07Безопасность (Security)

1. AppHost (ASPNETCORE_*)
        2. Command line arguments
        3. Environment variables (APPSETTING_*)
        4. appsettings.{Environment}.json
        5. appsettings.json
        6. User Secrets (Development only)
        7. Azure Key Vault (if configured)
        8. Azure App Service configuration

dotnet user-secrets init
        dotnet user-secrets set "Jwt:Key" "my-secret-key"
        dotnet user-secrets set "ConnectionStrings:Default" "Server=..."

// Program.cs - User Secrets loaded automatically in Development
        var builder = WebApplication.CreateBuilder(args);
        builder.Configuration.AddUserSecrets<Program>(optional: true);

# Linux
        export ConnectionStrings__Default="Server=..."
        export Jwt__Issuer="https://auth.example.com"

        # Windows PowerShell
        $env:ConnectionStrings__Default = "Server=..."
        $env:Jwt__Issuer = "https://auth.example.com"

// Install: Azure.Identity, Azure.Security.KeyVault.Secrets
        using Azure.Identity;
        using Azure.Security.KeyVault.Secrets;

        // DefaultAzureCredential - auto-detects auth method
        // Development: Azure CLI login
        // Production: Managed Identity
        var credential = new DefaultAzureCredential();
        var vaultUri = new Uri("https://myvault.vault.azure.net/");

        var client = new SecretClient(vaultUri, credential, new SecretClientOptions
        {
            Retry = { Delay = TimeSpan.FromSeconds(2), MaxDelay = TimeSpan.FromSeconds(16), MaxRetries = 5, Mode = RetryMode.Exponential }
        });

        // Set secret
        KeyVaultSecret secret = client.SetSecret("db-connection-string", "Server=prod;Database=app;");

        // Get secret
        KeyVaultSecret retrieved = client.GetSecret("db-connection-string");
        string value = retrieved.Value;

        // List secrets
        await foreach (var prop in client.GetPropertiesOfSecretsAsync())
        {
            Console.WriteLine($"{prop.Name} - {prop.CreatedOn}");
        }

// Key Vault as configuration source
        builder.Configuration.AddAzureKeyVault(
            new Uri($"https://{vaultName}.vault.azure.net/"),
            new DefaultAzureCredential());

        // Now accessible via standard IConfiguration
        var connectionString = builder.Configuration["db-connection-string"];
        var apiKey = builder.Configuration["api-key"];

# Enable system-assigned managed identity for App Service
        az webapp identity assign --name myapp --resource-group myrg

        # Grant Key Vault access
        az role assignment create --role "Key Vault Secrets User" \
            --assignee <principal-id> \
            --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.KeyVault/vaults/myvault

// Load certificate from Key Vault
        var certClient = new CertificateClient(new Uri($"https://{vaultName}.vault.azure.net/"), credential);
        var certOperation = await certClient.StartCreateCertificateAsync("my-cert", CertPolicy.CreateSelfSigned("CN=app.example.com"));
        await certOperation.WaitForCompletionAsync();

        // Load certificate for HTTPS
        var cert = new X509Certificate2(certBundle.Certificate);
        builder.WebHost.UseHttps(cert);

        // Certificate rotation
        public class CertificateRotationService : BackgroundService
        {
            private readonly CertificateClient _client;
            private readonly string _certName;
    
            public CertificateRotationService(CertificateClient client, IConfiguration config)
            {
                _client = client;
                _certName = config["CertificateName"]!;
            }
    
            protected override async Task ExecuteAsync(CancellationToken stoppingToken)
            {
                while (!stoppingToken.IsCancellationRequested)
                {
                    var certProps = await _client.GetCertificateAsync(_certName, stoppingToken);
                    var expiry = certProps.Properties.ExpiresOn;
            
                    // Rotate 30 days before expiry
                    if (expiry - DateTime.UtcNow < TimeSpan.FromDays(30))
                    {
                        await _client.StartReloadCertificateAsync(_certName, stoppingToken);
                        _logger.LogInformation("Certificate {Name} rotated", _certName);
                    }
            
                    var nextCheck = expiry - DateTime.UtcNow - TimeSpan.FromDays(29);
                    await Task.Delay(nextCheck, stoppingToken);
                }
            }
        }

// Encrypt connection string
        services.AddDataProtection()
            .SetApplicationName("SecureApp")
            .PersistKeysToAzureBlobStorage("DefaultEndpointsProtocol=https;") // Azure Blob storage
            .ProtectKeysWithAzureKeyVault(new Uri("https://myvault.vault.azure.net/keys/my-protection-key"), new DefaultAzureCredential());

        // Usage
        public class EncryptedConnectionStringService
        {
            private readonly IDataProtectionProvider _dp;
    
            public EncryptedConnectionStringService(IDataProtectionProvider provider)
                => _dp = provider;
    
            public string DecryptConnectionString(string encrypted)
            {
                var protector = _dp.CreateProtector("ConnectionString");
                return protector.Unprotect(encrypted);
            }
        }

services.AddDataProtection()
            .PersistKeysToFileSystem(new DirectoryInfo("/secure/key-storage"))
            .ProtectKeysWithCryptographicUser(); // Windows DPAPI

// Internal service-to-service auth
        public class ZeroTrustMiddleware
        {
            private readonly RequestDelegate _next;
            private readonly IHttpClientFactory _httpClient;
    
            public ZeroTrustMiddleware(RequestDelegate next, IHttpClientFactory httpClient)
            {
                _next = next;
                _httpClient = httpClient;
            }
    
            public async Task InvokeAsync(HttpContext context)
            {
                // Verify mTLS certificate
                var clientCert = context.Connection.ClientCertificate;
                if (clientCert == null)
                {
                    context.Response.StatusCode = StatusCodes.Status401Unauthorized;
                    return;
                }
        
                // Verify certificate chain
                var isValid = await VerifyCertificateAsync(clientCert);
                if (!isValid)
                {
                    context.Response.StatusCode = StatusCodes.Status401Unauthorized;
                    return;
                }
        
                // Verify request signature
                var signature = context.Request.Headers["X-Request-Signature"];
                if (string.IsNullOrEmpty(signature))
                {
                    context.Response.StatusCode = StatusCodes.Status401Unauthorized;
                    return;
                }
        
                await _next(context);
            }
        }

// Server-side mTLS
        builder.WebHost.ConfigureKestrel(options =>
        {
            options.ListenLocalhost(5001, listenOptions =>
            {
                listenOptions.UseHttps(httpsOptions =>
                {
                    httpsOptions.ServerCertificate = LoadServerCert();
                    httpsOptions.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
                });
            });
        });

        // Client-side mTLS
        var handler = new HttpClientHandler();
        handler.ClientCertificates.Add(LoadClientCert());
        var client = new HttpClient(handler);

// Log all secret access
        public class SecretAccessLogger
        {
            private readonly ILogger<SecretAccessLogger> _logger;
    
            public SecretAccessLogger(ILogger<SecretAccessLogger> logger) => _logger = logger;
    
            public void LogSecretAccess(string secretName, string caller, string ipAddress)
            {
                _logger.LogWarning("Secret accessed: {SecretName} by {Caller} from {Ip}", 
                    secretName, caller, ipAddress);
            }
        }

