C# Source Intelligence: ASP.NET Framework Support
The following section covers the C# framework and library components that NightVision Source Intelligence can detect and use to generate OpenAPI documentation. If a component that you use is not supported, please contact our support team at support@nightviz.ai and we can add this as a new feature.
C# ASP.NET.CORE
Section titled “C# ASP.NET.CORE”Microsoft.AspNetCore.Builder
Section titled “Microsoft.AspNetCore.Builder”| Library Component | Description |
|---|---|
| WebApplication | Method to initialize a web application |
| WebApplication.CreateBuilder | Method to create a builder for a web application, configuring services and middleware |
| WebApplicationBuilder | Initializes a new instance of the web application builder |
| WebApplicationBuilder.Build | Builds the web application and sets up the hosting environment |
| WebApplicationBuilder.Services | Collection of services for the application to compose |
| IApplicationBuilder.Map | Applies a base path prefix to a branch of the application |
| IApplicationBuilder.UseEndpoints | Adds middleware that will execute the defined endpoints |
| IApplicationBuilder.UseHealthChecks | Adds a middleware that provides health check status |
| IApplicationBuilder.UseMvc | Adds MVC to the request execution pipeline |
| IApplicationBuilder.UseMvcWithDefaultRoute | Adds MVC to the request execution pipeline with a default route |
| IApplicationBuilder.UsePathBase | Applies a base path prefix to the application |
| IEndpointConventionBuilder | Builds conventions that will be used for customization of EndpointBuilder instances |
| IEndpointConventionBuilder.AllowAnonymous | Allows anonymous access to endpoints |
| IEndpointConventionBuilder.RequireAuthorization | Adds authorization to endpoints |
Microsoft.AspNetCore.Mvc
Section titled “Microsoft.AspNetCore.Mvc”| Library Component | Description |
|---|---|
| ApiController | Marks a class as an API controller with attribute routing, making it use attribute routing to define its routes |
| Controller | Base class for an MVC controller without views |
| ControllerBase | Base class for an MVC or API controller |
| FromBody | The attribute that specifies a parameter should be bound from the body of the request |
| FromHeader | The attribute that specifies a parameter should be bound from the request headers |
| FromQuery | The attribute that specifies a parameter should be bound from the query string |
| FromRoute | The attribute that specifies a parameter should be bound from route data |
| HttpContext | Encapsulates all HTTP-specific information about an individual HTTP request |
| HttpDelete | Attribute indicating an action responds to HTTP DELETE requests |
| HttpGet | Attribute indicating an action responds to HTTP GET requests |
| HttpHead | Attribute indicating an action responds to HTTP HEAD requests |
| HttpOptions | Attribute indicating an action responds to HTTP OPTIONS requests |
| HttpPatch | Attribute indicating an action responds to HTTP PATCH requests |
| HttpPost | Attribute indicating an action responds to HTTP POST requests |
| HttpPut | Attribute indicating an action responds to HTTP PUT requests |
| Route | Attribute that defines the URL pattern that an action handles |
Microsoft.AspNetCore.Routing
Section titled “Microsoft.AspNetCore.Routing”| Library Component | Description |
|---|---|
| IEndpointRouteBuilder MapDelete, MapGet, MapHead, MapOptions, MapPatch, MapPost, MapPut | Contract for specifying the routes for an application |
| IEndpointRouteBuilder.MapControllers | Adds endpoints for controller actions |
| IEndpointRouteBuilder.MapDefaultControllerRoute | Adds endpoints for controller actions to the IEndpointRouteBuilder and adds the default route {controller=Home}/{action=Index}/{id?} |
| IEndpointRouteBuilder.MapGroup | Creates a RouteGroupBuilder for defining endpoints prefixed with a specified prefix |
| IRouteBuilder MapDelete, MapGet, MapHead, MapOptions, MapPatch, MapPost, MapPut | Contract for a route builder in an application |
| RouteGroupBuilder | A builder for defining groups of endpoints with a common prefix |
