Security dev tips

Need to access application settings?

Use IConfiguration

Common configuration sources:

• appsettings.json
• Environment variables
• User Secrets
• Azure Key Vault
• Command-line arguments

ASP.NET Core automatically combines multiple configuration providers into a single configuration object.

Need to return a proper response when something goes wrong?

Use exception handling middleware.

Common approaches:

• UseExceptionHandler()
• Custom exception middleware
• Return appropriate HTTP status codes
• Log unexpected exceptions
• Avoid exposing internal details

Centralized exception handling helps keep API responses consistent across your application.

Want to protect an API endpoint?

Add the [Authorize] attribute.

Common authorization options:

• [Authorize]
• [Authorize(Roles = "Admin")]
• [Authorize(Policy = "EmployeeOnly")]
• [AllowAnonymous] for public endpoints
• Configure authentication before using authorization

Protected endpoints require authenticated users before your action executes.

Public endpoints without [Authorize] are accessible without authentication.

How do you organize authorization in your APIs?