        // Integration with Key Vault access logging
        // Enable auditing in Azure Portal -> Key Vault -> Diagnostic Settings
        // Route to Log Analytics / Event Hub / Storage Account

┌─────────────────────────────────────────────────┐
        │                  Zero Trust Boundary             │
        │                                                   │
        │  ┌──────────┐    ┌──────────┐    ┌──────────┐   │
        │  │ Identity │    │  Device  │    │  App/    │   │
        │  │ & MFA    │    │ Health   │    │  Data    │   │
        │  └────┬─────┘    └────┬─────┘    └────┬─────┘   │
        │       │               │               │          │
        │       └───────────────┼───────────────┘          │
        │                       │                          │
        │              ┌────────▼────────┐                 │
        │              │  Policy Engine  │                 │
        │              │  (PDP/PEP)      │                 │
        │              └────────┬────────┘                 │
        │                       │                          │
        │              ┌────────▼────────┐                 │
        │              │  Access Gateway │                 │
        │              │  (ZTNA)         │                 │
        │              └─────────────────┘                 │
        └─────────────────────────────────────────────────┘

// Zero Trust middleware pipeline
        public class ZeroTrustMiddleware
        {
            private readonly RequestDelegate _next;
            private readonly IAuthorizationService _auth;
    
            public ZeroTrustMiddleware(
                RequestDelegate next,
                IAuthorizationService auth)
            {
                _next = next;
                _auth = auth;
            }
    
            public async Task InvokeAsync(HttpContext context)
            {
                // 1. Verify identity
                if (!context.User.Identity?.IsAuthenticated == true)
                {
                    context.Response.StatusCode = StatusCodes.Status401Unauthorized;
                    return;
                }
        
                // 2. Verify device health (certificate, platform)
                var clientCert = context.Connection.ClientCertificate;
                if (clientCert == null)
                {
                    context.Response.StatusCode = StatusCodes.Status403Forbidden;
                    return;
                }
        
                // 3. Verify request integrity
                var timestamp = context.Request.Headers["X-Timestamp"].ToString();
                if (string.IsNullOrEmpty(timestamp))
                {
                    context.Response.StatusCode = StatusCodes.Status400BadRequest;
                    return;
                }
        
                var ts = DateTimeOffset.FromUnixTimeSeconds(long.Parse(timestamp));
                if (DateTime.UtcNow - ts > TimeSpan.FromMinutes(5))
                {
                    context.Response.StatusCode = StatusCodes.Status408RequestTimeout;
                    return;
                }
        
                // 4. Policy evaluation
                var result = await _auth.AuthorizeAsync(
                    context.User, 
                    context.Request.Path.ToString(),
                    "ZeroTrustPolicy");
        
                if (!result.Succeeded)
                {
                    context.Response.StatusCode = StatusCodes.Status403Forbidden;
                    return;
                }
        
                await _next(context);
            }
        }

Layer 1: Network Security (Firewall, WAF, DDoS protection)
        Layer 2: Identity (Authentication, MFA, SSO)
        Layer 3: Application (Input validation, Authorization, CSP)
        Layer 4: Data (Encryption, Tokenization, DLP)
        Layer 5: Host (OS hardening, AV, EDR)
        Layer 6: Monitoring (SIEM, logging, alerting)

// Layer 1: Network - HTTPS enforcement + HSTS
        app.UseHttpsRedirection();
        app.UseHsts();

        // Layer 2: Identity - Authentication
        app.UseAuthentication();

        // Layer 3: Application - Authorization
        app.UseAuthorization();

        // Layer 3: Application - Security headers
        app.Use(async (context, next) =>
        {
            context.Response.Headers["X-Content-Type-Options"] = "nosniff";
            context.Response.Headers["X-Frame-Options"] = "DENY";
            context.Response.Headers["Content-Security-Policy"] = "default-src 'self'";
            await next();
        });

        // Layer 3: Application - Input validation
        app.Use(async (context, next) =>
        {
            // Request size limit
            context.Request.EnableBuffering();
            var maxRequestBodySize = 10 * 1024 * 1024; // 10MB
            if (context.Request.ContentLength > maxRequestBodySize)
            {
                context.Response.StatusCode = StatusCodes.Status413PayloadTooLarge;
                return;
            }
            await next();
        });

        // Layer 6: Monitoring - Request logging
        app.Use(async (context, next) =>
        {
            var sw = System.Diagnostics.Stopwatch.StartNew();
            await next();
            sw.Stop();
    
            // Log security-relevant metrics
            if (context.Response.StatusCode >= 400)
            {
                // Log errors for security review
            }
    
            if (sw.Elapsed > TimeSpan.FromSeconds(5))
            {
                // Log slow requests (potential DoS)
            }
        });

1. Identify assets (data, services, infrastructure)
        2. Create data flow diagrams
        3. Identify trust boundaries
        4. Apply STRIDE to each component
        5. Identify mitigations
        6. Validate assumptions

Component: Order API
        Trust Boundary: Public -> API Gateway -> Order Service -> Database

        STRIDE Analysis:
        ┌────────────┬──────────────────────────────────────────┐
        │ Threat     │ Mitigation                               │
        ├────────────┼──────────────────────────────────────────┤
        │ Spoofing   │ JWT authentication, mTLS internal        │
        │ Tampering  │ TLS, request signing, input validation   │
        │ Repudiation│ Audit logging, idempotency keys          │
        │ Info Disc. │ Response filtering, error handling       │
        │ DoS        │ Rate limiting, request timeouts          │
        │ Elevation  │ Policy-based authorization, ownership    │
        └────────────┴──────────────────────────────────────────┘

┌──────────┐    ┌──────────┐    ┌──────────┐    ┌──────────┐
        │  Code    │    │  Build   │    │  Test    │    │  Deploy  │
        │  Review  │ -> │  Scan    │ -> │  (SAST)  │ -> │  (DAST)  │
        └──────────┘    └──────────┘    └──────────┘    └──────────┘
             │               │               │               │
          Manual PR     Dependency      Unit +          Container
          checks        audit           Integration     image scan
                        (Dependabot)    tests           (Trivy)

name: Security Pipeline
        on: [push, pull_request]

        jobs:
          sast:
            runs-on: ubuntu-latest
            steps:
              - uses: actions/checkout@v4
      
              - name: Run SAST scan
                uses: github/codeql-action/init@v3
                with:
                  languages: csharp
      
              - name: Run CodeQL analysis
                uses: github/codeql-action/analyze@v3
  
          dependency-audit:
            runs-on: ubuntu-latest
            steps:
              - uses: actions/checkout@v4
      
              - name: Setup .NET
                uses: actions/setup-dotnet@v4
      
              - name: Audit dependencies
                run: dotnet list package --vulnerable --include-transitive
  
          container-scan:
            runs-on: ubuntu-latest
            steps:
              - name: Build and scan image
                run: |
                  docker build -t myapp:${{ github.sha }} .
                  trivy image --severity HIGH,CRITICAL myapp:${{ github.sha }}

using OtpNet;

        public class TotpService
        {
            private const int SecretKeySize = 20; // 160 bits
            private const int CodeDigits = 6;
            private const int PeriodSeconds = 30;

            public string GenerateSecretKey()
            {
                var key = new byte[SecretKeySize];
                using var rng = RandomNumberGenerator.Create();
                rng.GetBytes(key);
                return Base32.Encode(key);
            }

            public string GenerateUri(string secretKey, string issuer, string account)
            {
                return $"otpauth://totp/{Uri.EscapeDataString(issuer)}:{Uri.EscapeDataString(account)}" +
                       $"?secret={secretKey}&issuer={Uri.EscapeDataString(issuer)}" +
                       $"&digits={CodeDigits}&period={PeriodSeconds}";
            }

            public bool VerifyCode(string secretKey, string code)
            {
                var key = Base32.Decode(secretKey);
                var totp = new Totp(key, CodeDigits, PeriodSeconds);
        
