Add securing-aspnetcore-apis skill (+7.0% eval, near-miss) - #92
Conversation
Teaches ASP.NET Core API security: JWT bearer auth with proper TokenValidationParameters, CORS configuration (avoiding AllowAnyOrigin), critical middleware ordering, and rate limiting setup. Eval results: +7.0% improvement (threshold: 10%, near-miss) Includes eval.yaml with security setup scenario + negative test.
| app.MapPost("/api/auth/login", Login).AllowAnonymous(); | ||
| ``` | ||
|
|
||
| ### Step 4: Configure CORS correctly |
There was a problem hiding this comment.
Might be worth mentioning Websocket origin checks https://learn.microsoft.com/aspnet/core/fundamentals/websockets?view=aspnetcore-10.0#websocket-origin-restriction
| - Implementing rate limiting to prevent abuse | ||
| - Fixing security misconfigurations | ||
|
|
||
| ## When Not to Use |
There was a problem hiding this comment.
The skill is about multiple different security related concepts, some of which likely still apply to the items in this 'Not' section.
| **NEVER do this in production:** | ||
| ```csharp | ||
| // INSECURE — allows any origin to call your API | ||
| policy.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader(); |
There was a problem hiding this comment.
Another insecure pattern is policy.SetIsOriginAllowed(origin => return true)
| // Global limiter | ||
| options.GlobalLimiter = PartitionedRateLimiter.Create<HttpContext, string>( | ||
| context => RateLimitPartition.GetFixedWindowLimiter( | ||
| partitionKey: context.User?.Identity?.Name ?? context.Connection.RemoteIpAddress?.ToString() ?? "anonymous", |
There was a problem hiding this comment.
Consider different partitions for anonymous vs. authenticated users.
| @@ -0,0 +1,47 @@ | |||
| scenarios: | |||
There was a problem hiding this comment.
I assume there will be more scenarios in the future, this is just a good first start?
|
|
||
| ### Step 2: Configure middleware in the CORRECT order | ||
|
|
||
| **Middleware order is critical. Wrong order = auth bypassed silently.** |
There was a problem hiding this comment.
Can we refer to https://learn.microsoft.com/aspnet/core/fundamentals/middleware/?view=aspnetcore-10.0#middleware-order so we don't need to maintain an explicit list here? Or add it as an extra resource to check if needed?
Skill Validation Results — securing-aspnetcore-apis
Overall improvement: -19.8% (1 run) The model already scores 5/5 on the baseline across all scenarios — the skill provides no marginal quality improvement and adds token/time overhead that the pairwise judge penalizes. Recommend closing this PR as the model's existing knowledge is sufficient for these security scenarios. Model: claude-opus-4.6 | Judge: claude-opus-4.6 |
1 similar comment
Skill Validation Results — securing-aspnetcore-apis
Overall improvement: -19.8% (1 run) The model already scores 5/5 on the baseline across all scenarios — the skill provides no marginal quality improvement and adds token/time overhead that the pairwise judge penalizes. Recommend closing this PR as the model's existing knowledge is sufficient for these security scenarios. Model: claude-opus-4.6 | Judge: claude-opus-4.6 |
|
Closing since this is a futile experiment with a low score on the evals. CC: @BrennanConroy et al., please feel free to take the contents here and reuse for a new skill but the skill as it is isn't scoring as well as I hoped. |
… - VSTest-preserving path confirmed, Workforce status noted
Summary
Adds the securing-aspnetcore-apis skill for securing ASP.NET Core APIs with auth, CORS, and rate limiting.
Eval Results
What the Skill Teaches
Files