How do you secure an ASP.NET Core API?

Direct answer

What a strong answer covers

How it works

Authentication is configured with a well-supported scheme, JWT bearer for APIs or cookies for browser apps, with token validation parameters explicit about issuer, audience, and lifetime. Authorisation uses policies and resource-based handlers so a rule such as owner-or-admin lives in one place and applies at controllers and minimal endpoints alike. HTTPS is enforced with HSTS, cookie flows keep antiforgery on, input is validated with data annotations or FluentValidation, EF Core parameterises queries, rate limiting middleware protects login and expensive endpoints, and secrets and data protection keys live outside the container in a key store.

Example

An API validates JWTs against the identity provider’s JWKS with a five-minute clock skew, applies a ProjectOwner policy whose handler loads the project and compares OwnerId to the caller, and rate-limits /auth/login per IP and per account. Data protection keys are persisted to Azure Blob Storage and protected by Key Vault so cookies remain valid across pod restarts.

Common mistakes

• Disabling token validation checks such as audience to make a quick integration work.
• Checking roles in controllers only and leaving minimal API endpoints unprotected.
• Storing data protection keys in the container file system and invalidating all sessions on every deploy.

A useful answer structure

Answer from your own work.

Do not memorise a script: use only examples you can explain honestly in follow-up questions.