                // Allow 30-second window before and after (60 seconds total)
                var unixTime = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
                var timeStep = (long)(unixTime / PeriodSeconds);
        
                for (int i = -1; i <= 1; i++)
                {
                    if (totp.VerifyTotp(unixTime + (i * PeriodSeconds), code, out _))
                        return true;
                }
                return false;
            }
        }

public class BackupCodeService
        {
            private const int CodeCount = 10;
            private const int CodeLength = 8;

            public List<string> GenerateBackupCodes()
            {
                var codes = new List<string>();
                for (int i = 0; i < CodeCount; i++)
                {
                    var code = GenerateRandomCode();
                    var hashed = HashCode(code);
                    codes.Add(hashed); // Store hashed codes only
                }
                return codes;
            }

            public bool ConsumeCode(string storedHash, string inputCode)
            {
                var inputHash = HashCode(inputCode);
                if (inputHash == storedHash)
                {
                    // Code consumed - mark as used (set to null or delete)
                    return true;
                }
                return false;
            }

            private string GenerateRandomCode()
            {
                const string chars = "0123456789";
                return new string(Enumerable.Repeat(chars, CodeLength)
                    .Select(s => s[RandomNumberGenerator.GetInt32(s.Length)]).ToArray());
            }

            private string HashCode(string code)
            {
                using var sha256 = SHA256.Create();
                var hash = sha256.ComputeHash(Encoding.UTF8.GetBytes(code));
                return Convert.ToHexString(hash);
            }
        }

// User model with MFA state
        public class ApplicationUser : IdentityUser
        {
            public bool TwoFactorEnabled { get; set; }
            public string? TotpSecret { get; set; }
            public DateTime? MfaLockedUntil { get; set; }
            public int FailedMfaAttempts { get; set; }
        }

        // MFA Controller
        [Authorize]
        public class MfaController : ControllerBase
        {
            private readonly UserManager<ApplicationUser> _userManager;
            private readonly SignInManager<ApplicationUser> _signInManager;
            private readonly TotpService _totp;
            private readonly ILogger<MfaController> _logger;

            [HttpPost("mfa/enable")]
            public async Task<IActionResult> EnableMfa()
            {
                var user = await _userManager.GetUserAsync(User);
                var secretKey = _totp.GenerateSecretKey();
        
                // Store secret (encrypted)
                user.TotpSecret = secretKey;
                await _userManager.UpdateAsync(user);
        
                // Return QR code URI for user to scan
                var uri = _totp.GenerateUri(secretKey, "MyApp", user.Email!);
                var qrCodeData = GenerateQrCode(uri); // Base64 PNG
        
                return Ok(new { TotpSecret = secretKey, QrCode = qrCodeData });
            }

            [HttpPost("mfa/verify")]
            public async Task<IActionResult> VerifyMfa([FromBody] MfaVerifyRequest request)
            {
                var user = await _userManager.GetUserAsync(User);
        
                if (!_totp.VerifyCode(user.TotpSecret!, request.Code))
                {
                    user.FailedMfaAttempts++;
                    if (user.FailedMfaAttempts >= 5)
                    {
                        user.MfaLockedUntil = DateTime.UtcNow.AddHours(1);
                    }
                    await _userManager.UpdateAsync(user);
                    return BadRequest(new { error = "Invalid code" });
                }
        
                user.FailedMfaAttempts = 0;
                user.MfaLockedUntil = null;
                await _userManager.UpdateAsync(user);
        
                return Ok(new { success = true });
            }

            [HttpPost("mfa/disable")]
            [RequireMfa] // Custom authorization filter
            public async Task<IActionResult> DisableMfa()
            {
                var user = await _userManager.GetUserAsync(User);
                user.TwoFactorEnabled = false;
                user.TotpSecret = null;
                await _userManager.UpdateAsync(user);
                return Ok();
            }
        }

        // Custom authorization attribute
        public class RequireMfaAttribute : Attribute, IAsyncAuthorizationFilter
        {
            public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
            {
                var user = await context.HttpContext.GetUserManager<ApplicationUser>();
                var userId = context.HttpContext.User.FindFirstValue(ClaimTypes.NameIdentifier);
        
                if (user == null || user.TwoFactorEnabled)
                {
                    context.Result = new ForbidResult();
                    return;
                }
            }
        }

// Install: Microsoft.Identity.Web

        builder.Services.AddMicrosoftIdentityWebAppAuthentication(builder.Configuration)
            .EnableTokenAcquisitionToCallDownstreamApi()
            .AddInMemoryTokenCache();

        // API protection
        builder.Services.AddMicrosoftIdentityWebApiAuthentication(builder.Configuration);

        // Configuration (appsettings.json)
        /*
        {
          "AzureAd": {
            "Instance": "https://login.microsoftonline.com/",
            "TenantId": "<tenant-id>",
            "ClientId": "<client-id>",
            "ClientSecret": "<client-secret>",
            "Scopes": ["user.read", "api://app/read"]
          }
        }
        */

// Install: Sustainsys.Saml2

        builder.Services.AddSaml2(options =>
        {
            options.SPOptions.EntityId = new EntityId("https://app.example.com/saml");
            options.SPOptions.ReturnUrl = new Uri("https://app.example.com/");
    
            options.IdentityProviders.Add(new IdentityProvider(
                new EntityId("https://idp.example.com/saml"),
                options.SPOptions)
            {
                MetadataLocation = "https://idp.example.com/metadata.xml",
                AllowUnsolicitedAuthnResponse = true,
                Wallet = new MetadataWireSyncMetadataStore()
            });
    
            options.SPOptions.ServiceCertificates.Add(
                new X509Certificate2("path/to/cert.pfx", "password"));
        });

        app.UseSaml2();

public class ApiKeyService
        {
            private const int KeyLength = 32;
            private readonly ApplicationDbContext _db;
            private readonly ILogger<ApiKeyService> _logger;

            public async Task<ApiKeyDto> GenerateKeyAsync(
                string ownerId, 
                IEnumerable<string> scopes, 
                DateTimeOffset? expiry)
            {
                var rawKey = GenerateRandomKey();
                var hashedKey = HashKey(rawKey);
        
                var apiKey = new ApiKey
                {
                    Id = Guid.NewGuid(),
                    OwnerId = ownerId,
                    Name = $"key-{DateTime.UtcNow:yyyyMMdd-HHmmss}",
                    KeyHash = hashedKey,
                    Scopes = scopes.ToList(),
                    ExpiresAt = expiry,
                    IsActive = true,
                    CreatedAt = DateTime.UtcNow
                };
        
                _db.ApiKeys.Add(apiKey);
                await _db.SaveChangesAsync();
        
