ASP.NET Core Security ([Authorize], CORS, HTTPS & Rate Limiting) Masterclass

⚡ C# 12 & .NET 8 🟢 Chapter 40 of 35 📂 Phase 14: Authentication & Security 📅 2026 Edition

📌 Covered in this chapter: [Authorize] · Role-Based Auth · Policy-Based Auth · CORS · HTTPS · HSTS · Secret Management · Input Validation · SQL Injection Prevention · Rate Limiting

Welcome to Phase 14 (Chapter 40): ASP.NET Core Security — [Authorize], CORS, HTTPS, Input Validation & Rate Limiting Masterclass! A secure web API goes far beyond authentication. In this chapter, we implement Role-Based Authorization with [Authorize], Policy-Based Authorization, CORS configuration, HTTPS enforcement, Secret management with User Secrets and Azure Key Vault, Input validation, SQL injection prevention (EF Core handles this), XSS prevention, CSRF basics, and API Rate Limiting.

1[Authorize] — Role-Based & Policy-Based Authorization

C# — Role & Policy Authorization ▶ Run in Compiler

// 1. Role-based authorization
[Authorize]                              // Any authenticated user
[Authorize(Roles = "Admin")]             // Admin role only
[Authorize(Roles = "Admin,Manager")]     // Admin OR Manager
[AllowAnonymous]                         // Bypass auth for public endpoints

// 2. Register Policy-Based Authorization
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("AdminOnly", policy =>
        policy.RequireRole("Admin"));

    options.AddPolicy("MinimumAge18", policy =>
        policy.RequireClaim("DateOfBirth")
              .RequireAssertion(ctx =>
              {
                  var dob = DateTime.Parse(ctx.User.FindFirst("DateOfBirth")!.Value);
                  return (DateTime.Today - dob).TotalDays / 365 >= 18;
              }));
});

// 3. Apply policy on controller
[Authorize(Policy = "AdminOnly")]
[HttpDelete("{id:int}")]
public IActionResult DeleteProduct(int id) { /* only admins reach here */ }

2CORS, HTTPS & Secret Management

C# — CORS & HTTPS Configuration ▶ Run in Compiler

// CORS — Allow only specific frontend origins
builder.Services.AddCors(options =>
{
    options.AddPolicy("FrontendPolicy", policy =>
        policy.WithOrigins("https://myapp.com", "http://localhost:3000")
              .AllowAnyMethod()
              .AllowAnyHeader()
              .AllowCredentials());
});

// Middleware order matters!
app.UseCors("FrontendPolicy");
app.UseHttpsRedirection();    // Force HTTPS
app.UseHsts();                // HTTP Strict Transport Security header
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();

3Rate Limiting & Input Validation

C# — Rate Limiting (.NET 7+) ▶ Run in Compiler

// Built-in Rate Limiting (.NET 7+)
builder.Services.AddRateLimiter(options =>
{
    options.AddFixedWindowLimiter("ApiLimit", opt =>
    {
        opt.PermitLimit   = 100;             // Max 100 requests
        opt.Window        = TimeSpan.FromMinutes(1); // per minute
        opt.QueueLimit    = 0;               // No queuing, reject immediately
    });
    options.RejectionStatusCode = 429;       // Too Many Requests
});

app.UseRateLimiter();

// Apply to all endpoints
app.MapControllers().RequireRateLimiting("ApiLimit");

4Technical FAQs

Q1: Does EF Core prevent SQL Injection automatically?

Yes! EF Core always uses parameterized queries when translating LINQ expressions to SQL. Parameterized queries treat user input as data values — never executable SQL code — completely preventing SQL injection. Never use raw SQL string concatenation with user input.

Q2: What is CORS and why is it needed?

Cross-Origin Resource Sharing (CORS) is a browser security feature that blocks JavaScript from making API calls to a different origin (domain, port, or protocol) unless the server explicitly allows it. Your API needs CORS configuration to allow frontend apps (e.g., React on localhost:3000) to make requests.