Context Aware Validation

[ApiController]
[Route("api/[controller]")]
public class SnippetsController : ControllerBase
{
    // Only accessible to users with the Admin role
    [Authorize(Roles = "Admin")]
    [HttpGet("all")]
    public IActionResult GetAllSnippets()
    {
        return Ok(new { message = "All snippets for admin" });
    }

    // Accessible to both Admin and User roles
    [Authorize(Roles = "Admin,User")]
    [HttpGet("my-snippets")]
    public IActionResult GetMySnippets()
    {
        var userId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
        return Ok(new { userId, message = "User snippets" });
    }
}

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("AdminOnly", policy => 
        policy.RequireRole("Admin"));
    
    options.AddPolicy("UserOrAdmin", policy => 
        policy.RequireRole("User", "Admin"));
});

GET /api/snippets HTTP/1.1
Authorization: Bearer <stolen_token>
X-Forwarded-For: 192.168.1.100

using Microsoft.AspNetCore.HttpOverrides;

builder.Services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | 
                               ForwardedHeaders.XForwardedProto;
    
    // Add your actual load balancer/proxy IPs
    options.KnownProxies.Add(IPAddress.Parse("10.0.0.1"));
    // For multiple proxies:
    // options.KnownProxies.Add(IPAddress.Parse("10.0.0.2"));
});

// In the middleware pipeline:
app.UseForwardedHeaders(); // MUST be BEFORE UseAuthentication()
app.UseAuthentication();

public string GenerateAccessToken(string userId, string role, string ipAddress)
{
    var claims = new[]
    {
        new Claim(ClaimTypes.NameIdentifier, userId),
        new Claim(ClaimTypes.Role, role),
        new Claim("ip", ipAddress) // Bind token to this IP
    };

    // ... Standard JWT signing logic ...
}

// In Program.cs
builder.Services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | 
                               ForwardedHeaders.XForwardedProto;
});

// ... inside the app pipeline ...
app.UseForwardedHeaders();

public class IpValidationMiddleware
{
    private readonly RequestDelegate _next;

    public IpValidationMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        // Only check if the user is already authenticated by standard JWT middleware
        if (context.User.Identity?.IsAuthenticated == true)
        {
            var ipClaim = context.User.FindFirst("ip")?.Value;

            // SECURITY NOTE: RemoteIpAddress only contains the real client IP after 
            // ForwardedHeadersMiddleware processes the request. Without proper configuration,
            // this will be your load balancer's IP, making validation ineffective.
            var currentIp = context.Connection.RemoteIpAddress?.ToString();

            if (!string.IsNullOrEmpty(ipClaim) && ipClaim != currentIp)
            {
                context.Response.StatusCode = StatusCodes.Status403Forbidden;
                await context.Response.WriteAsJsonAsync(
                    new { error = "Token used from unexpected IP" });
                return; // Halt the pipeline
            }
        }

        await _next(context);
    }
}

[HttpPost("refresh")]
public async Task<IActionResult> RefreshToken([FromBody] RefreshTokenRequest request)
{
    // 1. Basic Availability Check
    if (string.IsNullOrEmpty(request.RefreshToken))
    {
        return BadRequest(new { error = "Refresh token required" });
    }

    // 2. Revocation Check (Is it already known to be bad?)
    if (await _revocationService.IsTokenRevokedAsync(request.RefreshToken))
    {
        return Unauthorized(new { error = "Token has been revoked" });
    }

    try
    {
        // 3. Cryptographic Validation
        var tokenHandler = new JwtSecurityTokenHandler();
        // ... (setup validation parameters) ...
        
        var principal = tokenHandler.ValidateToken(
            request.RefreshToken, 
            validationParameters, 
            out var validatedToken);