                _logger.LogInformation("API key generated for user {OwnerId}", ownerId);
        
                return new ApiKeyDto
                {
                    Id = apiKey.Id,
                    Name = apiKey.Name,
                    Key = rawKey, // Only returned once!
                    Scopes = apiKey.Scopes,
                    ExpiresAt = apiKey.ExpiresAt
                };
            }

            public async Task<bool> ValidateKeyAsync(string rawKey, IEnumerable<string> requiredScopes)
            {
                var hashedKey = HashKey(rawKey);
                var apiKey = await _db.ApiKeys.FirstOrDefaultAsync(k => k.KeyHash == hashedKey);
        
                if (apiKey == null || !apiKey.IsActive)
                    return false;
        
                if (apiKey.ExpiresAt.HasValue && apiKey.ExpiresAt < DateTime.UtcNow)
                    return false;
        
                // Scope check
                var missingScopes = requiredScopes.Except(apiKey.Scopes).ToList();
                if (missingScopes.Any())
                    return false;
        
                // Update usage
                apiKey.LastUsedAt = DateTime.UtcNow;
                apiKey.UsageCount++;
                await _db.SaveChangesAsync();
        
                return true;
            }

            public async Task RevokeKeyAsync(Guid keyId, string reason)
            {
                var apiKey = await _db.ApiKeys.FindAsync(keyId);
                if (apiKey != null)
                {
                    apiKey.IsActive = false;
                    apiKey.RevokedAt = DateTime.UtcNow;
                    apiKey.RevocationReason = reason;
                    await _db.SaveChangesAsync();
                }
            }

            public async Task RotateKeyAsync(Guid keyId, string newOwnerName)
            {
                var newRawKey = GenerateRandomKey();
                var newHashedKey = HashKey(newRawKey);
        
                var apiKey = await _db.ApiKeys.FindAsync(keyId);
                if (apiKey != null)
                {
                    apiKey.KeyHash = newHashedKey;
                    apiKey.CreatedAt = DateTime.UtcNow;
                    apiKey.LastUsedAt = null;
                    apiKey.UsageCount = 0;
                    await _db.SaveChangesAsync();
            
                    _logger.LogInformation("API key {KeyId} rotated for {Owner}", keyId, newOwnerName);
                }
            }

            private string GenerateRandomKey()
            {
                var bytes = new byte[KeyLength];
                using var rng = RandomNumberGenerator.Create();
                rng.GetBytes(bytes);
                return $"sk-{Convert.ToHexString(bytes).ToLower()}";
            }

            private string HashKey(string key)
            {
                using var sha256 = SHA256.Create();
                return Convert.ToHexString(sha256.ComputeHash(Encoding.UTF8.GetBytes(key)));
            }
        }

        // Middleware for API Key validation
        public class ApiKeyMiddleware
        {
            private readonly RequestDelegate _next;
            private readonly ApiKeyService _apiKeyService;
            private readonly ILogger<ApiKeyMiddleware> _logger;

            public ApiKeyMiddleware(RequestDelegate next, ApiKeyService apiKeyService, ILogger<ApiKeyMiddleware> logger)
            {
                _next = next;
                _apiKeyService = apiKeyService;
                _logger = logger;
            }

            public async Task InvokeAsync(HttpContext context)
            {
                if (!context.Request.Headers.TryGetValue("X-API-Key", out var apiKeyHeader))
                {
                    context.Response.StatusCode = StatusCodes.Status401Unauthorized;
                    await context.Response.WriteAsJsonAsync(new { error = "API key required" });
                    return;
                }

                var requiredScopes = ExtractScopesFromRoute(context);
                var isValid = await _apiKeyService.ValidateKeyAsync(apiKeyHeader, requiredScopes);
        
                if (!isValid)
                {
                    _logger.LogWarning("Invalid API key used from {Ip}", context.Connection.RemoteIpAddress);
                    context.Response.StatusCode = StatusCodes.Status401Unauthorized;
                    await context.Response.WriteAsJsonAsync(new { error = "Invalid or expired API key" });
                    return;
                }

                await _next(context);
            }

            private IEnumerable<string> ExtractScopesFromRoute(HttpContext context)
            {
                return context.Request.Path.Value?.Split('/')
                    .Where(s => !string.IsNullOrEmpty(s) && s != "api")
                    .Select(s => $"{s}.read") ?? Array.Empty<string>();
            }
        }

// Service A calls Service B via mTLS
        public class ServiceClient
        {
            private readonly HttpClient _client;

            public ServiceClient(IHttpClientFactory factory, X509Certificate2 clientCert)
            {
                var handler = new HttpClientHandler();
                handler.ClientCertificates.Add(clientCert);
                handler.ServerCertificateCustomValidationCallback = 
                    HttpClientHandler.DangerousAcceptAnyServerCertificateValidator; // In production, validate properly
        
                _client = factory.CreateClient("mtls");
                _client = new HttpClient(handler);
            }

            public async Task<T> CallServiceAsync<T>(string endpoint)
            {
                var response = await _client.GetAsync(endpoint);
                response.EnsureSuccessStatusCode();
                return await response.Content.ReadFromJsonAsync<T>();
            }
        }

// Service-to-service JWT using client credentials flow
        public class ServiceTokenProvider
        {
            private readonly HttpClient _httpClient;
            private readonly TokenClient _tokenClient;
            private string? _cachedToken;
            private DateTime _tokenExpiry;

            public ServiceTokenProvider(HttpClient httpClient, IConfiguration config)
            {
                _httpClient = httpClient;
                _tokenClient = new TokenClient(
                    config["AuthServer:TokenUrl"],
                    config["ServiceClientId"],
                    config["ServiceClientSecret"]);
            }

            public async Task<string> GetAccessTokenAsync(string scope)
            {
                // Return cached token if valid
                if (_cachedToken != null && _tokenExpiry > DateTime.UtcNow.AddMinutes(1))
                    return _cachedToken;
        
                // Request new token
                var response = await _tokenClient.RequestClientCredentialsAsync(scope);
        
                if (response.IsError)
                    throw new InvalidOperationException($"Token request failed: {response.Error}");
        
                _cachedToken = response.AccessToken;
                _tokenExpiry = DateTime.UtcNow.AddSeconds(response.ExpiresIn - 30);
        
                return _cachedToken;
            }
        }

builder.Services.ConfigureApplicationCookie(options =>
        {
            // Security flags
            options.Cookie.HttpOnly = true;      // No JS access
            options.Cookie.SecurePolicy = CookieSecurePolicy.Always; // HTTPS only
            options.Cookie.SameSite = SameSiteMode.Strict; // CSRF protection
    
            // Session management
            options.ExpireTimeSpan = TimeSpan.FromMinutes(30);
            options.SlidingExpiration = true;
            options.AccessDeniedPath = "/account/access-denied";
            options.LoginPath = "/account/login";
    
            // Session fixation prevention
            options.Events.OnRedirectToLogin = context =>
            {
                context.Response.Headers["Cache-Control"] = "no-cache, no-store, must-revalidate";
                return context.Response.Redirect(context.RedirectUri);
            };
        });

public class SessionSecurityMiddleware
        {
            private readonly RequestDelegate _next;

            public SessionSecurityMiddleware(RequestDelegate next) => _next = next;

            public async Task InvokeAsync(HttpContext context)
            {
                // Detect session fixation attempts
                var originalSessionId = context.Request.Cookies[".AspNetCore.Identity.Application"];
        
                await _next(context);
        
