API Security

public static IServiceCollection AddRateLimitingConfiguration(
    this IServiceCollection services, IConfiguration configuration)
{
    var settings = configuration.GetSection("RateLimiting").Get<RateLimitingSettings>();
    if (!settings.Enabled) return services;

    services.AddRateLimiter(options =>
    {
        // 1. Global DDoS ceiling - 1000 requests per minute
        options.AddFixedWindowLimiter("Global", opt =>
        {
            opt.PermitLimit = settings.GlobalLimit; // 1000
            opt.Window = TimeSpan.FromMinutes(1);
            opt.QueueLimit = 0;
        });

        // 2. Per-IP general ceiling - 200 requests per minute
        options.AddPolicy("PerIp", context => {
            var ip = context.Connection.RemoteIpAddress?.ToString() ?? "unknown";
            return RateLimitPartition.GetFixedWindowLimiter(ip, _ => new FixedWindowRateLimiterOptions {
                PermitLimit = settings.PerIpLimit, // 200
                Window = TimeSpan.FromMinutes(1),
                QueueLimit = 0
            });
        });

        // 3. Login / Auth endpoints brute-force shield - 10 attempts per 5 minutes per IP
        options.AddPolicy("Login", context => {
            var ip = context.Connection.RemoteIpAddress?.ToString() ?? "unknown";
            return RateLimitPartition.GetFixedWindowLimiter($"login:{ip}", _ => new FixedWindowRateLimiterOptions {
                PermitLimit = settings.LoginLimit, // 10
                Window = TimeSpan.FromMinutes(5),
                QueueLimit = 0
            });
        });

        // 4. Token refresh rate limiting (prevent refresh farming) - 20 per minute sliding
        options.AddPolicy("token-refresh", context => {
            var ip = context.Connection.RemoteIpAddress?.ToString() ?? "unknown";
            return RateLimitPartition.GetSlidingWindowLimiter($"refresh:{ip}", _ => new SlidingWindowRateLimiterOptions {
                PermitLimit = 20,
                Window = TimeSpan.FromMinutes(1),
                SegmentsPerWindow = 4,
                QueueLimit = 0
            });
        });
    });
    return services;
}

/// <summary>
/// S0.15: Signed Double-Submit Cookie Pattern for CSRF protection.
/// 
/// Defense Layers:
/// 1. Sec-Fetch-Metadata + Origin Validation (blocks form-based navigate actions cross-site).
/// 2. Bearer token bypass: requests using custom Authorization headers bypass double-submit checks
///    because Bearer tokens are stored in JS memory and cannot be attached by browser cross-origin.
/// 3. HMAC-SHA256 Signed token: Bound to the JWT session's 'jti' claim to prevent token forgery.
/// 4. __Host- cookie prefix enforces Secure, Path=/, and blocks subdomain injection.
/// </summary>
public class CsrfMiddleware
{
    public async Task InvokeAsync(HttpContext context)
    {
        // Issue fresh token on every response (Response header + Cookie)
        IssueSignedCsrfToken(context);

        // Safe methods (GET, HEAD, OPTIONS) are exempt
        if (SafeMethod(context.Request.Method) || PathExcluded(context.Request.Path))
        {
            await _next(context);
            return;
        }

        // Layer 1: Fetch Metadata Validation
        var fetchSite = context.Request.Headers["Sec-Fetch-Site"].FirstOrDefault();
        var fetchMode = context.Request.Headers["Sec-Fetch-Mode"].FirstOrDefault();
        if (fetchSite == "cross-site" && fetchMode == "navigate")
        {
            context.Response.StatusCode = 403; // Reject form post CSRF
            return;
        }

        // Layer 2: Bearer Token bypass
        if (context.Request.Headers.ContainsKey("Authorization"))
        {
            await _next(context);
            return;
        }

        // Layer 3: Double-Submit Token verification
        var cookieToken = context.Request.Cookies["__Host-XSRF-TOKEN"];
        var headerToken = context.Request.Headers["X-CSRF-Token"].FirstOrDefault();

        if (string.IsNullOrEmpty(cookieToken) || string.IsNullOrEmpty(headerToken))
        {
            context.Response.StatusCode = 403;
            return;
        }

        // Constant-time check prevents timing side-channels
        if (!CryptographicOperations.FixedTimeEquals(
            Encoding.UTF8.GetBytes(cookieToken),
            Encoding.UTF8.GetBytes(headerToken)))
        {
            context.Response.StatusCode = 403;
            return;
        }

        await _next(context);
    }
}

/// <summary>
/// P6.3: Request replay protection — MANDATORY on all authenticated mutations.
/// Requires X-Request-Timestamp (Unix epoch ms) and X-Request-Nonce (UUID format).
/// </summary>
public class ReplayProtectionMiddleware
{
    public async Task InvokeAsync(HttpContext context, ICacheService cache)
    {
        // Skip safe methods (GET, HEAD, OPTIONS)
        if (HttpMethods.IsGet(context.Request.Method))
        {
            await _next(context);
            return;
        }

        // Skip SignalR hubs & OpenIddict auth endpoints
        if (IsExcludedPath(context.Request.Path))
        {
            await _next(context);
            return;
        }

        // Skip unauthenticated requests
        if (context.User.Identity?.IsAuthenticated != true)
        {
            await _next(context);
            return;
        }

        var timestampHeader = context.Request.Headers["X-Request-Timestamp"].FirstOrDefault();
        var nonceHeader = context.Request.Headers["X-Request-Nonce"].FirstOrDefault();

        // Reject missing headers immediately
        if (string.IsNullOrEmpty(timestampHeader) || string.IsNullOrEmpty(nonceHeader))
        {
            context.Response.StatusCode = 400; // BAD_REQUEST
            return;
        }

        // Nonce validation - max 36 chars, valid UUID
        if (nonceHeader.Length > 36 || !Guid.TryParse(nonceHeader, out _))
        {
            context.Response.StatusCode = 400; // INVALID_NONCE
            return;
        }

        // Timestamp validation - max 5 minutes drift (clock skew mitigation)
        var requestTime = DateTimeOffset.FromUnixTimeMilliseconds(long.Parse(timestampHeader));
        var drift = (DateTimeOffset.UtcNow - requestTime).Duration();
        if (drift > TimeSpan.FromMinutes(5))
        {
            context.Response.StatusCode = 400; // STALE_REQUEST
            return;
        }

        // Nonce uniqueness check (cache TTL = 10 minutes)
        var cacheKey = $"replay-nonce:{nonceHeader}";
        var exists = await cache.GetAsync<string>(cacheKey);
        if (exists is not null)
        {
            context.Response.StatusCode = 409; // REQUEST_REPLAY_DETECTED (Conflict)
            return;
        }

        await cache.SetAsync(cacheKey, "1", TimeSpan.FromMinutes(10));
        await _next(context);
    }
}