ASP.NET Core API penetration testing: Hardening C# backends

Akande Simpa Lead Security Engineer & Cofounder, Simpa Labs CEH (Certified Ethical Hacker)

Mass assignment and Over-Posting in Entity Framework

Entity Framework (EF) Core allows developers to bind HTTP request payloads directly to database entity models. While convenient, this practice leads to mass assignment (over-posting) vulnerabilities. If your database model contains columns that should only be modified by system administrators, an attacker can append those fields to the request JSON:

// VULNERABLE controller action binding directly to DB entity
[HttpPost]
public async Task<IActionResult> UpdateProfile([FromBody] User userEntity)
{
    // Flaw: binds all JSON fields directly to EF tracking model
    _context.Users.Update(userEntity);
    await _context.SaveChangesAsync();
    return Ok();
}

The Fix: Implement strict Data Transfer Objects (DTOs) or use the [Bind] attribute to restrict what parameters are read from the payload, preventing model injection:

// SECURE pattern using DTOs
public class ProfileUpdateDto
{
    public string DisplayName { get; set; }
    public string EmailAddress { get; set; }
}

[HttpPost]
public async Task<IActionResult> UpdateProfile([FromBody] ProfileUpdateDto dto)
{
    var user = await _context.Users.FindAsync(User.GetUserId());
    if (user == null) return NotFound();
    
    user.DisplayName = dto.DisplayName;
    user.EmailAddress = dto.EmailAddress;
    
    await _context.SaveChangesAsync();
    return Ok();
}

Middleware execution order configuration

ASP.NET Core uses a pipeline middleware architecture. The order of registration in your Program.cs file determines how requests are processed. A common configuration mistake is misplacing authorization and authentication middleware, which can lead to route exposure:

// VULNERABLE Program.cs middleware registration order
var app = builder.Build();

app.UseAuthorization(); // Flaw: evaluated before authentication is verified!
app.UseAuthentication();
app.UseRouting();

The Fix: Enforce the correct order of middleware execution in your Program.cs bootstrap: routing first, then authentication, then authorization, and finally endpoint routing:

// SECURE middleware registration order
var app = builder.Build();

app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();

Data protection API keyring configurations

ASP.NET Core uses the Data Protection API (DPAPI) to encrypt cookies, CSRF tokens, and session identifiers. In dockerized or cloud environments, the keyring is stored locally inside the container filesystem. When containers restart or scale horizontally, the keys are lost or differ across nodes, resulting in invalid session decryptions. We check that your keyring configuration points to persistent cloud storage (like AWS KMS or Azure Key Vault).

Related reading

Blog: Spring Boot security audits · API data leaks · API rate limit enforcement

Services: API security testing · Secure architecture review