                // After authentication, ensure new session ID
                if (context.User.Identity?.IsAuthenticated == true && 
                    originalSessionId != context.Response.Cookies[".AspNetCore.Identity.Application"])
                {
                    // Session was properly regenerated
                }
            }
        }

// Configure structured logging
        builder.Logging.ClearProviders();
        builder.Logging.AddJsonConsole(options =>
        {
            options.JsonFormatterOptions.IncludeScopes = true;
        });

        // Security event logger
        public class SecurityEventLogger
        {
            private readonly ILogger<SecurityEventLogger> _logger;
            private readonly IHttpContextAccessor _httpContext;

            public SecurityEventLogger(
                ILogger<SecurityEventLogger> logger,
                IHttpContextAccessor httpContext)
            {
                _logger = logger;
                _httpContext = httpContext;
            }

            public void LogLoginFailure(string username, string reason)
            {
                var ip = GetIpAddress();
                _logger.LogWarning(
                    "Login failed: user={Username} ip={Ip} reason={Reason}",
                    username, ip, reason);
            }

            public void LogAccessDenied(string userId, string resource, string action)
            {
                var ip = GetIpAddress();
                _logger.LogWarning(
                    "Access denied: user={UserId} resource={Resource} action={Action} ip={Ip}",
                    userId, resource, action, ip);
            }

            public void LogPrivilegeEscalation(string adminUser, string targetUser, string newRole)
            {
                _logger.LogCritical(
                    "PRIVILEGE ESCALATION: admin={AdminUser} target={TargetUser} role={NewRole}",
                    adminUser, targetUser, newRole);
            }

            private string GetIpAddress()
            {
                var context = _httpContext.HttpContext;
                if (context == null) return "unknown";
        
                var ip = context.Connection.RemoteIpAddress?.ToString() ?? "unknown";
        
                // Handle forwarded headers (behind load balancer)
                if (context.Request.Headers.TryGetValue("X-Forwarded-For", out var forwarded))
                {
                    ip = forwarded.First();
                }
        
                return ip;
            }
        }

public class TamperEvidentAuditLogger
        {
            private readonly ApplicationDbContext _db;
            private readonly ILogger<TamperEvidentAuditLogger> _logger;
            private readonly SemaphoreSlim _lock = new(1, 1);

            public TamperEvidentAuditLogger(
                ApplicationDbContext db,
                ILogger<TamperEvidentAuditLogger> logger)
            {
                _db = db;
                _logger = logger;
            }

            public async Task LogAsync(AuditEvent evt)
            {
                await _lock.WaitAsync();
                try
                {
                    // Get previous hash for chain
                    var previousLog = await _db.AuditLogs
                        .OrderByDescending(l => l.Id)
                        .FirstOrDefaultAsync();
            
                    var previousHash = previousLog?.CurrentHash ?? "GENESIS";
            
                    // Calculate current hash
                    var hashInput = $"{evt.Type}:{evt.UserId}:{evt.Resource}:{evt.Timestamp}:{previousHash}";
                    var currentHash = ComputeHash(hashInput);
            
                    var auditLog = new AuditLog
                    {
                        Id = evt.Id,
                        Type = evt.Type,
                        UserId = evt.UserId,
                        Resource = evt.Resource,
                        Details = evt.Details,
                        IpAddress = evt.IpAddress,
                        PreviousHash = previousHash,
                        CurrentHash = currentHash,
                        Timestamp = DateTime.UtcNow
                    };
            
                    _db.AuditLogs.Add(auditLog);
                    await _db.SaveChangesAsync();
            
                    // Periodic anchoring (every 100 records)
                    var count = await _db.AuditLogs.CountAsync();
                    if (count % 100 == 0)
                    {
                        await AnchorHashAsync(currentHash);
                    }
                }
                finally
                {
                    _lock.Release();
                }
            }

            private string ComputeHash(string input)
            {
                using var sha256 = SHA256.Create();
                var bytes = sha256.ComputeHash(Encoding.UTF8.GetBytes(input));
                return Convert.ToHexString(bytes);
            }

            private async Task AnchorHashAsync(string hash)
            {
                // Store hash in external secure location (email, immutable storage)
                // This prevents DBA from rewriting history
                var anchor = new HashAnchor
                {
                    AnchorHash = hash,
                    AnchorAtId = await _db.AuditLogs.MaxAsync(l => l.Id),
                    AnchoredAt = DateTime.UtcNow
                };
                _db.HashAnchors.Add(anchor);
                await _db.SaveChangesAsync();
            }
        }

        // Verification engine
        public class AuditTrailVerifier
        {
            private readonly ApplicationDbContext _db;

            public AuditTrailVerifier(ApplicationDbContext db) => _db = db;

            public async Task<VerificationResult> VerifyAsync()
            {
                var logs = await _db.AuditLogs.OrderBy(l => l.Id).ToListAsync();
                var anchors = await _db.HashAnchors.ToListAsync();
        
                string expectedPreviousHash = "GENESIS";
                var violations = new List<Violation>();
        
                foreach (var log in logs)
                {
                    if (log.PreviousHash != expectedPreviousHash)
                    {
                        violations.Add(new Violation
                        {
                            LogId = log.Id,
                            Type = "HashChainBroken",
                            Message = $"Expected {expectedPreviousHash}, got {log.PreviousHash}"
                        });
                    }
            
                    var computedHash = ComputeHash(
                        $"{log.Type}:{log.UserId}:{log.Resource}:{log.Timestamp}:{log.PreviousHash}");
            
                    if (computedHash != log.CurrentHash)
                    {
                        violations.Add(new Violation
                        {
                            LogId = log.Id,
                            Type = "PayloadTampered",
                            Message = $"Hash mismatch for log {log.Id}"
                        });
                    }
            
                    expectedPreviousHash = log.CurrentHash;
                }
        
                return new VerificationResult
                {
                    IsValid = violations.Count == 0,
                    Violations = violations,
                    TotalRecords = logs.Count,
                    AnchorsVerified = anchors.Count
                };
            }

            private string ComputeHash(string input)
            {
                using var sha256 = SHA256.Create();
                var bytes = sha256.ComputeHash(Encoding.UTF8.GetBytes(input));
                return Convert.ToHexString(bytes);
            }
        }

public class BruteForceDetector
        {
            private readonly IDatabaseCache _cache;
            private readonly ILogger<BruteForceDetector> _logger;

            private const int MaxAttempts = 5;
            private const int LockoutMinutes = 15;
            private const int ProgressiveDelaySeconds = 10;

            public async Task<BruteForceResult> CheckAsync(string identifier)
            {
                var key = $"bf:{identifier}";
                var attempts = await _cache.GetIntAsync(key) ?? 0;
        
