This document discusses securing .NET Core and ASP.NET Core applications. It covers authentication and authorization topics like OpenID Connect, OAuth, sessions, and HTTPS. It provides an overview of authentication flows like OAuth's resource owner credentials flow and OpenID Connect's authorization code flow. It also discusses securing single page applications, Azure managed identities, and using libraries instead of rolling your own security implementation.

1. Securing .NET Core,
ASP.NET Core
applications
• Damien Bowden
• https://damienbod.com
• @damien_bod

2. Application Security today
OpenID Connect, OAuth
An introduction to Self Sovereign Identity

3. WAF
HTTPS everywhere, Certs Protected Zone

4. WAF
HTTPS everywhere, Certs Protected Zone

5. Authentication, Authorization, Accounting
Session Protection HTTP headers
HTTPS Certificates TLS 1.2, 1.3
Hosting
GDPR, Data breaches
WAF Web Application Firewall
Security in applications

6. Authentication, Authorization, Accounting
Session Protection HTTP headers
HTTPS Certificates TLS 1.2, 1.3
Hosting
GDPR, Data breaches
WAF Web Application Firewall
ASP.NET Core solutions

7. Authentication
Authorization
Signout
Session

8. USE Standards
Don’t implement this yourself, use
certified libs, packages, tested

10. OAuth2
OpenID Connect Authentication
Authorization
Delegated

11. OpenID Connect
http://openid.net/connect/
• Standard, Specification
• Authentication and Authorization
• built on top of OAuth2 (access control)
• Identity (Person can have n Identities)
• UserInfo Endpoint

12. Open ID Connect (OIDC) is
supported by almost all systems.
Azure AD, Auth0, OKTA, IdentityServer4, google accounts,
Openiddict, node-oidc-provider, Azure B2C

13. Authentication
Authorization
Signout
Session

14. OpenID Connect,
OAuth

15. OpenID Connect
Flows
OAuth2 Flows
http://openid.net/specs/openid-
connect-core-1_0.html
OAuth2 Resource Owner Credentials Flow
OpenID Connect Code flow + PKCE with client secret
OpenID Connect Hybrid flow
OpenID Connect Code flow + PKCE with no secret
OAuth Device Flow
On Behalf Of (OBO) Flow
Azure Managed Identities

16. id token
token (access token)
reference / self contained token
refresh token
scope
Back-Channel
Front-Channel
User Agent

17. OAuth2 Resource
Owner Credentials
Flow
• MC to MC applications
• trusted client
• grant_type=client_credenti
al&client_id=xxxxxxxxxx&cli
ent_secret=xxxxxxxxxx
• Limited user cases

18. OAuth2 Resource Owner Credentials Flow

19. OpenID Connect
Authorization Code
flow + PKCE + secret
• Server to server
applications with User
• Can keep secrets, is trusted
• Client is authenticated
• response_type = code

20. OIDC Authorization Code flow

21. OIDC Hybrid flow
• Mix of the Code and
Implicit Flow
• Can be used for Web
applications with server
side rendering.
• response_type = code
id_token |
code id_token token |
code token

22. OIDC Hybrid flow

23. Native App / SPA
Authorization Code
Flow + PKCE
• RFC 7636
• No secret for public clients
• https://tools.ietf.org/html/r
fc7636

25. Single Page
Applications
• Cookies
• OIDC Code Flow with PKCE
• OIDC Implicit Flow

26. OpenID Connect Code flow
with PKCE
• For browser applications, SPAs
• Client is not authenticated, or trusted
• response_type = code
• NO SECRET
• Use reference tokens if possible
• When using Refresh tokens, check that the STS supports the
latest fixes,
• Use Revocation!

27. Difference between Native
APPS and SPA
• Native apps use different Redirect URLs
• Storage for persisting tokens is different
• Native app opens a browser to authenicate
• Refresh tokens stored in the browser (or silent
renew ...)

31. OAuth Device Flow
• RFC 7636
• https://tools.ietf.org/html/d
raft-ietf-oauth-device-flow-12

33. OAuth On Behalf of
OBO Flow
• - RFC 6749
• https://tools.ietf.org/html/r
fc6749
• https://docs.microsoft.com/
en-us/azure/active-
directory/develop/v2-oauth2-
on-behalf-of-flow

34. src: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow

35. Azure Managed
identities

36. src: https://www.youtube.com/watch?v=vYUKC0mZFqI

37. Thank you
@damienbod