cybersecurity-implementation

Use the Microsoft.Identity.Web NuGet package and call AddMicrosoftIdentityWebApi with an AzureAd configuration section containing Instance, TenantId, ClientId, and Audience. Never place client secrets in appsettings.json; use Managed Identities or Key Vault instead.

Implement an IAuthorizationHandler that compares the authenticated user's identity against the resource's owner identifier, such as a DocumentAuthorizationHandler checking AuthorId. Only call context.Succeed when ownership matches; implicit failure is the correct default.

Use sessionStorage, never localStorage, because any XSS vulnerability enables trivial token theft from localStorage. MSAL.js keeps tokens in memory by default, and sessionStorage provides per-tab isolation that auto-clears when the tab closes.

Yes, enable RLS with FORCE ROW LEVEL SECURITY and create a policy comparing tenant_id to a session variable set per request from .NET middleware. RLS is deny-by-default, so enabling it without policies blocks all access; always index tenant_id columns.

The most common cause is reversed middleware ordering: UseAuthentication must precede UseAuthorization, otherwise authentication silently fails and authorization passes for all requests. Also check that CORS origins omit trailing slashes, which cause silent comparison failures.

Deploy an enterprise managed-settings.json with a permissions.deny list covering .env files, secrets directories, and cloud credential folders like ~/.aws and ~/.azure. Add a PostToolUse Semgrep hook in project settings to scan every edited file for secrets and OWASP issues.