[ { "id": "dotnet-identity-icu-alpine", "category": "dockerfile", "pattern": "Identity|IdentityUser|UserManager", "recommendation": "Install ICU libraries on Alpine images for ASP.NET Core Identity - required for globalization and string comparisons", "example": "FROM mcr.microsoft.com/dotnet/aspnet:8.0-alpine\nWORKDIR /app\n\n# Install ICU libraries for Identity\nRUN apk add --no-cache icu-libs\nENV DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=false\n\nCOPY --from=build /app/publish .", "severity": "required", "tags": [ "alpine", "dotnet", "fix-dockerfile", "generate-dockerfile", "globalization", "icu", "identity", "microsoft" ] }, { "id": "dotnet-identity-password-policy", "category": "security", "pattern": "Identity|password|PasswordValidator", "recommendation": "Configure strong password policies with minimum length 12+, complexity requirements, and common password prevention", "example": "ENV PasswordPolicy__MinLength=\"12\"\nENV PasswordPolicy__RequireDigit=\"true\"\nENV PasswordPolicy__RequireUppercase=\"true\"\nENV PasswordPolicy__RequireLowercase=\"true\"\nENV PasswordPolicy__RequireSpecialCharacter=\"true\"\nENV PasswordPolicy__DisallowCommonPasswords=\"true\"\nENV PasswordPolicy__PreventPasswordReuse=\"5\"", "severity": "high", "tags": [ "dotnet", "fix-dockerfile", "identity", "password", "policy", "scan-image", "security" ] }, { "id": "dotnet-identity-lockout-protection", "category": "security", "pattern": "Identity|lockout|brute.*force", "recommendation": "Enable account lockout protection against brute force attacks with progressive lockout duration", "example": "ENV Lockout__EnabledByDefault=\"true\"\nENV Lockout__DefaultLockoutTimeSpan=\"00:15:00\"\nENV Lockout__MaxFailedAccessAttempts=\"3\"\nENV SecurityMonitoring__BruteForceThreshold=\"10\"\nENV SecurityMonitoring__BruteForceWindow=\"00:05:00\"", "severity": "high", "tags": [ "brute-force", "dotnet", "fix-dockerfile", "identity", "lockout", "scan-image", "security" ] }, { "id": "dotnet-identity-jwt-secrets", "category": "security", "pattern": "JWT|JwtBearer", "recommendation": "Never hardcode JWT secrets in Dockerfile - use environment variables or secret management services", "example": "# BAD: ENV Jwt__SecretKey=\"hardcoded-secret\"\n\n# GOOD: Load from environment or secrets\nENV Jwt__SecretKey=\"${JWT_SECRET}\"\nENV Jwt__Issuer=\"https://yourdomain.com\"\nENV Jwt__Audience=\"https://yourdomain.com\"\nENV Jwt__ExpirationInMinutes=\"60\"", "severity": "required", "tags": [ "aws", "dotnet", "fix-dockerfile", "identity", "jwt", "scan-image", "secrets", "security" ] }, { "id": "dotnet-identityserver-https", "category": "security", "pattern": "IdentityServer|Duende", "recommendation": "Configure IdentityServer with dual HTTP/HTTPS ports and proper issuer URI for production security", "example": "# Install certificates\nRUN apt-get update && apt-get install -y ca-certificates openssl && rm -rf /var/lib/apt/lists/*\n\nENV IdentityServer__IssuerUri=\"https://identityserver.yourdomain.com\"\nENV IdentityServer__PublicOrigin=\"https://identityserver.yourdomain.com\"\nENV ASPNETCORE_URLS=\"https://+:8443;http://+:8080\"\nENV ASPNETCORE_HTTPS_PORT=\"8443\"\nEXPOSE 8080 8443", "severity": "high", "tags": [ "dotnet", "fix-dockerfile", "https", "identity", "identityserver", "scan-image", "security" ] }, { "id": "dotnet-identity-2fa-totp", "category": "security", "pattern": "two.*factor|2fa|totp|authenticator", "recommendation": "Enable two-factor authentication with TOTP for enhanced security on sensitive operations", "example": "ENV TwoFactor__Enabled=\"true\"\nENV TwoFactor__TOTPIssuer=\"YourCompany\"\nENV TwoFactor__TOTPDigits=\"6\"\nENV TwoFactor__TOTPPeriod=\"30\"\nENV TwoFactor__RequiredForSensitiveOperations=\"true\"\nENV TwoFactor__RememberBrowserDays=\"30\"", "severity": "medium", "tags": [ "2fa", "authentication", "dotnet", "fix-dockerfile", "identity", "scan-image", "security", "totp" ] }, { "id": "dotnet-identity-external-oauth", "category": "configuration", "pattern": "OAuth|Google.