Mobile apps, SaaS platforms, IoT devices, and business systems are all powered by APIs, which form the foundation of today's digital economy. However, a significant obstacle that comes with their popularity is security.
APIs are one of the most popular attack vectors for cybercriminals, according to OWASP, and are frequently taken advantage of through compromised authentication, lax authorization, or data exposure. With the help of a real-world example—a bookstore API—we will walk through the entire process of securing an ASP.NET Core Web API using role-based authorization and JWT authentication in this post.
Why API Security Matters?
Imagine a bookstore API that exposes endpoints to manage books, authors, and sales. Without security:
- Anyone could list books, update prices, or delete data.
- Hackers could steal sensitive reports intended for admins only.
- Attackers could flood the API with requests, causing downtime.
That’s why API security is non-negotiable.
Common API Security Threats
Before jumping into implementation, let’s recall the top threats (from OWASP API Top 10):
- Broken Authentication: Weak login mechanisms or missing tokens.
- Broken Authorization: Users accessing data or endpoints they shouldn’t.
- Injection Attacks (SQL, NoSQL, Command): Malicious input executed by the system.
- Sensitive Data Exposure: Sending unencrypted or excessive data.
- Rate Limiting & DoS Attacks – Flooding APIs with requests.
- Improper Logging & Monitoring – No visibility into attacks.
Best Practices for API Security
To mitigate these threats, adopt a defense-in-depth approach:
- Use HTTPS everywhere—no plain HTTP.
- Authentication & Authorization —JWT or OAuth 2.0 with RBAC/Policies.
- Validate Inputs —prevent SQL injection and NoSQL injection.
- Rate Limiting & Throttling —prevent abuse and DoS attacks.
- Centralized Secret Management —Azure Key Vault or AWS Secrets Manager.
- Error Handling —don’t leak stack traces.
- Monitoring & Logging —track security events with Serilog or App Insights.
Implementation: Securing a Bookstore API with JWT
We’ll now build a secure Bookstore API in ASP.NET Core Web API with:
- JWT-based authentication
- Role-based authorization (admin vs. user)
- Secure endpoints for books and admin reports
Step 1. Create Project
dotnet new webapi -n BookstoreApi
cd BookstoreApi
Step 2. Add NuGet Package
dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer
Step 3. Configure Authentication & Authorization ( Program.cs )
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Text;
var builder = WebApplication.CreateBuilder(args);
// Add Authentication with JWT
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
{
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuer = true,
ValidateAudience = true,
ValidateLifetime = true,
ValidateIssuerSigningKey = true,
ValidIssuer = "https://api.bookstore.com",
ValidAudience = "https://api.bookstore.com"
IssuerSigningKey = new SymmetricSecurityKey(
Encoding.UTF8.GetBytes("SuperSecretKey12345")) // use Key Vault in production
};
});
// Authorization Policies
builder.Services.AddAuthorization(options =>
{
options.AddPolicy("AdminOnly", policy => policy.RequireRole("Admin"));
});
builder.Services.AddControllers();
var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();
app.Run();
Step 4. Create Auth Controller ( Controllers/AuthController.cs )
using Microsoft.AspNetCore.Mvc;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
namespace BookstoreApi.Controllers
{
[ApiController]
[Route("api/[controller]")]
public class AuthController : ControllerBase
{
[HttpPost("login")]
public IActionResult Login(string username, string password)
{
// Demo validation (replace with ASP.NET Identity or DB check in production)
if (username == "admin" && password == "password")
{
var claims = new[]
{
new Claim(ClaimTypes.Name, username),
new Claim(ClaimTypes.Role, "Admin")
};
var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("SuperSecretKey12345"));
var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
var token = new JwtSecurityToken(
issuer: "https://api.bookstore.com",
audience: "https://api.bookstore.com",
claims: claims,
expires: DateTime.Now.AddMinutes(30),
signingCredentials: creds);
return Ok(new { token = new JwtSecurityTokenHandler().WriteToken(token) });
}
return Unauthorized();
}
}
}
Step 5. Create Secure Data Controller ( Controllers/SecureDataController.cs )
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
namespace BookstoreApi.Controllers
{
[ApiController]
[Route("api/[controller]")]
public class SecureDataController : ControllerBase
{
// Accessible by any authenticated user
[HttpGet("books")]
[Authorize]
public IActionResult GetBooks() =>
Ok("List of available books. (Authenticated users only)");
// Accessible only by Admin role
[HttpGet("admin/reports")]
[Authorize(Policy = "AdminOnly")]
public IActionResult GetAdminReports() =>
Ok("Sensitive sales reports. (Admins only)");
}
}
Testing the API
Log in to get a JWT token
POST https://api.bookstore.com/api/auth/login
Body: { "username": "admin", "password": "password" }
Response
{ "token": "eyJhbGciOiJIUzI1NiIsIn..." }
Access books endpoint. (user-protected)
GET https://api.bookstore.com/api/securedata/books
Authorization: Bearer <token>
Access admin reports endpoint (admin-only)
GET https://api.bookstore.com/api/securedata/admin/reports
Authorization: Bearer <token>
Enhancing Security Further
- Store SuperSecretKey12345 in Azure Key Vault or AWS Secrets Manager.
- Use the AspNetCoreRateLimit NuGet package to apply rate limiting.
- Enforce HTTPS redirection
- app.UseHttpsRedirection();
- Monitor API usage with Serilog and Application Insights.
- Regularly patch dependencies and update the .NET runtime.
Conclusion
API security is not just about authentication; it’s a multi-layered defense strategy. In this article, we:
- Reviewed the OWASP API Top 10 threats.
- Implemented JWT authentication in ASP.NET Core.
- Applied role-based authorization for sensitive endpoints.
- Discussed enterprise-grade enhancements like rate limiting and secret management.
With these practices, your ASP.NET Core Web APIs will be secure, reliable, and production-ready.