Identity Security Hardening

// ✅ Program.cs — production pipeline orderingvar app = builder.Build();
// 1. HTTPS redirection — permanent redirect (308) for any HTTP requestapp.UseHttpsRedirection();
// 2. HSTS — tell browsers to always use HTTPS for this host// includeSubDomains: all subdomains also require HTTPS// preload: opt-in to browser preload lists (requires max-age >= 1 year)app.UseHsts();
app.UseIdentityServer();app.UseAuthorization();

// ✅ Strong HSTS configurationbuilder.Services.AddHsts(options =>{    options.MaxAge = TimeSpan.FromDays(365);    options.IncludeSubDomains = true;    options.Preload = true;
    // Optionally exclude development/staging hosts    // options.ExcludedHosts.Add("localhost");});
// ✅ Force HTTPS redirect to use 443 explicitlybuilder.Services.AddHttpsRedirection(options =>{    options.RedirectStatusCode = StatusCodes.Status308PermanentRedirect;    options.HttpsPort = 443;});

// ✅ Required when hosted behind a load balancer or ingressbuilder.Services.Configure<ForwardedHeadersOptions>(options =>{    options.ForwardedHeaders =        ForwardedHeaders.XForwardedFor |        ForwardedHeaders.XForwardedProto;
    // Restrict to known proxy IPs — never accept from any source    options.KnownProxies.Add(IPAddress.Parse("10.0.0.1"));    options.ForwardLimit = 1;});
// Must be the very first middleware in the pipelineapp.UseForwardedHeaders();app.UseHttpsRedirection();app.UseHsts();app.UseIdentityServer();

// ✅ Kestrel TLS — require TLS 1.2 minimumbuilder.WebHost.ConfigureKestrel(options =>{    options.ConfigureHttpsDefaults(https =>    {        https.SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls13;        https.ClientCertificateMode = ClientCertificateMode.NoCertificate;    });});

// ✅ Production automatic key managementbuilder.Services.AddIdentityServer(options =>{    // Rotate every 90 days (default); reduce for higher-security deployments    options.KeyManagement.RotationInterval = TimeSpan.FromDays(90);
    // Announce 14 days before activation so JWKS caches refresh    options.KeyManagement.PropagationTime = TimeSpan.FromDays(14);
    // Keep retired keys for 14 days to validate recently-issued tokens    options.KeyManagement.RetentionDuration = TimeSpan.FromDays(14);
    // Delete keys when their retention period ends    options.KeyManagement.DeleteRetiredKeys = true;
    // Encrypt keys at rest via ASP.NET Core Data Protection (default: true)    options.KeyManagement.DataProtectKeys = true;
    // Store keys in a shared, durable location for load-balanced deployments    options.KeyManagement.KeyPath = "/var/identity/keys";
    // ES256 first = default for new tokens; RS256 for legacy client compatibility    options.KeyManagement.SigningAlgorithms = new[]    {        new SigningAlgorithmOptions(SecurityAlgorithms.EcdsaSha256),        new SigningAlgorithmOptions(SecurityAlgorithms.RsaSha256)        {            UseX509Certificate = true        }    };});

// ✅ Data Protection for load-balanced IdentityServerbuilder.Services.AddDataProtection()    // Persist keys to a shared location accessible by all instances    .PersistKeysToFileSystem(new DirectoryInfo("/var/identity/dp-keys"))    // Or: .PersistKeysToDbContext<IdentityDbContext>()    // Or: .PersistKeysToAzureBlobStorage(...)    .ProtectKeysWithCertificate(LoadProtectionCertificate())    // Always set an explicit application name    .SetApplicationName("identity-server");

// Phase 1: Announce new key — continue signing with old key// Deploy and wait ≥ 24 h for JWKS caches to refreshidsvrBuilder.AddSigningCredential(oldKey, SecurityAlgorithms.RsaSha256);idsvrBuilder.AddValidationKey(newKey, SecurityAlgorithms.RsaSha256);
// Phase 2: Switch to new key — retain old key for validation// Deploy and wait ≥ token lifetime (default 1 h) for old tokens to expireidsvrBuilder.AddSigningCredential(newKey, SecurityAlgorithms.RsaSha256);idsvrBuilder.AddValidationKey(oldKey, SecurityAlgorithms.RsaSha256);
// Phase 3: Drop old key — old tokens are all expiredidsvrBuilder.AddSigningCredential(newKey, SecurityAlgorithms.RsaSha256);

