Security API Security Hardener

Durcissement de la Sécurité des APIs

Workflow

1. Auditer : identifier les failles potentielles (OWASP API Top 10).
2. Configurer : headers, CORS, rate limiting.
3. Valider : entrées, sorties, authentification.
4. Monitorer : logs de sécurité, détection d'anomalies.

OWASP API Top 10 — Checklist

Implémentation ASP.NET Core

Headers de sécurité

app.Use(async (context, next) =>
{
    context.Response.Headers.Append("X-Content-Type-Options", "nosniff");
    context.Response.Headers.Append("X-Frame-Options", "DENY");
    context.Response.Headers.Append("X-XSS-Protection", "0");
    context.Response.Headers.Append("Referrer-Policy", "strict-origin-when-cross-origin");
    context.Response.Headers.Append("Content-Security-Policy", "default-src 'self'");
    context.Response.Headers.Append("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
    context.Response.Headers.Remove("Server");
    context.Response.Headers.Remove("X-Powered-By");

    await next();
});

Rate Limiting

builder.Services.AddRateLimiter(options =>
{
    // Rate limit global
    options.GlobalLimiter = PartitionedRateLimiter.Create<HttpContext, string>(context =>
        RateLimitPartition.GetFixedWindowLimiter(
            partitionKey: context.Connection.RemoteIpAddress?.ToString() ?? "unknown",
            factory: _ => new FixedWindowRateLimiterOptions
            {
                PermitLimit = 100,
                Window = TimeSpan.FromMinutes(1)
            }));

    // Rate limit par endpoint
    options.AddPolicy("strict", context =>
        RateLimitPartition.GetSlidingWindowLimiter(
            partitionKey: context.Connection.RemoteIpAddress?.ToString() ?? "unknown",
            factory: _ => new SlidingWindowRateLimiterOptions
            {
                PermitLimit = 10,
                Window = TimeSpan.FromMinutes(1),
                SegmentsPerWindow = 4
            }));

    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
});

// Usage
app.MapPost("/api/payments", handler).RequireRateLimiting("strict");

Validation d'entrée

public class CreatePaymentRequest
{
    [Required]
    [Range(1, 99999999, ErrorMessage = "Le montant doit être entre 1 et 99999999 centimes")]
    public int Amount { get; set; }

    [Required]
    [RegularExpression("^(EUR|USD|GBP)$")]
    public string Currency { get; set; }

    [Required]
    [StringLength(100, MinimumLength = 1)]
    public string RecipientId { get; set; }

    [MaxLength(10)]
    public Dictionary<string, string>? Metadata { get; set; }
}

CORS strict

builder.Services.AddCors(options =>
{
    options.AddPolicy("Production", policy =>
    {
        policy.WithOrigins("https://app.company.com", "https://admin.company.com")
              .WithMethods("GET", "POST", "PUT", "DELETE")
              .WithHeaders("Authorization", "Content-Type")
              .SetMaxAge(TimeSpan.FromHours(1));
    });
});

Règles

• Ne jamais exposer les entités de base de données directement — toujours des DTOs.
• Les messages d'erreur ne doivent jamais révéler des détails d'implémentation.
• Chaque endpoint doit vérifier l'autorisation (pas seulement l'authentification).
• Le rate limiting doit être appliqué avant la logique métier.
• Logger les tentatives d'accès non autorisées pour la détection d'intrusion.

Ce skill est un outil de sécurité défensif. Il aide à protéger les APIs contre les attaques courantes.

Communication Rules — MANDATORY

• Ultra-concise. No filler, no preamble, no pleasantries.
• Never say "happy to help", "sure!", "great question", "let me", or similar.
• Tool first, talk second. Act before explaining.
• Result first. Lead with outcome, not process.
• Stop when done. No summary, no recap, no trailing commentary.
• No politeness wrappers. Direct and blunt.
• Minimum words. If one word works, do not use ten.
• No unsolicited explanations.
• No emoji unless asked.