{"id":1347,"date":"2025-04-14T00:00:00","date_gmt":"2025-04-13T22:00:00","guid":{"rendered":"https:\/\/demo.sidekick.be\/itenium\/check-web-api-security\/"},"modified":"2025-11-28T13:31:41","modified_gmt":"2025-11-28T12:31:41","slug":"check-web-api-security","status":"publish","type":"post","link":"https:\/\/demo.sidekick.be\/itenium\/blog\/dotnet\/check-web-api-security\/","title":{"rendered":"UnitTest: Check Security on your Controllers"},"content":{"rendered":"

TL&DR<\/h1>\n
Type[] controllerTypes = typeof(YourController).Assembly.GetTypes()\n  .Where(t => t.GetCustomAttributes(typeof(ApiControllerAttribute), true).Any())\n  .ToArray();\n\nvar missingAuthActions = new List<string>();\nforeach (Type controller in controllerTypes)\n{\n  \/\/ If the entire Controller has Authorize\/AllowsAnonymous attribute, just move on\n  bool ctlHasAuthorize = controller.GetCustomAttributes(typeof(AuthorizeAttribute), true).Any();\n  if (ctlHasAuthorize)\n    continue;\n\n  bool ctlHasAllowAnon = controller.GetCustomAttributes(typeof(AllowAnonymousAttribute), true).Any();\n  if (ctlHasAllowAnon)\n    continue;\n\n  \/\/ NonAction methods do not represent an endpoint, and thus need no security check\n  var methods = controller\n    .GetMethods(BindingFlags.Instance | BindingFlags.Public | BindingFlags.DeclaredOnly)\n    .Where(m => !m.GetCustomAttributes(typeof(NonActionAttribute), true).Any());\n\n  foreach (MethodInfo method in methods)\n  {\n    bool hasAuthorize = method.GetCustomAttributes(typeof(AuthorizeAttribute), true).Any();\n    bool hasAllowAnonymous = method.GetCustomAttributes(typeof(AllowAnonymousAttribute), true).Any();\n    if (!hasAllowAnonymous && !hasAuthorize)\n    {\n      missingAuthActions.Add($\"{controller.Name}.{method.Name}\");\n    }\n  }\n}\n\nif (missingAuthActions.Any())\n{\n  var sortedMethods = string.Join(\"n\", missingAuthActions.OrderBy(x => x));\n  Assert.Fail($\"The following actions are missing [Authorize] attribute:n{sortedMethods}\");\n}\n<\/code><\/pre>\n
Variations<\/h1>\n
Maybe you want to remove the code allowing [AllowAnonymous]<\/code> or something\u2026<\/p>\n
Finding the Controllers<\/h2>\n
The code above checks for the presence of [ApiController]<\/code> but your mileage may vary:<\/p>\n
\/\/ Controllers have [ApiController] attribute\n.Where(t => t.GetCustomAttributes(typeof(ApiControllerAttribute), true).Any())\n\n\/\/ Controllers inherit from ControllerBase\n.Where(t => t.IsSubclassOf(typeof(ControllerBase)))\n\n\/\/ Check for \"Controller\" in the name (or use EndsWith)\n.Where(t => t.Name.Contains(\"Controller\"))\n<\/code><\/pre>\n
NotImplementedException<\/h2>\n
In a blatant violation of the Interface Segregation Principle (ISP)<\/a> some of our controllers implemented an interface but only implemented a few of the methods, with all others just doing a:<\/p>\n
throw new NotImplementedException();\n<\/code><\/pre>\n
And of course this broke the test \ud83d\ude48<\/p>\n
More AI to the rescue! Thank god for AI too, because I\u2019m pretty sure I would\u2019ve spent a lot of time on this otherwise \ud83d\udd25<\/p>\n
This doesn\u2019t catch all variations (ex: var ex = new NotImplementedException(); throw ex;<\/code>) but was good enough for our code-base.<\/p>\n
public static bool MethodThrowsNotImplementedException(MethodInfo method)\n{\n  byte[]? methodBody = method.GetMethodBody()?.GetILAsByteArray();\n  if (methodBody == null)\n    return false;\n\n  for (int i = 0; i < methodBody.Length - 5; i++)\n  {\n    \/\/ Look for NEWOBJ (0x73) followed later by THROW (0x7A)\n    if (methodBody[i] == 0x73 && methodBody[i + 5] == 0x7A)\n    {\n      var ctorToken = BitConverter.ToInt32(methodBody, i + 1);\n      var ctor = method.Module.ResolveMethod(ctorToken) as ConstructorInfo;\n      if (ctor?.DeclaringType == typeof(NotImplementedException))\n        return true;\n    }\n  }\n  return false;\n}\n<\/code><\/pre>\n
Minimal APIs<\/h1>\n
We\u2019re not using minimal APIs but for the sake of completeness, here is the code to check the same thing:<\/p>\n
Program.cs<\/h2>\n
Here we need to check if either RequireAuthorization<\/code> or AllowAnonymous<\/code> fluent methods were called for each endpoint.<\/p>\n
Also note the public partial class Program<\/code> addition so that we can reference Program from the test. This is probably not necessary if you have nicely split your startup code instead of just dumping everything in Program.cs \ud83d\ude09<\/p>\n
app.MapGet(\"\/unsecured\", () => \"Stormy\");\napp.MapGet(\"\/secured\", () => \"Sunny\").RequireAuthorization();\napp.MapGet(\"\/anonymous\", () => \"Cloudy\").AllowAnonymous();\n\napp.Run();\n\n\/\/ Enable access to Program from the test\n#if DEBUG\npublic partial class Program { }\n#endif\n<\/code><\/pre>\n
The Test<\/h2>\n
var factory = new WebApplicationFactory<Program>().WithWebHostBuilder(builder =>\n{\n  builder.ConfigureTestServices(services => { \/* Mock services as needed *\/ });\n});\n\nvar endpointDataSource = factory.Services.GetRequiredService<EndpointDataSource>();\nvar unsecured = new List<string>();\nforeach (var endpoint in endpointDataSource.Endpoints)\n{\n  bool isAuthorized = endpoint.Metadata.GetMetadata<IAuthorizeData>() != null;\n  bool isAnonymousAllowed = endpoint.Metadata.GetMetadata<IAllowAnonymous>() != null;\n  if (!isAuthorized && !isAnonymousAllowed)\n  {\n    unsecured.Add(endpoint.DisplayName ?? \"??\");\n  }\n}\n\nif (unsecured.Any())\n{\n  var lst = string.Join(\"n\", unsecured);\n  Assert.Fail($\"Missing RequireAuthorization\/AllowAnonymous for endpoints:n{lst}\");\n}\n<\/code><\/pre>\n
Extras<\/h1>\n
Stuff that came into being during the making of this post<\/b><\/p>\n