Security dev tips

Getting a 404 Not Found response?

Check whether the requested resource exists.

Common causes include:

• Incorrect URL
• Wrong route
• Missing endpoint
• Deleted resource
• Incorrect HTTP path
• Deployment configuration

HTTP 404 means the server did not find the requested resource.

If you're requesting /api/users but your endpoint is /api/customers, changing the URL might help.

Need to access application settings?

Use IConfiguration

Common configuration sources:

• appsettings.json
• Environment variables
• User Secrets
• Azure Key Vault
• Command-line arguments

ASP.NET Core automatically combines multiple configuration providers into a single configuration object.

Need to return a proper response when something goes wrong?

Use exception handling middleware.

Common approaches:

• UseExceptionHandler()
• Custom exception middleware
• Return appropriate HTTP status codes
• Log unexpected exceptions
• Avoid exposing internal details

Centralized exception handling helps keep API responses consistent across your application.

Want to protect an API endpoint?

Add the [Authorize] attribute.

Common authorization options:

• [Authorize]
• [Authorize(Roles = "Admin")]
• [Authorize(Policy = "EmployeeOnly")]
• [AllowAnonymous] for public endpoints
• Configure authentication before using authorization

Protected endpoints require authenticated users before your action executes.

Public endpoints without [Authorize] are accessible without authentication.

How do you organize authorization in your APIs?