Securing and Implementing Resilience in .NET Core Applications

Security and resilience are two important aspects that should be considered when developing applications of any scale. Security protects an application's secrets, performs authentication, and provides authorized access to secure content, whereas resiliency embraces the application if it fails so that it can degrade gracefully. Resiliency makes an application highly available and allows the application to function properly at the time when an error occurs or when it is in a faulty state. It is widely used with the microservices architecture, where an application is decomposed into multiple services and each service communicates with other services to perform an operation.

There are various techniques and libraries available in .NET Core that we can use to implement security and resiliency. In ASP.NET Core applications...

Introduction to resilient applications

Developing applications with resiliency as an important factor always makes your customers happy. Today, applications are distributed by nature and involve lots of communication over the wire. Problems arise when the service is down or not responding on time due to network failure, which eventually leads to a delay before the client operation is terminated. The purpose of resiliency is to make your application recover from a failure and make it responsive again.

Complexity increases when you call one service and that service calls another service, and so on. In a long chain of operations, considering resiliency is important. This is the reason it is one of the most widely adopted principles in microservice architecture.

Resilient policies

...

Storing sensitive information using Application Secrets

Every application has some configuration holding sensitive information, such as database connection strings, the secret keys of some third providers, and other sensitive information usually stored in the configuration files or the database. It is always a better option to secure all sensitive information to protect these resources from intruders. Web applications are usually hosted on servers, and this information can be read by just navigating to the server's path and accessing files, even though servers always have protected access and only authorized users are eligible to access the data. However, keeping information in plain text is not a good practice.

In .NET Core, we can use the Secret Manager tool to protect the sensitive information of an application. The Secret Manager tool allows you to store information in...

Protecting ASP.NET Core APIs

Securing web applications is an important milestone for any enterprise-grade application to protect not only the data, but also to protect it from different attacks from malicious sites.

There are various scenarios where security is an important factor for any web application:

• The information sent over the wire contains sensitive information.
• APIs are exposed publicly and are used by users to perform bulk operations.
• APIs are hosted on a server where the user can use some tools to do packet sniffing and read sensitive data.

To address the preceding challenges and to secure our application, we should consider the following options:

SSL (Secure Socket Layer)

Add security at the transport or network...

Summary

In this chapter, we have learned about resiliency, which is a very important factor when developing highly performant applications in .NET Core. We learned about different policies and used the Polly framework to use those policies in .NET Core. We also learned about safe storage mechanisms and how to use them in a development environment in order to keep sensitive information separate from the project repository. At the end of this chapter, we learned about some core fundamentals, which included SSL, CSRF, CORS, enabling security headers, and the ASP.NET Core Identity framework to protect ASP.NET Core applications.

In the next chapter, we will learn about some key metrics and necessary tools to monitor the performance of .NET Core applications.