        // 4. Context Validation: IP Address
        var tokenIp = principal.FindFirst("ip")?.Value;
        var currentIp = HttpContext.Connection.RemoteIpAddress?.ToString();
        
        if (!string.IsNullOrEmpty(tokenIp) && tokenIp != currentIp)
        {
            // Security Event: Revoke immediately
            await _revocationService.RevokeTokenAsync(
                request.RefreshToken,
                "IP mismatch detected");
                
            return Forbid(new { error = "Token used from unexpected IP" }.ToString());
        }

        // 5. Context Validation: User Agent
        var tokenUserAgent = principal.FindFirst("userAgent")?.Value;
        var currentUserAgent = HttpContext.Request.Headers["User-Agent"].ToString();
        
        if (!string.IsNullOrEmpty(tokenUserAgent) && 
            tokenUserAgent != currentUserAgent)
        {
            await _revocationService.RevokeTokenAsync(
                request.RefreshToken,
                "User agent mismatch detected");
                
            return StatusCode(403, new { error = "Token used from unexpected client" });
        }

        // 6. Success: Issue new tokens
        var userId = principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
        var role = principal.FindFirst(ClaimTypes.Role)?.Value;

        var newAccessToken = _tokenService.GenerateAccessToken(userId, role, currentIp);

        return Ok(new { accessToken = newAccessToken });
    }
    catch (SecurityTokenException)
    {
        return Unauthorized(new { error = "Invalid refresh token" });
    }
}

using System;
using System.Net;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Net.Http.Json;
using System.Text.Json;

Console.WriteLine("Running Context-Aware Validation Tests...\n");

var client = new HttpClient();
var passed = 0;
var failed = 0;

// Test 1: Normal user cannot access admin route
Console.WriteLine("Test 1: Normal user accessing admin route...");
var userLogin = await client.PostAsJsonAsync(
    "http://localhost:3001/api/auth/login",
    new { username = "contextUser", password = "pass123" });

var userData = await userLogin.Content.ReadFromJsonAsync<JsonElement>();
var userToken = userData.GetProperty("token").GetString();

var userRequest = new HttpRequestMessage(HttpMethod.Get,
    "http://localhost:3001/api/snippets/all");
userRequest.Headers.Authorization =
    new AuthenticationHeaderValue("Bearer", userToken);

var userResponse = await client.SendAsync(userRequest);

if (userResponse.StatusCode == HttpStatusCode.Forbidden)
{
    Console.WriteLine("✓ Normal user correctly blocked with 403 Forbidden");
    passed++;
}
else
{
    Console.WriteLine($"✗ Expected 403, got {(int)userResponse.StatusCode}");
    failed++;
}

// Test 2: Admin user can access admin route
Console.WriteLine("\nTest 2: Admin user accessing admin route...");
var adminLogin = await client.PostAsJsonAsync(
    "http://localhost:3001/api/auth/login",
    new { username = "contextAdmin", password = "adminPass" });

var adminData = await adminLogin.Content.ReadFromJsonAsync<JsonElement>();
var adminToken = adminData.GetProperty("token").GetString();

var adminRequest = new HttpRequestMessage(HttpMethod.Get,
    "http://localhost:3001/api/snippets/all");
adminRequest.Headers.Authorization =
    new AuthenticationHeaderValue("Bearer", adminToken);

var adminResponse = await client.SendAsync(adminRequest);

if (adminResponse.StatusCode == HttpStatusCode.OK)
{
    Console.WriteLine("✓ Admin user correctly granted access with 200 OK");
    passed++;
}
else
{
    Console.WriteLine($"✗ Expected 200, got {(int)adminResponse.StatusCode}");
    failed++;
}

Console.WriteLine($"\nTests completed: {passed} passed, {failed} failed");

Running Context-Aware Validation Tests...

Test 1: Normal user accessing admin route...
✓ Normal user correctly blocked with 403 Forbidden

Test 2: Admin user accessing admin route...
✓ Admin user correctly granted access with 200 OK

Tests completed: 2 passed, 0 failed