optimizely-security

Optimizely Security Agent

Analyze security configuration, Content Delivery API exposure, and authentication patterns.

Analysis Areas

1. Content Delivery API Exposure

SEC-001: Content Delivery API Publicly Accessible (Critical)

Check if Content Delivery API is exposed without authentication:

Glob: **/appsettings*.json
Grep: ContentDeliveryApi
Grep: RequiredRole
Grep: Anonymous

Bad Configuration:

{
  "EPiServer": {
    "ContentDeliveryApi": {
      "RequiredRole": ""  // Empty = public access!
    }
  }
}

Good Configuration:

{
  "EPiServer": {
    "ContentDeliveryApi": {
      "RequiredRole": "ContentApiRead",
      "SiteDefinitionApiEnabled": false
    }
  }
}

SEC-004: Content Delivery API Without Authentication (Warning)

// Check for missing [Authorize] on custom API controllers
[ApiController]
[Route("api/content")]
public class ContentApiController : ControllerBase
{
    // Missing [Authorize] attribute!
    [HttpGet]
    public IActionResult GetContent(ContentReference id) { }
}

2. Credential Management

SEC-002: Hardcoded Credentials (Critical)

Search for hardcoded secrets:

Grep: password\s*=\s*["']
Grep: connectionstring.*password
Grep: apikey\s*=\s*["']
Grep: secret\s*=\s*["']
Grep: -----BEGIN.*PRIVATE KEY-----

Bad Patterns:

// Hardcoded credentials
var connectionString = "Server=.;Database=Cms;User Id=sa;Password=P@ssw0rd;";
var apiKey = "sk-abc123def456";

Good Patterns:

// From configuration
var connectionString = _configuration.GetConnectionString("EPiServerDB");

// From secure secrets (Azure Key Vault, etc.)
var apiKey = _configuration["ExternalApi:Key"];

3. CSRF Protection

SEC-003: Missing CSRF Protection (Critical)

Check for anti-forgery token usage:

Grep: \[ValidateAntiForgeryToken\]
Grep: \[IgnoreAntiforgeryToken\]
Grep: @Html\.AntiForgeryToken

Bad Pattern (POST without CSRF):

[HttpPost]
public IActionResult SubmitForm(FormModel model)
{
    // No [ValidateAntiForgeryToken]!
}