Fix missing authentication for a critical function in C# and ASP.NET Core
=========================================================================

Verify a credential on the server in your authentication handler, then require
it on every protected endpoint. Here the handler looks the bearer token up in
the sessions table and builds the principal from the stored row, or produces
no identity so RequireAuthorization answers 401. It never trusts a userId
query parameter or an X-Authenticated-User header.

Page: https://softwaresecurity.com/fix/missing-authentication/csharp-aspnetcore/

What is in this archive
-----------------------
missing-authentication/csharp-aspnetcore/   the project: three implementations of the same code and one test suite
  src/Accounts/impl/VulnerableAuthenticationHandler.cs   (vulnerable)
  src/Accounts/impl/FixedAuthenticationHandler.cs   (fixed)
  src/Accounts/impl/WrongAuthenticationHandler.cs   (a plausible fix that still fails)
run-all.mjs   runs the tests in all three modes and checks the results (Node.js only)
LICENSE-CODE.txt

Run it
------
  Tested with .NET 10 (SDK 10.0.112, runtime 10.0.12). run-all.mjs needs Node.js
  22 or later. Supported versions: https://softwaresecurity.com/fix/versions/

  From the missing-authentication/csharp-aspnetcore folder, install the
  dependencies once (this needs network access):

    dotnet restore tests/Accounts.Tests --locked-mode

  Then run the tests. IMPL chooses the implementation the tests load:

    # every test passes
    IMPL=fixed dotnet test --project tests/Accounts.Tests --no-restore --results-directory reports --report-xunit-junit --report-xunit-junit-filename junit.xml
    # an exploit test fails
    IMPL=vulnerable dotnet test --project tests/Accounts.Tests --no-restore --results-directory reports --report-xunit-junit --report-xunit-junit-filename junit.xml
    # a test fails
    IMPL=wrong dotnet test --project tests/Accounts.Tests --no-restore --results-directory reports --report-xunit-junit --report-xunit-junit-filename junit.xml

  The JUnit report is written to reports/junit.xml. To run all three modes and
  check the results in one step, run the harness from this top folder (it needs
  only Node.js; --install runs the install step first):

    node run-all.mjs --install missing-authentication/csharp-aspnetcore
    node run-all.mjs missing-authentication/csharp-aspnetcore

Verified
--------
  11 October 2026 on macOS 27.0 (Darwin 27.0.0, arm64), with dotnetSdk 10.0.112,
  aspNetCoreRuntime 10.0.12, microsoftDataSqlite 10.0.12, aspnetMvcTesting
  10.0.12, xunitV3 4.0.2, microsoftTestingPlatform 2.5.1. Versions and results
  hold for that date: run the tests with your own versions before relying on the
  fix.

Licence
-------
  The code is MIT licensed (LICENSE-CODE.txt). The page text is CC BY 4.0.
