Hrithik.Security.Pro 1.1.0

Hrithik.Security.Pro

Enterprise-ready request signing and distributed replay protection middleware for ASP.NET Core.

Prevent replay attacks and forged API requests before they reach your business logic.

Hrithik.Security.Pro provides cryptographic request integrity, replay attack prevention, and tamper-resistant commercial licensing for high-trust API environments.

Designed to integrate seamlessly into the ASP.NET Core middleware pipeline without requiring an external API gateway.

Executive Summary

Modern distributed APIs require stronger guarantees than authentication alone.

Hrithik.Security.Pro enables:

• Deterministic HMAC request validation\
• Distributed replay attack prevention\
• Secret rotation without downtime\
• Constant-time signature comparison\
• RSA-signed commercial license enforcement

Built for internal APIs, B2B integrations, financial systems, and service-to-service architectures.

Security Capabilities

Request Integrity

• HMAC-SHA256 request signing
• Full body hash validation
• HTTP method + path binding
• Constant-time signature comparison (timing-attack safe)

Replay Protection

• Unique request ID enforcement
• Configurable timestamp skew validation
• In-memory or Redis-backed replay store
• TTL-based replay window control

Secret Management

• Multiple active secrets
• Versioned secret header (X-Secret-Version)
• Zero-downtime key rotation

Licensing Security

• RSA-signed license payload
• Application-bound enforcement
• Time-limited validation
• Tamper-resistant verification

🏗 Validation Pipeline

┌──────────────┐
│   Client     │
│ HMAC Sign    │
└──────┬───────┘
       │
       ▼
┌──────────────────────────────────┐
│ ReplayProtectionMiddleware       │
│                                  │
│ 1. License Validation            │
│ 2. Timestamp Validation          │
│ 3. Signature Verification        │
│ 4. Replay Store Check            │
└──────────────┬───────────────────┘
               │
               ▼
        ┌──────────────┐
        │  Controller  │
        └──────────────┘

Replay validation occurs before business logic, preventing tampered or replayed requests from reaching application code.

⚡ Performance Characteristics

Benchmarked on:

• .NET 8
• 4-core development machine
• 1KB JSON payload
• In-memory replay store

Observed:

• ~0.4--0.8ms average overhead per request\
• ~15,000--20,000 requests/sec (in-memory mode)\
• Redis-backed mode adds only network latency

Replay lookup is O(1).
Signature comparison uses fixed-time equality to prevent timing attacks.

Benchmarks are illustrative and may vary by environment.

Installation

dotnet add package Hrithik.Security.Pro

Minimal Configuration

builder.Services.AddHrithikSecurityPro(
    license =>
    {
        license.LicenseKey = "YOUR_LICENSE_KEY";
        license.AppName = "MyApi";
    },
    replay =>
    {
        replay.ValidSecrets.Add("PRIMARY_SECRET");
        replay.AllowedClockSkew = TimeSpan.FromMinutes(2);
        replay.ReplayEntryTtl = TimeSpan.FromMinutes(5);
        replay.MaxBodySizeBytes = 1_000_000;
    });

app.UseMiddleware<ReplayProtectionMiddleware>();

Distributed Deployment

builder.Services.AddRedisReplayStore("localhost:6379");

Recommended for multi-instance production deployments.

Observability & Operations

Health Checks

builder.Services.AddReplayStoreHealthCheck();
app.MapHealthChecks("/health");

Metrics

OpenTelemetry-compatible counters:

• replay_rejected_total
• invalid_signature_total
• expired_timestamp_total

When To Use This

Ideal for:

• Service-to-service authentication
• Fintech and payment APIs
• B2B integrations
• Webhook verification
• Internal distributed systems

When Not To Use This

Not recommended if:

• You rely exclusively on OAuth2/JWT and do not control the client
• HMAC validation is already enforced at an API Gateway
• Client-side signing cannot be implemented

Commercial Licensing

Hrithik.Security.Pro is distributed under a commercial license.

Pro Plan --- $99/year (per application)

Includes:

• Full middleware functionality
• Distributed Redis replay support
• Secret rotation features
• RSA-signed license enforcement
• Ongoing updates

Licenses are application-bound, non-transferable, and valid for 12 months.

Security Model

Refer to SECURITY_MODEL.md for:

• Threat model
• Attack vectors mitigated
• Replay window design
• License validation strategy

👤 Maintained By

Built and maintained by Hrithik Kalra
Senior Backend & Azure Engineer
Focused on distributed API security and production-grade .NET systems.

• LinkedIn: https://www.linkedin.com/in/hrithik-kalra-b6836a246/
• GitHub: https://github.com/hrithikalra/
• NuGet: https://www.nuget.org/profiles/hrithikkalra

Support

For licensing, configuration, or security inquiries:

📧 hrithikkalra11@gmail.com