Security defaults that belong in every ASP.NET Core application from day one.
87
83%
Does it follow best practices?
Impact
94%
1.91xAverage score across 5 eval scenarios
Passed
No known issues
An e-commerce company needs an order management API built with ASP.NET Core and C#. A Vue.js storefront on https://store.example.com will consume this API. Customers browse products, add items to a cart, and place orders.
The API needs the following endpoints:
GET /api/products -- list available products (public, supports ?category=electronics&sort=price)GET /api/products/{id} -- get product details (public)POST /api/orders -- place a new order (authenticated, accepts items array with productId and quantity, plus shippingAddress)GET /api/orders -- list the current user's orders (authenticated)GET /api/orders/{id} -- get order details (authenticated, users can only see their own orders)PATCH /api/orders/{id}/cancel -- cancel an order (authenticated, only if status is "Pending")GET /api/admin/orders -- list all orders (admin only, supports ?status=pending&page=1)Use an in-memory data store. Products have Id, Name, Description, Price, Category, StockQuantity. Orders have Id, UserId, Items, ShippingAddress, Status (Pending, Confirmed, Shipped, Cancelled), Total, CreatedAt.
Produce:
Program.cs -- Application setup with services and middlewareControllers/ProductsController.cs -- Product browsing endpointsControllers/OrdersController.cs -- Order management endpointsModels/ -- Request/response DTOs and entity classesServices/OrderService.cs -- Order processing business logicappsettings.json -- ConfigurationECommerceApi.csproj -- Project file with NuGet packagesevals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
aspnet-security-basics
verifiers