// ✅ Production-tuned client — short-lived access tokens, rotating refresh tokensnew Client{    ClientId = "web.app",    AllowedGrantTypes = GrantTypes.Code,    RequirePkce = true,
    // Short access token — reduces replay window    AccessTokenLifetime = 300,            // 5 minutes (default: 3600)
    // Identity tokens are consumed immediately after login    IdentityTokenLifetime = 300,          // 5 minutes (default: 300)
    // Refresh tokens rotate on every use — each use issues a new token    AllowOfflineAccess = true,    RefreshTokenUsage = TokenUsage.OneTimeOnly,    RefreshTokenExpiration = TokenExpiration.Absolute,    AbsoluteRefreshTokenLifetime = 86400, // 24 hours (default: 2592000 = 30 days)    SlidingRefreshTokenLifetime = 3600,   // 1 hour sliding window
    // Revoke refresh tokens when the user's session ends    CoordinateLifetimeWithUserSession = true}

// ✅ Client configured for reference tokensnew Client{    ClientId = "internal.api.consumer",    AllowedGrantTypes = GrantTypes.ClientCredentials,    ClientSecrets = { new Secret("secret".Sha256()) },
    // Issue reference tokens instead of self-contained JWTs    AccessTokenType = AccessTokenType.Reference,
    AllowedScopes = { "internal-api" }}

// ✅ API configured to validate reference tokens via introspectionbuilder.Services    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)    .AddOAuth2Introspection("introspection", options =>    {        options.Authority = "https://identity.example.com";        options.ClientId = "internal-api";        options.ClientSecret = "api-secret";    });

// ✅ Separate API resources = separate audiencesnew ApiResource("catalog-api", "Product Catalog"){    Scopes = { "catalog.read", "catalog.write" }},new ApiResource("orders-api", "Order Management"){    Scopes = { "orders.manage" }}

// ✅ API validates its own audiencebuilder.Services    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)    .AddJwtBearer(options =>    {        options.Authority = "https://identity.example.com";        options.Audience = "catalog-api"; // Must exactly match the ApiResource name        options.TokenValidationParameters.ValidateAudience = true;    });

// ✅ PKCE required (this is the default — shown explicitly for clarity)new Client{    ClientId = "web.app",    AllowedGrantTypes = GrantTypes.Code,    RequirePkce = true, // DO NOT SET TO FALSE IN PRODUCTION    ClientSecrets = { new Secret("secret".Sha256()) },    RedirectUris = { "https://app.example.com/signin-oidc" },    AllowedScopes = { "openid", "profile", "api1" }}

// ❌ WRONG — disabling PKCE for authorization code flownew Client{    ClientId = "legacy.app",    AllowedGrantTypes = GrantTypes.Code,    RequirePkce = false, // Vulnerable to authorization code interception}

// ✅ Public client — no secret, PKCE is mandatorynew Client{    ClientId = "native.app",    AllowedGrantTypes = GrantTypes.Code,    RequirePkce = true,    RequireClientSecret = false, // Public client — no secret
    RedirectUris =    {        "com.example.app:/callback",      // Custom URI scheme for native apps        "https://app.example.com/callback" // HTTPS redirect for web    },    AllowedScopes = { "openid", "profile", "api1" }}

// ❌ Avoid — shared secrets can be extracted from config, logs, and memorynew Client{    ClientId = "basic.client",    ClientSecrets = { new Secret("my-secret".Sha256()) }}

// ✅ Load secret value from configuration, not codevar secretValue = configuration["IdentityServer:Clients:MyClient:Secret"];new Client{    ClientId = "my-client",    ClientSecrets = { new Secret(secretValue.Sha256()) }}

// ✅ Register a client that authenticates with private_key_jwtnew Client{    ClientId = "secure.service",    AllowedGrantTypes = GrantTypes.ClientCredentials,    AllowedScopes = { "api1" },
    ClientSecrets =    {        // Register the client's public key or certificate        new Secret        {            Type = IdentityServerConstants.SecretTypes.JsonWebKey,            Value = """            {                "kty": "RSA",                "use": "sig",                "kid": "my-key-id",                "n": "<base64url-encoded-modulus>",                "e": "AQAB"            }            """        }    }}

// ✅ Client-side: authenticate with a signed assertionvar tokenRequest = new ClientCredentialsTokenRequest{    Address = disco.TokenEndpoint,    ClientId = "secure.service",    ClientAssertion = new ClientAssertion    {        Type = OidcConstants.ClientAssertionTypes.JwtBearer,        Value = BuildClientAssertionJwt(clientId, tokenEndpoint, privateKey)    },    Scope = "api1"};

