Security Principles

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Text;

// In the Program.cs configuration
var builder = WebApplication.CreateBuilder(args);

// 1. Configure Authentication Service with JWT Bearer Scheme
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true, // Validate the token issuer
            ValidateAudience = true, // Validate the token audience
            ValidateLifetime = true, // Check if the token is not expired
            ValidateIssuerSigningKey = true, // Validate the token's signing key
            ValidIssuer = "https://myapi.com", // Who created the token
            ValidAudience = "https://myclient.com", // Who the token is for
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("my_secret_key_here"))
        };
    });

var app = builder.Build();

// 2. Use Authentication Middleware
app.UseAuthentication();
app.UseAuthorization(); // Authorization must come after Authentication

app.MapGet("/secure", () => "This is a secure endpoint!").RequireAuthorization();

app.Run();

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

[ApiController]
[Route("api/[controller]")]
public class DocumentsController : ControllerBase
{
    [HttpGet]
    [Authorize] // 1. Simple authorization: any authenticated user can access
    public IActionResult GetDocuments() { /* ... */ }

    [HttpGet("{id}")]
    [Authorize(Roles = "Admin,Editor")] // 2. Role-based: User must be in Admin OR Editor role
    public IActionResult GetDocument(int id) { /* ... */ }

    [HttpDelete("{id}")]
    [Authorize(Policy = "CanDeleteDocument")] // 3. Policy-based: More flexible, complex rule
    public IActionResult DeleteDocument(int id) { /* ... */ }
}

// Policy registration in Program.cs
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("CanDeleteDocument", policy =>
        policy.RequireRole("Admin") // Must be an Admin
              .RequireClaim("department", "IT") // AND have a department claim set to "IT"
              .Requirements.Add(new MinimumAgeRequirement(18))); // AND meet a custom requirement
});

using System.Security.Cryptography;
using System.Text;

// --- HASHING a password (using SHA256) ---
string password = "MySecurePassword123!";
using (SHA256 sha256Hash = SHA256.Create())
{
    // ComputeHash returns a byte array
    byte[] bytes = sha256Hash.ComputeHash(Encoding.UTF8.GetBytes(password));
    // Convert byte array to a hexadecimal string
    StringBuilder builder = new StringBuilder();
    for (int i = 0; i < bytes.Length; i++)
    {
        builder.Append(bytes[i].ToString("x2"));
    }
    string hashedPassword = builder.ToString();
    Console.WriteLine($"Hashed Password: {hashedPassword}");
    // Store this hash in the database. Never store the plain-text password.
}

// --- SYMMETRIC ENCRYPTION (using AES) ---
string originalText = "Sensitive data to encrypt.";
byte[] key = new byte[32]; // 256-bit key
byte[] iv = new byte[16];  // 128-bit IV
RandomNumberGenerator.Fill(key); // Generate a random key and IV
RandomNumberGenerator.Fill(iv);

using (Aes aesAlg = Aes.Create())
{
    aesAlg.Key = key;
    aesAlg.IV = iv;

    // Create an encryptor to perform the stream transform.
    ICryptoTransform encryptor = aesAlg.CreateEncryptor(aesAlg.Key, aesAlg.IV);

    // Create the streams used for encryption.
    using (MemoryStream msEncrypt = new MemoryStream())
    {
        using (CryptoStream csEncrypt = new CryptoStream(msEncrypt, encryptor, CryptoStreamMode.Write))
        {
            using (StreamWriter swEncrypt = new StreamWriter(csEncrypt))
            {
                swEncrypt.Write(originalText);
            }
        }
        byte[] encryptedData = msEncrypt.ToArray();
        // The encryptedData and the iv are needed for decryption.
    }
}

using Microsoft.AspNetCore.DataProtection;
using Microsoft.Extensions.DependencyInjection;

// Setup the service provider (typically done in DI configuration)
var serviceCollection = new ServiceCollection();
serviceCollection.AddDataProtection(); // Adds the data protection services
var services = serviceCollection.BuildServiceProvider();

// Get an instance of IDataProtector
var protector = services.GetService<IDataProtectionProvider>().CreateProtector("purpose_string");

// The 'purpose' string creates an isolation boundary.
string plainText = "This is a secret message.";
Console.WriteLine($"Plain text: {plainText}");

// Protect the data (encrypt)
string protectedPayload = protector.Protect(plainText);
Console.WriteLine($"Protected payload: {protectedPayload}");

// Unprotect the data (decrypt)
string unprotectedPayload = protector.Unprotect(protectedPayload);
Console.WriteLine($"Unprotected payload: {unprotectedPayload}"); // Should match the original plainText.

// THIS IS AN EXAMPLE OF LEGACY CODE. It does not work in .NET Core/5+.
using System.Security;
using System.Security.Permissions;

[FileIOPermission(SecurityAction.Demand, Read = "C:\\temp")] // Demands read access
public void ReadFile()
{
    // This method would throw a SecurityException if the calling code didn't have the required permission.
    string content = File.ReadAllText("C:\\temp\\file.txt");
}

using System.Security.Claims;

// Assuming we are in a context where the user is authenticated (e.g., in an MVC Controller)
public class HomeController : Controller
{
    public IActionResult AdminPanel()
    {
        // Check if the current user is in the "Administrator" role.
        if (User.IsInRole("Administrator"))
        {
            // Show admin panel
            return View("AdminPanel");
        }
        else
        {
            // Return access denied
            return Forbid();
        }
    }

    public IActionResult Profile()
    {
        // Get the user's name from their identity
        string userName = User.Identity.Name;
        // Get a specific claim (e.g., email)
        string userEmail = User.FindFirstValue(ClaimTypes.Email);
        // ... use the claims
        return View();
    }
}