                if (attempts >= MaxAttempts)
                {
                    var lockedUntil = await _cache.GetStringAsync($"{key}:locked");
                    if (DateTimeOffset.TryParse(lockedUntil, out var lockTime) && 
                        lockTime > DateTimeOffset.UtcNow)
                    {
                        _logger.LogWarning("Account locked: {Identifier} attempts={Attempts}", 
                            identifier, attempts);
                        return BruteForceResult.Locked((int)(lockTime - DateTimeOffset.UtcNow).TotalMinutes);
                    }
                    else
                    {
                        // Lock expired, reset
                        await _cache.RemoveAsync(key);
                        await _cache.RemoveAsync($"{key}:locked");
                    }
                }
        
                return BruteForceResult.Continue(attempts);
            }

            public async Task RecordFailureAsync(string identifier)
            {
                var key = $"bf:{identifier}";
                var attempts = await _cache.GetIntAsync(key) ?? 0;
                attempts++;
        
                await _cache.SetIntAsync(key, attempts);
                await _cache.SetExpiryAsync(key, TimeSpan.FromMinutes(30));
        
                if (attempts >= MaxAttempts)
                {
                    var lockUntil = DateTimeOffset.UtcNow.AddMinutes(LockoutMinutes);
                    await _cache.SetStringAsync($"{key}:locked", lockUntil.ToString());
                    await _cache.SetExpiryAsync($"{key}:locked", 
                        TimeSpan.FromMinutes(LockoutMinutes + 1));
            
                    _logger.LogWarning("Account locked after {Attempts} failed attempts: {Identifier}",
                        attempts, identifier);
                }
            }

            public async Task ResetAsync(string identifier)
            {
                await _cache.RemoveAsync($"bf:{identifier}");
                await _cache.RemoveAsync($"bf:{identifier}:locked");
            }
        }

        // Login endpoint with brute force protection
        [HttpPost("login")]
        public async Task<IActionResult> Login([FromBody] LoginRequest request)
        {
            var detector = new BruteForceDetector(_cache, _logger);
    
            // Check if account is locked
            var result = await detector.CheckAsync(request.Username);
            if (result.IsLocked)
            {
                return TooManyRequests($"Account locked for {result.LockoutMinutes} minutes");
            }
    
            // Progressive delay
            if (result.Attempts > 0)
            {
                await Task.Delay(TimeSpan.FromSeconds(result.Attempts * ProgressiveDelaySeconds));
            }
    
            // Attempt login
            var user = await _userManager.FindByNameAsync(request.Username);
            if (user == null || !await _userManager.CheckPasswordAsync(user, request.Password))
            {
                await detector.RecordFailureAsync(request.Username);
                return Unauthorized();
            }
    
            // Success - reset counter
            await detector.ResetAsync(request.Username);
    
            // Login logic...
            return Ok();
        }

public class AnomalyDetector
        {
            private readonly ApplicationDbContext _db;
            private readonly ILogger<AnomalyDetector> _logger;

            public async Task DetectAsync(SecurityEvent evt)
            {
                // 1. Geographic anomaly
                if (await IsGeographicAnomaly(evt.UserId, evt.IpAddress))
                {
                    _logger.LogWarning("GEOGRAPHIC ANOMALY: user={UserId} ip={Ip}", 
                        evt.UserId, evt.IpAddress);
                    await AlertSecurityTeamAsync(evt);
                }
        
                // 2. Time anomaly
                if (await IsTimeAnomaly(evt.UserId, DateTime.UtcNow))
                {
                    _logger.LogWarning("TIME ANOMALY: user={UserId} hour={Hour}", 
                        evt.UserId, DateTime.UtcNow.Hour);
                    await AlertSecurityTeamAsync(evt);
                }
        
                // 3. Volume anomaly
                if (await IsVolumeAnomaly(evt.UserId, evt.Type))
                {
                    _logger.LogWarning("VOLUME ANOMALY: user={UserId} type={Type}", 
                        evt.UserId, evt.Type);
                    await AlertSecurityTeamAsync(evt);
                }
        
                // 4. Privilege anomaly
                if (evt.Type == "RoleChange" || evt.Type == "PermissionGrant")
                {
                    _logger.LogCritical("PRIVILEGE ANOMALY: {Event}", evt.Details);
                    await AlertSecurityTeamAsync(evt);
                }
            }

            private async Task<bool> IsGeographicAnomaly(string userId, string ipAddress)
            {
                var recentEvents = await _db.SecurityEvents
                    .Where(e => e.UserId == userId && 
                               e.Timestamp > DateTime.UtcNow.AddHours(-1))
                    .ToListAsync();
        
                if (recentEvents.Count < 2) return false;
        
                var ips = recentEvents.Select(e => e.IpAddress).Distinct().ToList();
                return ips.Count > 3; // More than 3 different IPs in 1 hour
            }

            private async Task<bool> IsTimeAnomaly(string userId, DateTime now)
            {
                var businessHours = now.Hour is >= 7 and <= 19 && 
                                   now.DayOfWeek is not (DayOfWeek.Saturday or DayOfWeek.Sunday);
        
                if (businessHours) return false;
        
                var afterHoursCount = await _db.SecurityEvents
                    .CountAsync(e => e.UserId == userId && 
                                   e.Timestamp > DateTime.UtcNow.AddHours(-1) &&
                                   !businessHours);
        
                return afterHoursCount > 5;
            }

            private async Task<bool> IsVolumeAnomaly(string userId, string eventType)
            {
                var count = await _db.SecurityEvents
                    .CountAsync(e => e.UserId == userId && 
                                   e.Type == eventType &&
                                   e.Timestamp > DateTime.UtcNow.AddMinutes(-5));
        
                return count > 100; // More than 100 events in 5 minutes
            }

            private async Task AlertSecurityTeamAsync(SecurityEvent evt)
            {
                // Send to SIEM, Slack, Email
                _logger.LogCritical("SECURITY ALERT: {Event}", evt.Details);
            }
        }

1. Preparation
           - Security tools (SIEM, EDR, WAF)
           - Team roles and contacts
           - Communication plan

        2. Identification
           - Detect anomaly (automated or manual)
           - Classify severity (P1-P4)
           - Create incident ticket

        3. Containment
           - Short-term: isolate affected system
           - Long-term: patch, rotate credentials

        4. Eradication
           - Remove attacker access
           - Clean compromised systems
           - Patch vulnerability

        5. Recovery
           - Restore from clean backup
           - Monitor for recurrence
           - Validate system integrity

        6. Lessons Learned
           - Post-incident review
           - Update playbooks
           - Improve detection

1. Detect: WAF/SIEM alerts on SQL injection pattern
        2. Contain:
           - Block attacking IP via WAF
           - Disable affected API endpoint
           - Preserve logs and evidence
        3. Assess:
           - Determine if data was exfiltrated
           - Check database for unauthorized queries
           - Review audit trail
        4. Eradicate:
           - Fix vulnerable query (parameterize)
           - Rotate database credentials
           - Review all endpoints for similar issues
        5. Recover:
           - Re-enable endpoint after fix
           - Monitor for recurrence
        6. Report:
           - Document timeline and impact
           - Notify affected parties if needed
           - Update security controls

public class EvidencePreservationService
        {
            private readonly ICloudStorage _storage;
            private readonly ILogger<EvidencePreservationService> _logger;

            public async Task PreserveEvidenceAsync(Incident incident)
            {
                var evidenceId = Guid.NewGuid();
                var container = $"evidence/{incident.Id}/{evidenceId}";
        