// ✅ Two active secrets during rotation windownew Client{    ClientId = "my-service",    ClientSecrets =    {        new Secret(currentSecret.Sha256()),        new Secret(newSecret.Sha256()) // New secret pre-registered    }}// After all clients are updated: remove currentSecret

// ✅ Custom validator that rejects secrets shorter than 32 characterspublic sealed class MinimumLengthSecretValidator : ISecretValidator{    public Task<SecretValidationResult> ValidateAsync(        IEnumerable<Secret> secrets, ParsedSecret parsedSecret)    {        if (parsedSecret.Type != IdentityServerConstants.ParsedSecretTypes.SharedSecret)            return Task.FromResult(new SecretValidationResult { Success = false });
        var value = parsedSecret.Credential as string;        if (value is null || value.Length < 32)        {            return Task.FromResult(new SecretValidationResult            {                Success = false,                Error = "Secret does not meet minimum length requirements"            });        }
        // Delegate to default validation        return Task.FromResult(new SecretValidationResult { Success = true });    }}

// ✅ Exact URIs — no trailing slash ambiguity, no wildcardsnew Client{    ClientId = "web.app",    RedirectUris =    {        "https://app.example.com/signin-oidc"    },    PostLogoutRedirectUris =    {        "https://app.example.com/signout-callback-oidc"    }}

// ❌ WRONG — wildcards allow an attacker to redirect to a malicious hostnew Client{    RedirectUris = { "https://*.example.com/callback" } // Never do this}

// ✅ Custom validator that allows tenant subdomains from a verified listpublic sealed class TenantRedirectUriValidator : IRedirectUriValidator{    private readonly ITenantRegistry _tenants;
    public TenantRedirectUriValidator(ITenantRegistry tenants) => _tenants = tenants;
    public async Task<bool> IsRedirectUriValidAsync(string requestedUri, Client client)    {        // Allow standard registered URIs first        if (client.RedirectUris.Contains(requestedUri))            return true;
        // Allow per-tenant URIs — always validate against a trusted data source        var uri = new Uri(requestedUri);        return await _tenants.IsAllowedCallbackAsync(uri);    }
    public async Task<bool> IsPostLogoutRedirectUriValidAsync(        string requestedUri, Client client)    {        if (client.PostLogoutRedirectUris.Contains(requestedUri))            return true;
        var uri = new Uri(requestedUri);        return await _tenants.IsAllowedCallbackAsync(uri);    }}

// ✅ Replace the default validatorbuilder.Services.AddTransient<IRedirectUriValidator, TenantRedirectUriValidator>();

// ❌ WRONG — implicit flow exposes tokens in browser history and referrer headersnew Client{    AllowedGrantTypes = GrantTypes.Implicit}
// ✅ CORRECT — use authorization code + PKCE for all interactive clientsnew Client{    AllowedGrantTypes = GrantTypes.Code,    RequirePkce = true}

// ✅ Machine-to-machine service: only client_credentialsnew Client{    ClientId = "background.worker",    AllowedGrantTypes = GrantTypes.ClientCredentials,    // AllowOfflineAccess = false (default) — no refresh tokens for M2M}
// ✅ Interactive web app: only authorization codenew Client{    ClientId = "web.app",    AllowedGrantTypes = GrantTypes.Code,    RequirePkce = true}
// ❌ WRONG — granting more than needednew Client{    ClientId = "web.app",    AllowedGrantTypes = GrantTypes.CodeAndClientCredentials // Never combine user + M2M flows}

// ✅ Extension grant with strict validationpublic sealed class TokenExchangeGrantValidator : IExtensionGrantValidator{    public string GrantType => "urn:ietf:params:oauth:grant-type:token-exchange";
    public async Task ValidateAsync(ExtensionGrantValidationContext context)    {        var subjectToken = context.Request.Raw.Get("subject_token");        if (string.IsNullOrWhiteSpace(subjectToken))        {            context.Result = new GrantValidationResult(TokenRequestErrors.InvalidRequest,                "subject_token is required");            return;        }
        // Validate the subject token — never trust without verification        var principal = await ValidateSubjectTokenAsync(subjectToken);        if (principal is null)        {            context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant,                "subject_token is invalid or expired");            return;        }
        context.Result = new GrantValidationResult(            subject: principal.GetSubjectId(),            authenticationMethod: GrantType);    }}