*auth|Facebook.*auth|Microsoft.*auth", "recommendation": "Configure external OAuth providers with proper callback URLs and secure cookie settings", "example": "ENV Authentication__Google__ClientId=\"${GOOGLE_CLIENT_ID}\"\nENV Authentication__Google__ClientSecret=\"${GOOGLE_CLIENT_SECRET}\"\nENV Authentication__CallbackPath=\"/signin-google\"\nENV Authentication__Cookies__SameSite=\"Lax\"\nENV Authentication__Cookies__SecurePolicy=\"Always\"\nENV Authentication__Cookies__HttpOnly=\"true\"", "severity": "medium", "tags": [ "authentication", "aws", "dotnet", "external-providers", "google", "identity", "oauth" ] }, { "id": "dotnet-identity-session-redis", "category": "configuration", "pattern": "session|distributed.*cache|redis", "recommendation": "Use Redis for distributed session management in multi-instance Identity deployments", "example": "ENV Session__Timeout=\"00:20:00\"\nENV Session__Store=\"Redis\"\nENV ConnectionStrings__Redis=\"redis:6379\"\nENV Session__Redis__KeyPrefix=\"session:\"\nENV Session__CookieSecure=\"true\"\nENV Session__CookieHttpOnly=\"true\"\nENV Session__CookieSameSite=\"Strict\"", "severity": "medium", "tags": [ "dotnet", "identity", "session", "redis", "distributed", "scalability" ] }, { "id": "dotnet-identity-security-headers", "category": "security", "pattern": "security.*header|hsts|csp", "recommendation": "Configure comprehensive security headers including HSTS, CSP, X-Frame-Options for Identity applications", "example": "ENV SecurityHeaders__HSTS=\"true\"\nENV SecurityHeaders__ContentSecurityPolicy=\"default-src 'self'\"\nENV SecurityHeaders__XFrameOptions=\"DENY\"\nENV SecurityHeaders__XContentTypeOptions=\"nosniff\"\nENV SecurityHeaders__ReferrerPolicy=\"no-referrer\"", "severity": "high", "tags": [ "csp", "dotnet", "fix-dockerfile", "hsts", "identity", "scan-image", "security", "security-headers" ] }, { "id": "dotnet-identity-cors-api", "category": "security", "pattern": "cors|api|cross.*origin", "recommendation": "Configure CORS with explicit allowed origins for Identity APIs - never use wildcard in production", "example": "ENV ApiSecurity__EnableCors=\"true\"\nENV Cors__AllowedOrigins=\"https://yourdomain.com,https://app.yourdomain.com\"\nENV Cors__AllowedMethods=\"GET,POST,PUT,DELETE\"\nENV Cors__AllowedHeaders=\"Authorization,Content-Type\"\nENV Cors__AllowCredentials=\"true\"", "severity": "high", "tags": [ "api", "cors", "dotnet", "fix-dockerfile", "identity", "scan-image", "security" ] }, { "id": "dotnet-identity-rate-limiting", "category": "security", "pattern": "rate.*limit|throttle|api", "recommendation": "Implement rate limiting for Identity endpoints to prevent abuse and DoS attacks", "example": "ENV RateLimit__Enabled=\"true\"\nENV RateLimit__PerUserLimit=\"100\"\nENV RateLimit__PerIpLimit=\"1000\"\nENV RateLimit__WindowInMinutes=\"15\"\nENV RateLimit__AuthorizationRequests=\"100\"\nENV RateLimit__TokenRequests=\"200\"", "severity": "medium", "tags": [ "api", "dotnet", "fix-dockerfile", "identity", "rate-limiting", "scan-image", "security" ] }, { "id": "dotnet-identity-audit-logging", "category": "security", "pattern": "audit|security.*event|compliance", "recommendation": "Enable comprehensive audit logging for all identity operations including logins, password changes, and role modifications", "example": "ENV AuditLog__Enabled=\"true\"\nENV AuditLog__LogSuccessfulLogins=\"true\"\nENV AuditLog__LogFailedLogins=\"true\"\nENV AuditLog__LogPasswordChanges=\"true\"\nENV AuditLog__LogRoleChanges=\"true\"\nENV AuditLog__LogPermissionChanges=\"true\"", "severity": "high", "tags": [ "audit", "compliance", "dotnet", "fix-dockerfile", "identity", "logging", "scan-image", "security" ] }, { "id": "dotnet-identity-multi-tenant", "category": "architecture", "pattern": "multi.