
        return books;
    }            
    

Use logging and monitoring

Logging offers detailed information about your application behaviour whereas monitoring detects and identifies app failures. With the help of these aspects, you get a clear view of API usage and the security issues that are associated with your API. Moreover, you also gain the advantages of the built-in default logger in ASP.Net

    public class DemoController: Controller
    {
        private readonly ILogger _logger;

        public DemoController(ILogger <DemoController> logger)
        {
            _logger = logger;
        }

        public IActionResult Index()
        {
            _logger.LogInformation("Inside the Index action method");
            return View();
        }

        public IActionResult Test()
        {
            _logger.LogInformation("Inside the Test action method");
            return View();
        }
    }                   
    

Use rate limiting

Rate limiting is the key component to protect your API from the risk of vulnerabilities as it allows you to limit the number of calls to an API within the given time frame.

Token based Authentication

It’s an authentication security where a unique token is generated for each authenticated user. The token is generated once when the identity of the user is verified. It’s recommended to use JSON Web Tokens since it’s reliable in transmitting information ensuring that the information isn't destroyed or unauthorised.