Security defaults that belong in every ASP.NET Core application from day one.
87
83%
Does it follow best practices?
Impact
94%
1.91xAverage score across 5 eval scenarios
Passed
No known issues
A SaaS startup needs a user management API built with ASP.NET Core and C#. A React single-page app hosted on https://app.example.com will consume this API. The API will run behind an AWS Application Load Balancer in production.
The API needs the following endpoints:
POST /api/users/register -- create a new user account (accepts email, username, password, displayName)POST /api/users/login -- authenticate and return a JWT tokenGET /api/users/me -- return the current user's profile (requires valid JWT in Authorization header)PUT /api/users/me -- update the current user's profile (accepts displayName, bio)GET /api/users -- list all users (admin only, supports ?page=1&pageSize=20)DELETE /api/users/{id} -- deactivate a user account (admin only)Use an in-memory list as the data store. Hash passwords before storing. The JWT secret and allowed origins should come from configuration. Users have Id, Email, Username, PasswordHash, DisplayName, Bio, Role (User or Admin), IsActive, and CreatedAt fields.
Produce:
Program.cs -- Application entry point with all service registration and middleware pipelineControllers/UsersController.cs -- Controller with user management endpointsModels/ -- Request DTOs and User entityServices/AuthService.cs -- JWT token generation and password hashingappsettings.json -- Configuration file (no real secrets)MyApp.csproj -- Project file with required NuGet packagesevals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
aspnet-security-basics
verifiers