*tenant|tenant|saas", "recommendation": "Implement tenant isolation for multi-tenant Identity with separate databases or schemas per tenant", "example": "ENV MultiTenancy__Strategy=\"Subdomain\"\nENV MultiTenancy__RequireTenant=\"true\"\nENV ConnectionStrings__Template=\"Server=db;Database=Identity_{tenant};User=sa;Password=${DB_PASSWORD};TrustServerCertificate=true\"\nENV TenantIsolation__Users=\"true\"\nENV TenantIsolation__Roles=\"true\"\nENV CrossTenant__AllowSharedUsers=\"false\"", "severity": "medium", "tags": [ "dotnet", "identity", "multi-tenant", "isolation", "saas", "architecture" ] }, { "id": "dotnet-identity-refresh-tokens", "category": "security", "pattern": "JWT|refresh.*token|token.*rotation", "recommendation": "Implement refresh token rotation and proper expiration for secure JWT authentication", "example": "ENV Jwt__AccessTokenExpiration=\"01:00:00\"\nENV Jwt__RefreshTokenExpiration=\"30.00:00:00\"\nENV Jwt__RefreshTokenRotation=\"true\"\nENV Jwt__RevokeRefreshTokenOnUse=\"true\"\nENV Jwt__MaxRefreshTokenLifetime=\"90.00:00:00\"", "severity": "high", "tags": [ "dotnet", "fix-dockerfile", "identity", "jwt", "refresh-token", "scan-image", "security" ] }, { "id": "dotnet-identity-claims-transformation", "category": "configuration", "pattern": "claims|authorization|rbac", "recommendation": "Configure claims-based authorization with proper issuer validation and claims transformation", "example": "ENV Authorization__DefaultPolicy=\"DefaultPolicy\"\nENV Authorization__RequireAuthenticatedUser=\"true\"\nENV Claims__EnableClaimsTransformation=\"true\"\nENV Claims__ClaimsIssuer=\"https://yourdomain.com\"\nENV Permissions__CacheTimeout=\"300\"\nENV Permissions__EnableHierarchy=\"true\"", "severity": "medium", "tags": [ "dotnet", "identity", "claims", "authorization", "rbac" ] }, { "id": "dotnet-identity-password-expiration", "category": "security", "pattern": "password.*expir|password.*policy", "recommendation": "Implement password expiration policies for compliance and security best practices", "example": "ENV PasswordExpiration__Enabled=\"true\"\nENV PasswordExpiration__ExpirationDays=\"90\"\nENV PasswordExpiration__WarningDays=\"14\"\nENV PasswordPolicy__PreventPasswordReuse=\"5\"\nENV PasswordPolicy__MaxAge=\"90\"", "severity": "medium", "tags": [ "compliance", "dotnet", "expiration", "fix-dockerfile", "identity", "password", "scan-image", "security" ] }, { "id": "dotnet-identity-session-fixation", "category": "security", "pattern": "session|cookie|authentication", "recommendation": "Prevent session fixation attacks by regenerating session IDs on login and limiting concurrent sessions", "example": "ENV Security__RegenerateSessionOnLogin=\"true\"\nENV Security__MaxConcurrentSessions=\"5\"\nENV Security__SessionFixationProtection=\"true\"\nENV Session__IdleTimeout=\"00:20:00\"\nENV Session__AbsoluteTimeout=\"08:00:00\"", "severity": "high", "tags": [ "dotnet", "fix-dockerfile", "identity", "scan-image", "security", "session", "session-fixation" ] }, { "id": "dotnet-identity-email-confirmation", "category": "configuration", "pattern": "email.*confirm|account.*verif|register", "recommendation": "Require email confirmation for new accounts and configure email provider settings securely", "example": "ENV Email__Provider=\"SendGrid\"\nENV Email__SendGrid__ApiKey=\"${SENDGRID_API_KEY}\"\nENV Email__SendGrid__FromEmail=\"noreply@yourdomain.com\"\nENV Identity__SignIn__RequireConfirmedEmail=\"true\"\nENV Email__ConfirmationTokenExpiration=\"24:00:00\"", "severity": "medium", "tags": [ "dotnet", "identity", "email", "confirmation", "registration" ] }, { "id": "dotnet-identityserver-key-management", "category": "security", "pattern": "IdentityServer|signing.*key|key.