DFMS Security Guidelines

Secrets Management

⚠️ CRITICAL: Never Commit Secrets to Source Control

The following files contain sensitive information and should NEVER be committed:

• appsettings.Production.json - Production configuration with real passwords
• appsettings.json - Development settings (currently contains hardcoded secrets - see below)

Current Security Issues to Address

1. Move secrets to environment variables or User Secrets:

   # Set environment variables (Windows PowerShell)
   $env:ConnectionStrings__DefaultConnection = "your-connection-string"
   $env:Jwt__Key = "your-jwt-key"
   $env:EmailSettings__MailPassword = "your-email-password"

2. Or use .NET User Secrets for development:

   dotnet user-secrets init
   dotnet user-secrets set "Jwt:Key" "your-secure-key"
   dotnet user-secrets set "ConnectionStrings:DefaultConnection" "your-connection-string"

3. For production, use Azure Key Vault or similar

Security Fixes Applied

CSRF Protection

• All POST methods in AdminController now have [ValidateAntiForgeryToken] attribute
• Ensure all forms include @Html.AntiForgeryToken() or use tag helpers with asp-action

API Registration

• The /api/authentication/register endpoint now requires Administrator role
• Previously was open to anyone (AllowAnonymous)

Path Traversal Protection

• File download/display functions now validate filenames
• Path resolution ensures files are within allowed directories
• Use FileSecurityHelper.TryGetSafeFilePath() for new file operations

Authorization

• Users can only view their own details (unless Administrator)
• Added proper authorization checks to Details action

Logging

• Removed JWT key logging from AuthUserService and Program.cs
• Never log sensitive information (passwords, tokens, keys)

Error Handling

• Developer Exception Page only shows in Development environment
• Production uses generic error page

Recommended Next Steps

1. Rotate all secrets that were in appsettings.json (they're in git history)
2. Add .gitignore with entries for:

   appsettings.Production.json
   appsettings.*.local.json
   

3. Enable HTTPS redirect in production
4. Add rate limiting to login endpoints
5. Implement audit logging for sensitive operations
6. Add account lockout policies (already configured in Program.cs)

Role Definitions

Role	Purpose
Administrator	Full system access
User	Practitioner access
FacilityUser	Institution/Facility access
Finance	Payment-related functions
ApiUser	External API integrations