Coretexia.SecureShield 2.0.0

🛡️ SecureShield

Enterprise-Grade Security Framework for .NET Applications

SecureShield is a comprehensive security hardening framework for .NET applications that provides 13 essential security modules to protect against modern cyber threats including SQL injection, XSS, CSRF, DoS attacks, malicious file uploads, and more.

✨ Features

🔒 Core Security Modules

• SQL Injection Protection - Advanced pattern detection and parameterized query validation
• XSS Protection - Input validation and output sanitization with HTML encoding
• CSRF Protection - Token-based validation with SameSite cookies
• JWT Security - Token validation with replay attack detection
• Rate Limiting - TokenBucket algorithm with endpoint-specific rules
• CORS Protection - Secure cross-origin resource sharing configuration
• Security Headers - HSTS, CSP, X-Frame-Options, and more

🆕 Advanced Security Features

• OTP DoS Protection - Prevent SMS/Email flooding attacks on OTP endpoints
• Form Validation Security - Prevent form bypass and mass assignment attacks
• File Upload Security - Comprehensive malware scanning and file validation
• Packet Encryption - AES-256-GCM with compression and key rotation
• Network Security - Packet validation, anomaly detection, connection throttling
• Threat Intelligence - IP reputation, behavioral analysis, malware scanning

📦 Installation

NuGet Package Manager

Install-Package Coretexia.SecureShield

.NET CLI

dotnet add package Coretexia.SecureShield

Package Reference

<PackageReference Include="Coretexia.SecureShield" Version="2.0.0" />

🚀 Quick Start

1. Basic Setup

using Coretexia.SecureShield.Extensions;

var builder = WebApplication.CreateBuilder(args);

// Add SecureShield with default configuration
builder.Services.AddSecureShield(builder.Configuration)
    .EnableSqlInjectionProtection()
    .EnableXssProtection()
    .EnableCsrfProtection()
    .EnableRateLimiting()
    .EnableSecurityHeaders();

var app = builder.Build();

// Apply SecureShield middleware
app.UseSecureShield();

app.Run();

2. Advanced Configuration

builder.Services.AddSecureShield(builder.Configuration)
    .EnableSqlInjectionProtection(opts =>
    {
        opts.ValidateParameterizedQueries = true;
        opts.MaxParameterLength = 2000;
    })
    .EnableOtpDoSProtection(opts =>
    {
        opts.MaxOtpRequestsPerIpPerHour = 5;
        opts.CooldownPeriodSeconds = 60;
        opts.EnableProgressivePenalties = true;
    })
    .EnableFormValidation(opts =>
    {
        opts.PreventMassAssignment = true;
        opts.SanitizeInputValues = true;
        opts.MaxFieldLength = 1000;
    })
    .EnableFileUploadSecurity(opts =>
    {
        opts.MaxFileSizeBytes = 10 * 1024 * 1024; // 10MB
        opts.EnableMalwareScanning = true;
        opts.QuarantineSuspiciousFiles = true;
    })
    .EnablePacketEncryption(opts =>
    {
        opts.Algorithm = "AES-256-GCM";
        opts.EnableCompression = true;
    })
    .EnableThreatIntelligence(opts =>
    {
        opts.EnableIpReputation = true;
        opts.ThreatScoreThreshold = 7;
    });

⚙️ Configuration

appsettings.json

{
  "SecureShield": {
    "Enable": true,
    "SqlInjection": {
      "Enable": true,
      "ValidateParameterizedQueries": true,
      "MaxParameterLength": 2000
    },
    "OtpDoSProtection": {
      "Enable": true,
      "MaxOtpRequestsPerIpPerHour": 5,
      "MaxOtpRequestsPerPhonePerHour": 3,
      "CooldownPeriodSeconds": 60,
      "EnableProgressivePenalties": true
    },
    "FormValidation": {
      "Enable": true,
      "PreventMassAssignment": true,
      "SanitizeInputValues": true,
      "MaxFieldLength": 1000,
      "BlockedFieldNames": ["id", "userId", "roleId", "isAdmin"]
    },
    "FileUploadSecurity": {
      "Enable": true,
      "MaxFileSizeBytes": 10485760,
      "EnableMalwareScanning": true,
      "AllowedExtensions": [".jpg", ".png", ".pdf", ".docx"],
      "QuarantineSuspiciousFiles": true
    },
    "RateLimiting": {
      "Enable": true,
      "MaxRequests": 100,
      "Period": "00:01:00",
      "Algorithm": "TokenBucket"
    },
    "SecurityHeaders": {
      "Enable": true,
      "EnableHsts": true,
      "ContentSecurityPolicy": "default-src 'self'"
    }
  }
}

🔍 Security Modules Overview

🆕 New Features in v2.0

OTP DoS Protection

Protects against SMS/Email flooding attacks on OTP endpoints:

• IP-based rate limiting (5 requests/hour)
• Phone/Email-based limiting (3 requests/hour)
• Progressive penalties for repeat offenders
• Cooldown periods between requests
• Failed verification attempt monitoring