*rotation", "recommendation": "Enable automatic key management and rotation for IdentityServer signing keys", "example": "ENV IdentityServer__KeyManagement__Enabled=\"true\"\nENV IdentityServer__KeyManagement__RotationInterval=\"90.00:00:00\"\nENV IdentityServer__KeyManagement__PropagationTime=\"14.00:00:00\"\nENV IdentityServer__KeyManagement__RetentionDuration=\"180.00:00:00\"", "severity": "high", "tags": [ "dotnet", "fix-dockerfile", "identityserver", "key-management", "rotation", "scan-image", "security" ] }, { "id": "dotnet-identity-persistent-storage", "category": "configuration", "pattern": "IdentityServer|Configuration.*Store|Grant.*Store", "recommendation": "Use separate databases for IdentityServer configuration, operational, and grant stores for better performance", "example": "ENV ConnectionStrings__DefaultConnection=\"Server=db;Database=IdentityServer;User=sa;Password=${DB_PASSWORD}\"\nENV ConnectionStrings__ConfigurationDbConnection=\"Server=db;Database=IdentityServerConfiguration;User=sa;Password=${DB_PASSWORD}\"\nENV ConnectionStrings__PersistedGrantDbConnection=\"Server=db;Database=IdentityServerGrants;User=sa;Password=${DB_PASSWORD}\"", "severity": "medium", "tags": [ "dotnet", "identityserver", "database", "persistence", "configuration" ] }, { "id": "dotnet-identity-sms-2fa", "category": "configuration", "pattern": "sms|twilio|2fa|two.*factor", "recommendation": "Configure SMS provider for two-factor authentication with secure credential management", "example": "ENV SMS__Provider=\"Twilio\"\nENV SMS__Twilio__AccountSid=\"${TWILIO_ACCOUNT_SID}\"\nENV SMS__Twilio__AuthToken=\"${TWILIO_AUTH_TOKEN}\"\nENV SMS__Twilio__FromNumber=\"${TWILIO_PHONE_NUMBER}\"\nENV TwoFactor__SMSCodeExpiration=\"00:05:00\"", "severity": "medium", "tags": [ "dotnet", "identity", "sms", "2fa", "twilio", "authentication" ] }, { "id": "dotnet-identity-default-roles", "category": "configuration", "pattern": "role|RoleManager|authorization", "recommendation": "Configure default roles and admin seeding at application startup for consistent authorization", "example": "ENV Roles__DefaultRoles=\"User,Manager,Admin\"\nENV Roles__AdminEmail=\"${ADMIN_EMAIL}\"\nENV Roles__SeedAdminOnStartup=\"true\"\nENV Authorization__EnableRoleHierarchy=\"true\"", "severity": "medium", "tags": [ "dotnet", "identity", "roles", "authorization", "configuration" ] }, { "id": "dotnet-identity-token-validation", "category": "security", "pattern": "JWT|token.*validat|bearer", "recommendation": "Configure comprehensive JWT token validation including issuer, audience, lifetime, and signature validation", "example": "ENV Jwt__ValidateIssuer=\"true\"\nENV Jwt__ValidateAudience=\"true\"\nENV Jwt__ValidateLifetime=\"true\"\nENV Jwt__ValidateIssuerSigningKey=\"true\"\nENV Jwt__ClockSkew=\"00:05:00\"\nENV Jwt__RequireExpirationTime=\"true\"", "severity": "high", "tags": [ "dotnet", "fix-dockerfile", "identity", "jwt", "scan-image", "security", "validation" ] }, { "id": "dotnet-identity-oauth-pkce", "category": "security", "pattern": "OAuth|PKCE|authorization.*code", "recommendation": "Require PKCE (Proof Key for Code Exchange) for OAuth authorization code flow to prevent interception attacks", "example": "ENV OAuth__RequirePkce=\"true\"\nENV OAuth__AllowPlainTextPkce=\"false\"\nENV OAuth__AuthorizationCodeExpiration=\"00:10:00\"\nENV OAuth__RequireClientSecret=\"true\"", "severity": "high", "tags": [ "aws", "dotnet", "fix-dockerfile", "identity", "oauth", "pkce", "scan-image", "security" ] }, { "id": "dotnet-identity-alert-monitoring", "category": "reliability", "pattern": "alert|monitoring|suspicious", "recommendation": "Configure alerting for suspicious identity activities including multiple failed logins and privilege escalation", "example": "ENV Alerting__Enabled=\"true\"\nENV Alerting__EmailRecipients=\"${SECURITY_EMAIL}\"\nENV Alerting__SlackWebhook=\"${SLACK_WEBHOOK}\"\nENV Alerts__FailedLoginThreshold=\"5\"\nENV Alerts__PrivilegeEscalation=\"true\"\nENV Alerts__SuspiciousActivityThreshold=\"5\"", "severity": "medium", "tags": [ "dotnet", "identity", "alerting", "monitoring", "security" ] } ]