This document outlines the security improvements made to the Change Management System.

• Password Requirements:

  • Minimum 8 characters
  • Requires uppercase letters
  • Requires lowercase letters
  • Requires digits
  • Requires non-alphanumeric characters
  • Minimum of 1 unique character

• Account Lockout:

  • Lockout duration: 15 minutes
  • Max failed attempts: 5
  • Enabled for all users including new registrations

• Cookie Security:

  • HttpOnly: true (prevents JavaScript access)
  • SecurePolicy: Always (requires HTTPS)
  • SameSite: Strict (CSRF protection)
  • Sliding expiration: 24 hours

Policy-based authorization instead of role strings:

• AdminOnly: Admin role required
• EmployeeOnly: Employee role required
• AdminOrEmployee: Either role accepted

• Anti-forgery tokens on all POST, PUT, DELETE actions
• [ValidateAntiForgeryToken] attribute on all state-changing operations
• Custom header name: X-CSRF-TOKEN
• Secure cookie policy enforced

The following security headers are automatically added to all responses:

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' cdn.jsdelivr.net ajax.aspnetcdn.com; style-src 'self' 'unsafe-inline' cdn.jsdelivr.net; font-src 'self' cdn.jsdelivr.net; img-src 'self' data:;

1. X-Content-Type-Options: nosniff

   • Prevents MIME type sniffing
   • Forces browsers to respect declared content types

2. X-Frame-Options: DENY

   • Prevents clickjacking attacks
   • Disallows embedding in iframes

3. X-XSS-Protection: 1; mode=block

   • Enables XSS filter in older browsers
   • Blocks pages when XSS detected

4. Content-Security-Policy

   • Restricts resource loading
   • Mitigates XSS and injection attacks
   • Allows CDN resources for Bootstrap/jQuery

5. Referrer-Policy

   • Controls referrer information leakage
   • Sends origin only on cross-origin requests

All models include comprehensive data annotations:

[Required(ErrorMessage = "Title is required.")]
[StringLength(200, MinimumLength = 5)]
public string Title { get; set; }

[Required(ErrorMessage = "Description is required.")]
[StringLength(2000, MinimumLength = 10)]
public string Description { get; set; }

[RegularExpression("^(Low|Medium|High|Critical)$")]
public string Priority { get; set; }

• Client-side validation with jQuery Validation
• maxlength attributes on inputs
• required attributes on mandatory fields
• Type-specific inputs (email, datetime-local)

• Entity Framework Core: All database queries use parameterized commands
• Repository Pattern: No raw SQL queries
• LINQ expressions: Type-safe query construction

Example:

// Safe - parameterized automatically
var request = _unitOfWork.Request.Get(u => u.Id == id);

Never store sensitive data in source control:

Development: Use User Secrets

dotnet user-secrets set "AdminUser:Email" "admin@example.com"
dotnet user-secrets set "AdminUser:Password" "SecurePassword123!"
dotnet user-secrets set "ConnectionStrings:DefaultConnection" "Server=...;"

Production: Use environment-specific configurations

• Azure Key Vault
• AWS Secrets Manager
• Environment variables
• Managed identities

• appsettings.Production.json with real credentials
• User Secrets storage
• Connection strings with real servers
• Email credentials

• Information: Successful operations, user actions
• Warning: Non-critical issues, missing configurations
• Error: Exceptions with full stack traces
• Critical: Application startup failures

✅ User authentication events ✅ Request creation/updates ✅ Admin approval actions ✅ Database operations ✅ Email sending attempts ✅ Configuration issues

❌ Passwords ❌ Session tokens ❌ Personal identifiable information (PII) ❌ Credit card numbers ❌ API keys

• Location: logs/changemanagement-YYYYMMDD.txt
• Rotation: Daily
• Retention: Manual cleanup required
• Format: JSON-structured for easy parsing

• Custom error pages (no stack traces)
• Generic error messages to users
• Detailed errors logged server-side

• Developer exception page enabled
• Detailed stack traces
• Database error page

app.UseHttpsRedirection();  // Redirects HTTP to HTTPS
app.UseHsts();              // HTTP Strict Transport Security

• Default: 30 days
• Includes subdomains
• Preload eligible

• Use integrated security or managed identities
• Never commit connection strings to source control
• Use encrypted connections: TrustServerCertificate=True (development only)

• Applied automatically on startup
• Logged with errors
• Transactional execution

• No SQL injection vulnerabilities
• Parameterized queries only
• Tracked entities for updates
• Soft delete possible (not implemented)

• TLS/SSL encryption enforced
• Credentials stored in secrets
• Timeouts configured
• Error handling without exposing credentials

• HTML sanitization (if accepting user content)
• No inline credentials
• Proper error logging

• Authorization required on all endpoints
• Input validation on all parameters
• Proper HTTP status codes
• Error messages don't expose internal details

Currently not implemented. Consider adding:

• AspNetCoreRateLimit package
• Per-user or per-IP limits
• Configurable thresholds

options.Cookie.HttpOnly = true;          // JavaScript can't access
options.Cookie.SecurePolicy = CookieSecurePolicy.Always;  // HTTPS only
options.Cookie.SameSite = SameSiteMode.Strict;           // CSRF protection
options.ExpireTimeSpan = TimeSpan.FromHours(24);         // 24-hour sessions
options.SlidingExpiration = true;                        // Extends on activity

• No hardcoded credentials
• Configuration-based user creation
• Validated password requirements
• Email confirmation optional
• Logged creation attempts

1. Enable Email Confirmation

   options.SignIn.RequireConfirmedEmail = true;

2. Add Rate Limiting

   • Install: AspNetCoreRateLimit
   • Configure per-endpoint limits

3. Implement CAPTCHA

   • Add reCAPTCHA on login/registration
   • Prevents brute force attacks

4. Add 2FA Support

   • Already supported by Identity
   • Configure authenticator app support

5. Database Encryption

   • Enable Transparent Data Encryption (TDE)
   • Encrypt backups

6. Regular Security Updates

   • Keep NuGet packages updated
   • Monitor CVE databases
   • Subscribe to security bulletins

7. Penetration Testing

   • Regular security audits
   • Automated scanning (OWASP ZAP, etc.)
   • Manual testing of critical paths

8. Content Security Policy Tuning

   • Remove unsafe-inline and unsafe-eval if possible
   • Implement nonce-based CSP
   • Report violations to monitoring service

• Password policies enforced
• Account lockout configured
• CSRF protection on all forms
• Security headers implemented
• Input validation on all fields
• SQL injection protection (EF Core)
• XSS protection (encoded output)
• HTTPS enforcement
• Secure cookie settings
• Structured logging
• Error handling without info leakage
• Authorization policies
• No hardcoded secrets
• Rate limiting (recommended)
• CAPTCHA on login (recommended)
• 2FA support (recommended)
• Email confirmation (optional)

If you discover a security vulnerability:

1. DO NOT open a public issue
2. Email: security@yourdomain.com
3. Include detailed reproduction steps
4. Allow time for patching before disclosure

• OWASP Top 10
• ASP.NET Core Security Best Practices
• NIST Security Guidelines