                // 1. Memory dump (if applicable)
                // 2. Disk image (if applicable)
                // 3. Log collection
                var logs = await CollectLogsAsync(incident);
                await _storage.UploadAsync(container, "logs.json", logs);
        
                // 4. Configuration snapshot
                var config = await CollectConfigurationAsync();
                await _storage.UploadAsync(container, "config.json", config);
        
                // 5. Hash all evidence
                var manifest = new EvidenceManifest
                {
                    EvidenceId = evidenceId,
                    IncidentId = incident.Id,
                    CollectedAt = DateTime.UtcNow,
                    Files = new List<EvidenceFile>
                    {
                        new() { Name = "logs.json", Hash = ComputeHash(logs) },
                        new() { Name = "config.json", Hash = ComputeHash(config) }
                    }
                };
        
                await _storage.UploadAsync(container, "manifest.json", 
                    JsonSerializer.Serialize(manifest));
        
                // Store manifest hash in immutable storage
                await _storage.UploadAsync("evidence-manifests", 
                    evidenceId.ToString(), ComputeHash(JsonSerializer.Serialize(manifest)));
        
                _logger.LogInformation("Evidence preserved: {EvidenceId} for incident {IncidentId}",
                    evidenceId, incident.Id);
            }
        }

┌─────────────────────────────────────────────────────┐
        │                    SPA / Mobile                      │
        └────────────────────┬────────────────────────────────┘
                             │ HTTPS + JWT / OAuth2
                             ▼
        ┌─────────────────────────────────────────────────────┐
        │              API Gateway / Reverse Proxy             │
        │         (Rate Limiting, CORS, Security Headers)      │
        └────────────────────┬────────────────────────────────┘
                             │
                 ┌───────────┼───────────┐
                 ▼           ▼           ▼
        ┌────────────┐ ┌──────────┐ ┌──────────┐
        │  Auth Svc  │ │  API Svc │ │ User Svc │
        │  (OIDC/    │ │ (RBAC +  │ │ (ABAC +  │
        │   MFA)     │ │  HMAC)   │ │  Audit)  │
        └─────┬──────┘ └────┬─────┘ └────┬─────┘
              │              │            │
              └──────────────┼────────────┘
                             ▼
        ┌─────────────────────────────────────────────────────┐
        │              Shared Infrastructure                   │
        │   Redis (Rate Limiting, Sessions)                    │
        │   SQL Server (Data, Audit Logs)                      │
        │   Azure Key Vault (Secrets, Certificates)            │
        │   SIEM / Log Analytics (Monitoring)                  │
        └─────────────────────────────────────────────────────┘

// Auth Service — OIDC provider
        builder.Services.AddAuthentication(options =>
        {
            options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
        })
        .AddCookie()
        .AddOpenIdConnect(options =>
        {
            options.Authority = "https://auth.example.com";
            options.ClientId = "secure-api-client";
            options.ResponseType = OpenIdConnectResponseType.Code;
            options.UsePkce = true;
            options.Scope.Add("openid");
            options.Scope.Add("profile");
            options.Scope.Add("email");
            options.Scope.Add("api://secure-api.read");
            options.Scope.Add("api://secure-api.write");
            options.SaveTokens = true;
            options.GetClaimsFromUserInfoEndpoint = true;
        });

        // JWT token issuance
        public class TokenService
        {
            public (string AccessToken, RefreshToken RefreshToken) GenerateTokens(
                ApplicationUser user, IEnumerable<string> roles)
            {
                // RS256 signing
                using var rsa = RSA.Create(2048);
                rsa.ImportFromPem(File.ReadAllText("private-key.pem"));
                var securityKey = new RsaSecurityKey(rsa);
                var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.RsaSha256);
        
                var claims = new List<Claim>
                {
                    new(JwtRegisteredClaimNames.Sub, user.Id),
                    new(JwtRegisteredClaimNames.UniqueName, user.Email!),
                    new(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
                    new(JwtRegisteredClaimNames.Iat, DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString())
                };
                claims.AddRange(roles.Select(r => new Claim(ClaimTypes.Role, r)));
        
                var token = new JwtSecurityToken(
                    issuer: "https://auth.example.com",
                    audience: "https://secure-api.example.com",
                    claims: claims,
                    expires: DateTime.UtcNow.AddMinutes(15),
                    signingCredentials: credentials);
        
                var accessToken = new JwtSecurityTokenHandler().WriteToken(token);
        
                var refreshToken = new RefreshToken
                {
                    Token = HashToken(Guid.NewGuid().ToString()),
                    UserId = user.Id,
                    Expires = DateTime.UtcNow.AddDays(14),
                    Created = DateTime.UtcNow
                };
        
                return (accessToken, refreshToken);
            }
        }

// RBAC — Role-based
        builder.Services.AddAuthorization(options =>
        {
            options.AddPolicy("AdminOnly", policy => policy.RequireRole("Admin"));
            options.AddPolicy("ManagerOrAbove", policy => 
                policy.Requirements.Add(new RoleHierarchyRequirement("Manager")));
    
            // ABAC — Attribute-based
            options.AddPolicy("DepartmentAccess", policy =>
                policy.Requirements.Add(new DepartmentMatchRequirement()));
    
            // Hybrid — RBAC + ABAC
            options.AddPolicy("SensitiveDataAccess", policy =>
            {
                policy.RequireRole("Admin", "Manager");
                policy.Requirements.Add(new SecurityLevelRequirement(3));
                policy.Requirements.Add(new DepartmentMatchRequirement());
            });
        });

        // ABAC Handler
        public class DepartmentMatchRequirement : IAuthorizationRequirement { }

        public class DepartmentMatchHandler : AuthorizationHandler<DepartmentMatchRequirement>
        {
            protected override Task HandleRequirementAsync(
                AuthorizationHandlerContext context,
                DepartmentMatchRequirement requirement)
            {
                var userDept = context.User.FindFirstValue("department");
                var resourceDept = GetResourceDepartment(context.Resource);
        
                if (userDept == resourceDept)
                    context.Succeed(requirement);
        
                return Task.CompletedTask;
            }
        }

        // Security Level Requirement
        public class SecurityLevelRequirement : IAuthorizationRequirement
        {
            public int RequiredLevel { get; }
            public SecurityLevelRequirement(int level) => RequiredLevel = level;
        }

        public class SecurityLevelHandler : AuthorizationHandler<SecurityLevelRequirement>
        {
            protected override Task HandleRequirementAsync(
                AuthorizationHandlerContext context,
                SecurityLevelRequirement requirement)
            {
                var userLevel = int.Parse(context.User.FindFirstValue("security_level") ?? "0");
                if (userLevel >= requirement.RequiredLevel)
                    context.Succeed(requirement);
        
                return Task.CompletedTask;
            }
        }

// Distributed rate limiting with Redis
        builder.Services.AddSingleton<IConnectionMultiplexer>(
            ConnectionMultiplexer.Connect("redis://cache.example.com:6379"));
        builder.Services.AddSingleton<RedisRateLimiter>();
        builder.Services.AddMiddleware<RateLimitMiddleware>();

        // CORS
        builder.Services.AddCors(options =>
        {
            options.AddPolicy("SecureApi", policy =>
                policy.WithOrigins("https://app.example.com")
                    .WithMethods("GET", "POST", "PUT", "DELETE")
                    .WithHeaders(HeaderNames.Authorization, HeaderNames.ContentType)
                    .AllowCredentials());
        });

