Encrypting Header & Request Body Parameters in .NET Core Web API

In modern web applications, ensuring the security of data transmitted over the network is crucial. One effective way to secure sensitive data, such as API keys, credentials, or personal information, is through encryption. In this article, we'll explore how to encrypt headers and request body parameters in a .NET Core Web API to prevent them from being readable in the page source or by network sniffing tools. We'll use an example application developed by "Nikunj Satasiya" to illustrate the process.

Prerequisites

Before we start, ensure you have the following installed.

• .NET Core SDK (version 3.1 or later)
• An IDE such as Visual Studio or Visual Studio Code

Step 1. Create a .NET core Web API project

Open your command terminal and create a new .NET Core Web API project named SecureApi.

dotnet new webapi -n SecureApi
cd SecureApi

Step 2. Install Required Packages

To handle encryption and decryption, install the Microsoft.AspNetCore.DataProtection package.

dotnet add package Microsoft.AspNetCore.DataProtection

Step 3. Implement Data Protection Services

In the Startup.cs file, configure the data protection services in the ConfigureServices method.

public void ConfigureServices(IServiceCollection services)
{
    services.AddControllers();
    services.AddDataProtection();
}

Step 4. Create Encryption Service

Create a service class to encapsulate encryption and decryption logic. Let's call it EncryptionService.

using Microsoft.AspNetCore.DataProtection;
using System;
public class EncryptionService
{
    private readonly IDataProtector _protector;
    public EncryptionService(IDataProtectionProvider dataProtectionProvider)
    {
        _protector = dataProtectionProvider.CreateProtector("NikunjSatasiya.Protector");
    }
    public string Encrypt(string input)
    {
        return _protector.Protect(input);
    }
    public string Decrypt(string encryptedData)
    {
        return _protector.Unprotect(encryptedData);
    }
}

Step 5. Register Encryption Service

Register the EncryptionService in the dependency injection container in Startup.cs.

public void ConfigureServices(IServiceCollection services)
{
    services.AddControllers();
    services.AddDataProtection();
    services.AddSingleton<EncryptionService>();
}

Step 6. Implement Encrypted API

Create a controller that uses EncryptionService to encrypt and decrypt request headers and body parameters.

using Microsoft.AspNetCore.Mvc;
using System;
[ApiController]
[Route("[controller]")]
public class SecureController : ControllerBase
{
    private readonly EncryptionService _encryptionService;

    public SecureController(EncryptionService encryptionService)
    {
        _encryptionService = encryptionService;
    }
    [HttpPost]
    public IActionResult Post(
        [FromHeader(Name = "X-Custom-Header")] string header, 
        [FromBody] string body)
    {
        var decryptedHeader = _encryptionService.Decrypt(header);
        var decryptedBody = _encryptionService.Decrypt(body);
        // Process decrypted data
        Console.WriteLine($"Header: {decryptedHeader}, Body: {decryptedBody}");
        // Encrypt response
        var encryptedResponse = _encryptionService.Encrypt("Processed Data");
        return Ok(encryptedResponse);
    }
}

Step 7. Test the API

For testing, you can use tools like Postman. Encrypt your header and body data using the encryption logic before sending them to the API. Ensure that the API decrypts them correctly, processes them, and returns encrypted responses.

Conclusion

By implementing encryption in your .NET Core Web API, you can ensure that sensitive data in headers and request bodies is secured from potential eavesdropping or access from unauthorized parties. This technique is crucial for protecting data integrity and privacy in applications that handle sensitive information. "Nikunj Satasiya's" example demonstrates a practical approach to achieving this security in .NET Core applications.