security-and-hardening

Security and Hardening

Overview

Security-first development practices for .NET applications — ASP.NET Core web apps, Blazor, Avalonia, MAUI, and library code. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems.

When to Use

• Building anything that accepts user input (HTTP endpoints, message consumers, file watchers, UI text fields)
• Implementing authentication or authorization (ASP.NET Core Identity, cookie auth, JWT bearer, OAuth, policy-based authz)
• Storing or transmitting sensitive data (PII, payment info, API tokens, connection strings)
• Integrating with external APIs or services (HttpClient, gRPC, Service Bus)
• Adding file uploads, webhooks, or callbacks
• Handling payment or regulated data (GDPR, HIPAA, PCI DSS)

Process: Threat Model First

Controls bolted on without a threat model are guesses. Before hardening, spend five minutes thinking like an attacker:

1. Map the trust boundaries. Where does untrusted data cross into your system? HTTP requests (body, route, query, headers), form fields, IFormFile uploads, webhooks, third-party API responses, Service Bus / queue messages, and LLM output. Every boundary is attack surface.
2. Name the assets. What's worth stealing or breaking? Credentials, PII, payment data, admin actions, money movement.
3. Run STRIDE over each boundary — a quick lens, not a ceremony: