How to implement HMAC authentication in ASP.NET Core

using HmacDemoApi;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container
// Learn more about configuring OpenAPI at https://aka.ms/aspnet/openapi
builder.Services.AddOpenApi();

var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.MapOpenApi();
}

// Enable HMAC protection across your entire API pipeline
app.UseMiddleware();

app.MapPost("/api/data", (OrderRequest order, HttpContext context) =>
{
    var user = context.User.Identity?.Name; // "Client_App_01"
    return Results.Ok($"Product {order.ProductId} from {user}");
});

app.Run();

public record OrderRequest(int ProductId, int Quantity);

Implement an HMAC authentication client in ASP.NET Core

The HMAC authentication client should be a Console App project. For our example, we’ll mock a simple order service. The client builds the request by creating an order instance, serializing it, and signing the message using the shared helper class. Finally, the client invokes the API by sending the JSON data and the required authentication headers. All of this is shown in the code listing given below.

using HmacDemoSharedLibrary;

using System.Text;

using System.Text.Json;

Console.WriteLine("Press any key to invoke...");

Console.ReadLine();

await HmacClient.SendSecurePostRequestAsync();

Console.WriteLine("Press any key to stop...");

Console.ReadLine();

public class HmacClient

{

    private static readonly HttpClient client = new HttpClient();

    public static async Task SendSecurePostRequestAsync()

    {

        string url = "https://localhost:44399/api/data";

        string path = "/api/data";

        var order = new OrderRequest(101, 5);

        string jsonBody = JsonSerializer.Serialize(order);

        string timestamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString();

        string method = "POST";

        string payload = $"{method}\n{path}\n{timestamp}\n{jsonBody}";

        string signature = HmacDemoHelper.ComputeHmacSha256(payload);

        var request = new HttpRequestMessage(HttpMethod.Post, url);

        request.Content = new StringContent(jsonBody, Encoding.UTF8, "application/json");

        request.Headers.Add("X-Api-Key", "Client_App_01");

        request.Headers.Add("X-Timestamp", timestamp);

        request.Headers.Add("X-Signature", signature);

        var response = await client.SendAsync(request);

        string result = await response.Content.ReadAsStringAsync();

        Console.WriteLine($"Status Code: {response.StatusCode}");

        Console.WriteLine($"Server Response: {result}");

    }

}

public record OrderRequest(int ProductId, int Quantity);

HMAC authentication in action

To run this application, first set the Web API (HmacDemoApi) and Console App (HmacDemoApiClient) projects as the start projects in Visual Studio. After you’ve set the Web API and the Console App as the start projects and executed the application in Visual Studio, you’ll observe that the Web API project will launch a web page and the Console App will launch a Command window.

Figure 2 below shows how the client app captures the server response and displays it in the Console window.