How to secure your Umbraco api controller with an api key

public class DemoController : UmbracoApiController
{
    [HttpPost]
    public IActionResult SecuredAction()
    {
        return Ok("You have access to this endpoint!");
    }
}

public class ApiKeyAuthenticationDefaults
{
    // 👇 This string identifies the authentication scheme for api keys. It can be anything you want.
    public const string AuthenticationScheme = "ApiKey";

    // 👇 This is the header from which the api key should be read
    public const string HeaderName = "apiKey";
}

public class ApiKeyAuthenticationOptions : AuthenticationSchemeOptions
{
    // 👇 This is the value that the request header should have to be accepted
    public string ApiKey { get; set; }
}

{
    "ApiConnection": {
        "ApiKey": "MySecretApiKey"
    }
}

public class ApiKeyAuthenticationHandler : AuthenticationHandler<ApiKeyAuthenticationOptions>
{
    public ApiKeyAuthenticationHandler(
        IOptionsMonitor<ApiKeyAuthenticationOptions> options,
        ILoggerFactory logger,
        UrlEncoder encoder,
        ISystemClock clock)
        : base(options, logger, encoder, clock)
    { }

    // 👇 All our code will be synchronous, so let's leave all async stuff separate.
    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
        => Task.FromResult(HandleAuthenticate());

    private AuthenticateResult HandleAuthenticate()
    {
        // 👇 We have to make sure that an api key is defined.
        // If the api key is not defined, the endpoint is potentially vulnerable, so this handler should stop early to prevent accidental exposure
        var apiKey = Options.ApiKey;
        if (string.IsNullOrWhiteSpace(apiKey))
        {
            Logger.LogError("The configured api key is empty or null. APIs with api key are closed off for security");
            return AuthenticateResult.NoResult();
        }

        // 👇 If the incoming request does not have the api key header, then it can't be authenticated with this handler, so the handler stops early
        if (!Request.Headers.ContainsKey(ApiKeyAuthenticationDefaults.HeaderName))
        {
            return AuthenticateResult.NoResult();
        }

        // 👇 If the incoming request does contain the api key header, then it's certain that they try to authenticate with this handler.
        // If the incoming api key does not match configuration, the authentication should actively fail.
        if (!Options.ApiKey.Equals(Request.Headers[ApiKeyAuthenticationDefaults.HeaderName]))
        {
            return AuthenticateResult.Fail("Invalid Key provided");
        }

        // 👇 If all the previous checks pass, then we know that the requester is legit.
        // Notice that these claims can pretty much be anything you want. The Claim of type 'ClaimTypes.Name' is required to have, but the rest is completely up to you.
        // In this example, I use the remote IP address as part of the identity. This will come in use later in the authorization step
        var claims = new[] { new Claim("origin", Request.HttpContext.Connection.RemoteIpAddress.ToString()), new Claim(ClaimTypes.Name, Request.HttpContext.Connection.RemoteIpAddress.ToString()) };
        var identity = new ClaimsIdentity(claims, Scheme.Name);
        var principal = new ClaimsPrincipal(identity);
        var ticket = new AuthenticationTicket(principal, Scheme.Name);
        return AuthenticateResult.Success(ticket);
    }
}

public static class ApiKeyAuthenticationExtensions
{
    public static AuthenticationBuilder AddApiKey(this AuthenticationBuilder builder, Action<ApiKeyAuthenticationOptions>? configureOptions = null)
        => AddApiKey(builder, ApiKeyAuthenticationDefaults.AuthenticationScheme, configureOptions);

    public static AuthenticationBuilder AddApiKey(this AuthenticationBuilder builder, string authenticationScheme, Action<ApiKeyAuthenticationOptions>? configureOptions = null)
    {
        return builder.AddScheme<ApiKeyAuthenticationOptions, ApiKeyAuthenticationHandler>(authenticationScheme, configureOptions);
    }
}

public class Startup
{
    // ...

    public void ConfigureServices(IServiceCollection services)
    {
        // ...

        services.AddAuthentication(ApiKeyAuthenticationDefaults.AuthenticationScheme)
            .AddApiKey(options =>
            {
                // 👇 the api key is read from the appsettings.json here.
                options.ApiKey = _config.GetValue<string>("ApiConnection:ApiKey");
            });
    }
}

public class DemoController : UmbracoApiController
{
    // 👇 We use the authentication schemes option here to say that users need to be authenticated with an api key before accessing this resource. There are no requirements for this user.
    [HttpPost, Authorize(AuthenticationSchemes = ApiKeyAuthenticationDefaults.AuthenticationScheme)]
    public IActionResult SecuredAction()
    {
        return Ok("You have access to this endpoint!");
    }
}

public class IPAddressPolicyDefaults
{
    public const string LocalhostPolicy = "SourceFromLocalhost";
    public const string LocalhostIP = "::1";
}

public class IPAddressRequirement : IAuthorizationRequirement
{
    public IPAddressRequirement(string ipaddress)
    {
        SourceAddress = IPAddress.Parse(ipaddress);
    }

    public IPAddress SourceAddress { get; }
}

public class Startup
{
    // ...

    public void ConfigureServices(IServiceCollection services)
    {
        // ...

        services.AddAuthorization(options =>
        {
            options.AddPolicy(IPAddressPolicyDefaults.LocalhostPolicy, policy =>
            {
                policy.Requirements.Add(new IPAddressRequirement(IPAddressPolicyDefaults.LocalhostIP));
            });
        });
    }
}

// 👇 this handler specifically handles every ip address requirement
public class IPAddressAuthorizationHandler : AuthorizationHandler<IPAddressRequirement>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, IPAddressRequirement requirement)
    {
        // 👇 We have knowledge about the user through their claims. Look back at the Authentication handler and notice that we set a value for the claim "origin" there. It is here that we read and use that value.
        var claim = context.User.Claims.FirstOrDefault(c => c.Type == "origin");

        // 👇 If there is no origin claim, then this handler cannot verify the ip address requirement
        if (claim is null) return Task.CompletedTask;

        // 👇 If the origin claim cannot be parsed as an IPAddress, then this handler also cannot verify the ip address requirement
        if (!IPAddress.TryParse(claim.Value, out var ipAddress)) return Task.CompletedTask;

        // 👇 If the ip address from the origin claim is not equal to the ip address of the requirement, then this handler still cannot verify the ip address requirement
        if (!ipAddress.Equals(requirement.SourceAddress)) return Task.CompletedTask;

        // 👇 If all the above checks pass, then this must be a valid ip address and the requirement is verified.
        context.Succeed(requirement);
        return Task.CompletedTask;
    }
}

public class Startup
{
    // ...

    public void ConfigureServices(IServiceCollection services)
    {
        // ...

        services.AddSingleton<IAuthorizationHandler, IPAddressAuthorizationHandler>();
    }
}

public class DemoController : UmbracoApiController
{
    [HttpPost, Authorize(AuthenticationSchemes = ApiKeyAuthenticationDefaults.AuthenticationScheme, Policy = IPAddressPolicyDefaults.LocalhostPolicy)]
    public IActionResult SecuredAction()
    {
        return Ok("You have access to this endpoint!");
    }
}