        // CSRF
        builder.Services.AddAntiforgery(options =>
        {
            options.HeaderName = "X-CSRF-TOKEN";
            options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
            options.Cookie.SameSite = SameSiteMode.Strict;
        });

// Azure Key Vault integration
        var credential = new DefaultAzureCredential();
        var vaultUri = new Uri("https://myvault.vault.azure.net/");

        builder.Configuration.AddAzureKeyVault(vaultUri, credential);

        // Data Protection with Key Vault
        services.AddDataProtection()
            .SetApplicationName("SecureApi")
            .ProtectKeysWithAzureKeyVault(
                new Uri("https://myvault.vault.azure.net/keys/dpkey"),
                credential);

        // Secret access with auditing
        public class AuditedSecretService
        {
            private readonly SecretClient _client;
            private readonly SecurityEventLogger _logger;
    
            public async Task<string> GetSecretAsync(string name)
            {
                var secret = await _client.GetSecretAsync(name);
                _logger.LogSecretAccess(name, "secret-service", "internal");
                return secret.Value;
            }
        }

// Tamper-evident audit logging
        public class SecurityAuditService
        {
            private readonly ApplicationDbContext _db;
            private readonly SecurityEventLogger _eventLogger;
            private readonly AnomalyDetector _anomalyDetector;
    
            public async Task LogSecurityEvent(SecurityEvent evt)
            {
                // 1. Log to audit trail (hash-chained)
                await _auditLogger.LogAsync(evt);
        
                // 2. Log for SIEM
                _eventLogger.Log(evt);
        
                // 3. Check for anomalies
                await _anomalyDetector.DetectAsync(evt);
        
                // 4. Check brute force
                if (evt.Type == "LoginFailure")
                {
                    await _bruteForceDetector.RecordFailureAsync(evt.UserId);
                }
            }
        }

        // EF Core Interceptor for automatic audit
        public class AuditInterceptor : SaveChangesInterceptor
        {
            public override async ValueTask<InterceptionResult<int>> SavingChangesAsync(
                DbContextEventData eventData,
                InterceptionResult<int> result,
                CancellationToken cancellationToken = default)
            {
                if (eventData.Context == null) return await base.SavingChangesAsync(eventData, result, cancellationToken);
        
                var audits = new List<AuditLog>();
        
                foreach (var entry in eventData.Context.ChangeTracker.Entries())
                {
                    if (entry.Entity is IAuditableEntity auditable)
                    {
                        audits.Add(new AuditLog
                        {
                            EntityType = entry.Entity.GetType().Name,
                            EntityId = GetPrimaryKey(entry),
                            Action = entry.State.ToString(),
                            UserId = auditable.ModifiedBy,
                            OldValues = entry.OriginalValues.ToDictionary(),
                            NewValues = entry.CurrentValues.ToDictionary(),
                            Timestamp = DateTime.UtcNow
                        });
                    }
                }
        
                // Save audit logs
                if (audits.Any())
                {
                    eventData.Context.AuditLogs.AddRange(audits);
                    await eventData.Context.SaveChangesAsync(cancellationToken);
                }
        
                return await base.SavingChangesAsync(eventData, result, cancellationToken);
            }
        }

# .github/workflows/security.yml
        name: Security Pipeline

        on: [push, pull_request, workflow_dispatch]

        jobs:
          sast:
            name: Static Analysis
            runs-on: ubuntu-latest
            steps:
              - uses: actions/checkout@v4
              - name: Setup .NET
                uses: actions/setup-dotnet@v4
              - name: Run CodeQL
                uses: github/codeql-action/init@v3
                with: { languages: csharp }
              - name: Analyze
                uses: github/codeql-action/analyze@v3

          dependency-audit:
            name: Dependency Audit
            runs-on: ubuntu-latest
            steps:
              - uses: actions/checkout@v4
              - name: Setup .NET
                uses: actions/setup-dotnet@v4
              - name: Audit
                run: dotnet list package --vulnerable --include-transitive
              - name: Run Snyk
                uses: snyk/actions/dotnet@master
                env:
                  SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

          container-scan:
            name: Container Scan
            runs-on: ubuntu-latest
            steps:
              - name: Build image
                run: docker build -t secure-api:${{ github.sha }} .
              - name: Trivy scan
                uses: aquasecurity/trivy-action@master
                with:
                  image-ref: secure-api:${{ github.sha }}
                  severity: HIGH,CRITICAL

          dast:
            name: Dynamic Analysis
            runs-on: ubuntu-latest
            needs: [sast, dependency-audit]
            steps:
              - name: Start app
                run: docker compose up -d
              - name: Run OWASP ZAP
                uses: zaproxy/action-full-scan@v0.8.0
                with:
                  target: 'http://localhost:5000'

          security-gate:
            name: Security Gate
            needs: [sast, dependency-audit, container-scan, dast]
            runs-on: ubuntu-latest
            if: always()
            steps:
              - name: Check results
                run: |
                  if [ "${{ needs.sast.result }}" != "success" ] || \
                     [ "${{ needs.dependency-audit.result }}" != "success" ] || \
                     [ "${{ needs.container-scan.result }}" != "success" ] || \
                     [ "${{ needs.dast.result }}" != "success" ]; then
                    echo "Security gate FAILED"
                    exit 1
                  fi
                  echo "Security gate PASSED"

SecureApiPlatform/
        ├── src/
        │   ├── SecureApi.Auth/           # Auth service (OIDC, JWT, MFA)
        │   │   ├── Controllers/
        │   │   ├── Services/
        │   │   │   ├── TokenService.cs
        │   │   │   ├── MfaService.cs
        │   │   │   └── RefreshTokenService.cs
        │   │   └── Program.cs
        │   │
        │   ├── SecureApi.Api/            # Main API
        │   │   ├── Controllers/
        │   │   ├── Middleware/
        │   │   │   ├── RateLimitMiddleware.cs
        │   │   │   ├── SecurityHeadersMiddleware.cs
        │   │   │   └── AuditMiddleware.cs
        │   │   ├── Authorization/
        │   │   │   ├── Handlers/
        │   │   │   ├── Requirements/
        │   │   │   └── Policies.cs
        │   │   └── Program.cs
        │   │
        │   ├── SecureApi.Shared/         # Shared
        │   │   ├── Models/
        │   │   ├── Interfaces/
        │   │   ├── Extensions/
        │   │   └── SecurityEvents.cs
        │   │
        │   └── SecureApi.Infrastructure/ # Infrastructure
        │       ├── Data/
        │       │   ├── ApplicationDbContext.cs
        │       │   └── Interceptors/
        │       │       └── AuditInterceptor.cs
        │       ├── Security/
        │       │   ├── Cryptography/
        │       │   ├── KeyVault/
        │       │   └── RateLimiting/
        │       └── Monitoring/
        │           ├── Logging/
        │           └── AnomalyDetection/
        │
        ├── tests/
        │   ├── SecureApi.UnitTests/
        │   ├── SecureApi.IntegrationTests/
        │   └── SecureApi.SecurityTests/
        │
        ├── docker-compose.yml
        ├── .github/workflows/security.yml
        └── README.md