Form Validation Security

Prevents form bypass and manipulation attacks:

• Mass assignment protection
• Hidden field manipulation prevention
• Input sanitization and validation
• Field length enforcement
• Required field validation
• Pattern-based validation (email, phone, URL)

File Upload Security

Comprehensive file upload protection:

• File size validation (max 10MB)
• Extension and MIME type validation
• File header verification
• Malware pattern scanning
• Suspicious file quarantine
• Secure filename generation
• Double extension detection

📚 Usage Examples

OTP DoS Protection

// Configure OTP endpoints protection
.EnableOtpDoSProtection(opts =>
{
    opts.OtpEndpointPatterns = new[] { "/api/auth/send-otp", "/otp/*" };
    opts.MaxOtpRequestsPerIpPerHour = 5;
    opts.WhitelistedIps = new[] { "127.0.0.1" };
});

// Example OTP endpoint
app.MapPost("/api/auth/send-otp", ([FromBody] OtpRequest request) =>
{
    // This endpoint is automatically protected
    return Results.Ok(new { Status = "OTP sent" });
});

Form Validation

// Configure form validation
.EnableFormValidation(opts =>
{
    opts.BlockedFieldNames = new[] { "id", "userId", "isAdmin" };
    opts.FieldValidationPatterns = new Dictionary<string, string>
    {
        { "email", @"^[^@]+@[^@]+\.[^@]+$" },
        { "phone", @"^\+?[\d\s-()]+$" }
    };
});

// Example protected form endpoint
app.MapPost("/api/user/profile", ([FromBody] UserProfile profile) =>
{
    // Automatic validation against blocked fields and patterns
    return Results.Ok(new { Status = "Profile updated" });
});

File Upload Security

// Configure file upload security
.EnableFileUploadSecurity(opts =>
{
    opts.AllowedExtensions = new[] { ".jpg", ".png", ".pdf" };
    opts.MaxFileSizeBytes = 5 * 1024 * 1024; // 5MB
    opts.EnableMalwareScanning = true;
});

// Example protected upload endpoint
app.MapPost("/api/upload", async (IFormFileCollection files) =>
{
    // Files are automatically scanned and validated
    return Results.Ok(new { UploadedFiles = files.Count });
});

🎯 Security Testing

Test Endpoints

SecureShield includes built-in test endpoints for validation:

// Security status endpoint
GET /security/detailed-status

// Security metrics endpoint  
GET /security/metrics

// Test OTP protection
POST /api/auth/send-otp
POST /api/auth/verify-otp

// Test form validation
POST /api/user/profile

// Test file upload security
POST /api/file/upload

🔧 Advanced Features

Packet Encryption

.EnablePacketEncryption(opts =>
{
    opts.Algorithm = "AES-256-GCM";
    opts.EnableCompression = true;
    opts.KeyRotationInterval = TimeSpan.FromHours(24);
    opts.ExcludedPaths = new[] { "/health", "/metrics" };
});

Network Security

.EnableNetworkSecurity(opts =>
{
    opts.EnableAnomalyDetection = true;
    opts.MaxConnectionsPerIp = 50;
    opts.BlockedUserAgents = new[] { "bot", "crawler" };
});

Threat Intelligence

.EnableThreatIntelligence(opts =>
{
    opts.EnableIpReputation = true;
    opts.ThreatScoreThreshold = 7;
    opts.DefaultAction = ThreatAction.Block;
});

📊 Performance & Monitoring

Built-in Metrics

• Request processing times
• Threat detection counts
• Rate limiting statistics
• Encryption performance metrics
• File upload scan results

Logging Integration

SecureShield integrates with Microsoft.Extensions.Logging:

// Enable detailed security logging
"Logging": {
  "LogLevel": {
    "Coretexia.SecureShield": "Information"
  }
}

🔒 Security Best Practices

1. Enable All Modules: Use all security modules for maximum protection
2. Regular Updates: Keep SecureShield updated to latest version
3. Configuration Review: Regularly review and update security configurations
4. Monitoring: Monitor security logs and metrics
5. Testing: Use provided test endpoints to validate security measures

🆘 Troubleshooting

Common Issues

Build Errors: Ensure .NET 8.0+ is installed

dotnet --version

Configuration Issues: Validate appsettings.json syntax

dotnet run --environment Development

Performance Issues: Adjust rate limiting and encryption settings

opts.MaxRequests = 200; // Increase if needed
opts.EnableCompression = false; // Disable for performance

🤝 Contributing

We welcome contributions! Please see our Contributing Guidelines for details.

Development Setup

git clone https://github.com/coretexia/secureshield.git
cd secureshield
dotnet build
dotnet test

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Acknowledgments

• Microsoft .NET Team for the excellent framework
• Security community for vulnerability research
• All contributors and users providing feedback

📞 Support

• 📧 Email: support@coretexia.com
• 🐛 Issues: GitHub Issues
• 📖 Documentation: Wiki

⚡ Secure your .NET applications with SecureShield - Enterprise-grade security made simple!