Defence in depth as Code
summary
Slides and live demo show a practical six-step model implemented in ASP.NET Core 6: HTTPS hosting plus reverse proxy, JWT validation with Duende IdentityServer, a claims transformer to map scopes to permissions, strong input validation, permission checks and data-level authorization using domain primitives. Code on GitHub demonstrates controllers, a service layer, domain-only IDs, and test requests; demos return correct 200/401/403/404 statuses and prevent obvious injection and exposure flaws. Secret handling and secure hosting (NGINX, TLS1.3, Azure Key Vault) are included.
AI-written summary · about
chapters (16)
- 0:00Start
- 1:01Principles of Zero Trust and Least Privilege
- 9:42Bearer Authentication Middleware
- 14:14Claims Transformation
- 17:15Validation
- 20:03Step Five Where We Validate the Permission To Perform the Operation
- 26:03Domain Driven Design
- 36:48Broken Object Level Authorization
- 37:15Secondary Broken User Authentication
- 37:55Excessive Data Exposure
- 38:36Broken Function Level Authorization
- 39:13Security Misconfiguration
- 39:31Classic Injection
- 41:15Secure Hosting
- 42:04Add Security Headers
- 42:45Hosting
related talks
01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
39mA guided tour of ASP.NET core security
52mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
51mAuthentication and Authorization in ASP.NET Core 2
01h 04mImplementing Authentication and Authorization with ASP.NET Core 2
01h 01mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
53mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
53mTest Driven Application Security