How to create a security ASP.NET Web API controller

 Hi,

Here is a code that has base response class and use it in an ASP.NET Web API controller to send a response with a cookie and security headers.

This code creates a BaseResponse<T> class with a Status property and a Data property of type T. In the Post method of MyController, a new HttpResponseMessage is created with a status of OK and the content set to a serialized BaseResponse<string>. A cookie is added to the response headers, and then several security headers are added. The X-Content-Type-Options header is set to nosniff to prevent the browser from trying to interpret content with a MIME type that doesn't match the declared type. The X-Frame-Options header is set to SAMEORIGIN to prevent the page from being displayed in a frame or iframe. The Content-Security-Policy header is set to only allow content from the same origin

In this code, I've assumed that you have a service IDatabaseService with a method CheckIfExists that checks if an ID exists in the database. The Post method now accepts an ID, checks if it exists in the database, and sets the Status property of the BaseResponse to the result. It also generates a new GUID for the session ID and sets it as a cookie in the response headers. The Data property of the BaseResponse is set to the ID that was passed to the Post method.

This code sets the HttpOnly attribute of the cookie to true, which prevents the cookie from being accessed by client-side scripts. It also sets the Expires attribute to 1 hour from now, which means the cookie will be deleted after 1 hour. The Strict-Transport-Security header is set to max-age=31536000; includeSubDomains, which tells the browser to only use HTTPS for all future requests to this domain and its subdomains for the next year. The Secure attribute is set to true, which means the cookie will only be sent over an HTTPS connection. Please note that this attribute will have no effect if your application is not served over HTTPS.

public class BaseResponse<T>

{

    public bool Status { get; set; }

    public T Data { get; set; }

}

public class MyController : ApiController

{

    private readonly IDatabaseService _databaseService;

    public MyController(IDatabaseService databaseService)

    {

        _databaseService = databaseService;

    }

    public async Task<HttpResponseMessage> Post([FromBody] string id)

    {

        var exists = await _databaseService.CheckIfExists(id);

        var response = new HttpResponseMessage(HttpStatusCode.OK)

        {

            Content = new StringContent(JsonConvert.SerializeObject(new BaseResponse<string> { Status = exists, Data = id }), Encoding.UTF8, "application/json")

        };

        var newSessionId = Guid.NewGuid().ToString();

        var cookie = new CookieHeaderValue("session-id", newSessionId)

        {

            HttpOnly = true,

            Secure = true,

            Expires = DateTimeOffset.Now.AddHours(1)

        };

        response.Headers.AddCookies(new CookieHeaderValue[] { cookie });

        response.Headers.Add("X-Content-Type-Options", "nosniff");

        response.Headers.Add("X-Frame-Options", "SAMEORIGIN");

        response.Headers.Add("Content-Security-Policy", "default-src 'self'");

        response.Headers.Add("Strict-Transport-Security",                 "max-age=31536000; includeSubDomains");

        return response;

    }

}

Have a nice day :)