// ✅ Tightened input length restrictionsbuilder.Services.AddIdentityServer(options =>{    // Scope values — tighten to your longest actual scope name    options.InputLengthRestrictions.Scope = 300;         // default: 300
    // Client ID — match your longest client ID    options.InputLengthRestrictions.ClientId = 100;      // default: 100
    // Client secret — limit to prevent memory abuse    options.InputLengthRestrictions.ClientSecret = 100;  // default: 100
    // Redirect URI — match your longest registered URI    options.InputLengthRestrictions.RedirectUri = 400;   // default: 400
    // Nonce — OpenID Connect replay protection    options.InputLengthRestrictions.Nonce = 300;         // default: 300
    // Code challenge for PKCE — use the correct min/max length properties    // (verify exact property names against current Duende IdentityServer source,    //  e.g. CodeChallengeMinLength / CodeChallengeMaxLength)    options.InputLengthRestrictions.CodeChallengeMinLength = 43;  // RFC 7636 minimum    options.InputLengthRestrictions.CodeChallengeMaxLength = 128; // RFC 7636 maximum});

// ✅ Enable audit eventsbuilder.Services.AddIdentityServer(options =>{    options.Events.RaiseSuccessEvents = true;    options.Events.RaiseFailureEvents = true;    options.Events.RaiseErrorEvents = true;    options.Events.RaiseInformationEvents = true;});

// ✅ Raise UI login events from your account controller/pagepublic LoginModel(IEventService events) => _events = events;
await _events.RaiseAsync(    new UserLoginSuccessEvent(user.Username, user.SubjectId, user.Username));// or on failure:await _events.RaiseAsync(    new UserLoginFailureEvent(username, "invalid credentials"));

// ✅ Forward audit events to Seq (Serilog.Sinks.Seq) — and keep loggingpublic sealed class SeqEventSink : IEventSink{    private readonly ILogger<SeqEventSink> _logger; // default sink is replaced — log here    public SeqEventSink(ILogger<SeqEventSink> logger) => _logger = logger;
    public Task PersistAsync(Event evt)    {        _logger.LogInformation("{Name} ({Id}) {@Event}", evt.Name, evt.Id, evt);        return Task.CompletedTask;    }}
// Registration — replaces the built-in logger sinkservices.AddTransient<IEventSink, SeqEventSink>();

// ❌ WRONG — authorization code interception becomes trivially exploitablenew Client { RequirePkce = false }
// ✅ CORRECT — RequirePkce = true is the default; never override it to falsenew Client { RequirePkce = true }

// ❌ WRONG — open redirector: attacker steers code to their serverRedirectUris = { "https://*.example.com/*" }
// ✅ CORRECT — fully qualified, exact-match URIs onlyRedirectUris = { "https://app.example.com/signin-oidc" }

// ❌ WRONG — exposes tokens in URL fragments, browser history, referrer headersAllowedGrantTypes = GrantTypes.Implicit
// ✅ CORRECT — authorization code + PKCE replaces implicit flow entirelyAllowedGrantTypes = GrantTypes.Code

// ❌ WRONG — attacker can spoof X-Forwarded-Proto: https from any IPoptions.ForwardedHeaders = ForwardedHeaders.XForwardedProto;// KnownProxies is empty = accepts from anywhere
// ✅ CORRECT — restrict to known proxy IPsoptions.KnownProxies.Add(IPAddress.Parse("10.0.0.1"));

// ❌ WRONG — secret is committed to git historyClientSecrets = { new Secret("SuperSecret123".Sha256()) }
// ✅ CORRECT — load from secret store or environment variableClientSecrets = { new Secret(config["Services:MyClient:Secret"].Sha256()) }

// ❌ WRONG — discovery document publishes http:// issuer; APIs reject all tokens// Caused by missing ForwardedHeaders middleware behind a TLS-terminating proxy
// ✅ CORRECT — configure ForwardedHeaders before UseIdentityServer()// OR set the issuer explicitlyoptions.IssuerUri = "https://identity.example.com";

// ❌ WRONG — 8-hour access token gives attackers a huge replay windowAccessTokenLifetime = 28800
// ✅ CORRECT — 5–15 minutes; use refresh tokens for longer sessionsAccessTokenLifetime = 300

// ❌ WRONG — API accepts any token from the issuer, regardless of audienceoptions.TokenValidationParameters = new TokenValidationParameters{    ValidateAudience = false // Dangerous — token from any client works at any API};
// ✅ CORRECT — validate the audience matches this specific APIoptions.Audience = "my-api";options.TokenValidationParameters.ValidateAudience = true;

// ❌ WRONG — development signing key committed to source control and reused in productionidsvrBuilder.AddDeveloperSigningCredential(); // Development only!
// ✅ CORRECT — automatic key management generates and rotates keys per-environment// Each environment has its own isolated key materialoptions.KeyManagement.Enabled = true;options.KeyManagement.DataProtectKeys = true;