dotnet-security

.NET Security Standards

.NET-specific security practices. For universal security principles, see engineering-security.mdc.

Conflict resolution: Where this file provides .NET-specific guidance that differs from engineering-security.mdc, this file takes precedence for .cs, .csproj, .json, .yaml, and .yml files. The universal rule provides the default; this rule provides the override.

---

Input validation in .NET

Use FluentValidation in the MediatR pipeline; do not rely on manual inline checks:

public class PlaceOrderCommandValidator : AbstractValidator<PlaceOrderCommand>
{
    public PlaceOrderCommandValidator()
    {
        RuleFor(x => x.CustomerId).NotEmpty();
        RuleFor(x => x.Lines).NotEmpty().WithMessage("At least one line is required");
        RuleFor(x => x.Email).EmailAddress().MaximumLength(254);
    }
}

---

EF Core — injection prevention

• Use EF Core LINQ queries or FromSqlRaw with parameters exclusively; never concatenate user input

// Correct
dbContext.Users.FirstOrDefaultAsync(u => u.Email == email, ct);

// Also correct (parameterised raw)
dbContext.Products.FromSqlRaw("SELECT * FROM Products WHERE Category = {0}", category);

// Incorrect — do not do this
var sql = $"SELECT * FROM Products WHERE Category = '{category}'";

---

Authentication in ASP.NET Core

builder.Services
    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.Authority = configuration["Auth:Authority"];
        options.Audience = configuration["Auth:Audience"];
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ClockSkew = TimeSpan.Zero
        };
    });

• Use ASP.NET Core Identity or a delegated identity provider (Entra ID, Okta, Auth0); do not implement custom auth
• Validate iss, aud, exp, and nbf on every JWT; reject tokens that fail any check
• Set ClockSkew = TimeSpan.Zero to prevent tokens being valid after expiry