Microsoft.AspNetCore.Http
Section titled “Microsoft.AspNetCore.Http”| Library Component | Description |
|---|---|
| HttpContext | Encapsulates all HTTP-specific information about an individual request |
| HttpContext.AuthenticateAsync | Authenticate the current request |
| HttpContext.Request | Gets the HttpRequest object for the request |
| HttpRequest | Represents the incoming side of an individual HTTP request |
| HttpRequest.Cookies | Gets the collection of Cookies for this request |
| HttpRequest.Form | Access the request body as form values |
| HttpRequest.Headers | Gets the request headers |
| HttpRequest.Query | Gets the query value collection for the request |
| HttpResults | Namespace containing classes implementing IResult |
| IResult | The result of an HTTP endpoint |
| PathString | Provides correct escaping for path when constructing a URI string |
Microsoft.Extensions.DependencyInjection
Section titled “Microsoft.Extensions.DependencyInjection”| Library Component | Description |
|---|---|
| IServiceCollection | Specifies the contract for a collection of service descriptors |
| IServiceCollection.AddAuthentication | Registers services required by authentication |
| IServiceCollection.AddAuthorization | Registers services required by authorization |
| IServiceCollection.AddAuthorizationBuilder | Add a builder to add authorization services |
| IServiceCollection.AddDefaultIdentity | Adds a set of common identity services to the application and configures authentication to use identity cookies |
| IServiceCollection.AddIdentity | Adds the default identity system configuration for a specified user and role types |
| IServiceCollection.AddIdentityServer | Return a builder object that provides extension methods to add IdentityServer-specific services to the service provider |
| IServiceCollection.AddOpenIddict | Registers OpenIddict core services to allow an application to act as an OIDC and OAuth2 provider |
| IServiceCollection.ConfigureApplicationCookie | Configures the application cookie |
Microsoft.AspNetCore.Authentication
Section titled “Microsoft.AspNetCore.Authentication”| Library Component | Description |
|---|---|
| AuthenticationBuilder | Authentication builder class |
| AuthenticationBuilder.AddScheme | Add and configures a custom authentication scheme |
| AuthenticationBuilder.AddCookie | Adds cookie authentication to the AuthenticationBuilder |
| AuthenticationBuilder.AddJwtBearer | Enables JWT-bearer authentication |
| AuthenticationBuilder.AddNegotiate | Configures the AuthenticationBuilder to use Negotiate (a.k.a. Windows, Kerberos, or NTLM) authentication |
| AuthenticationBuilder.AddOAuth | Adds OAuth2-based authentication |
| AuthenticationBuilder.AddOpenIdConnect | Adds OpenIdConnect authentication |
| AuthenticationBuilder.AddWsFederation | Registers the WS-Federation authentication handler |
| AuthenticationBuilder.AddFacebook | Add Facebook OAuth2-based authentication |
| AuthenticationBuilder.AddGoogle | Add Google OAuth2-based authentication |
| AuthenticationBuilder.AddMicrosoftAccount | Add Microsoft OAuth2-based authentication |
| AuthenticationBuilder.AddMicrosoftIdentityWebApi | Protects the web API with Microsoft identity platform (formerly Azure AD v2.0) |
| AuthenticationBuilder.AddMicrosoftIdentityWebApp | Add authentication with Microsoft identity platform |
| AuthenticationBuilder.AddPolicyScheme | Registers an authentication handler which can redirect to other authentication schemes |
| AuthenticationOptions | Options to configure authentication for an application |
| AuthenticationOptions.DefaultAuthenticateScheme | Used as the default scheme by authenticate operations |
| AuthenticationOptions.DefaultScheme | Used as the fallback default scheme for all authentication operations |
| AuthenticationSchemeOptions | Base class to configure an authentication scheme |
| AuthenticationSchemeOptions.ForwardAuthenticate | Specifies the target scheme that this scheme should forward authenticate operations to |
| AuthenticationSchemeOptions.ForwardDefault | Specifies a default scheme that authentication handlers forward all authentication operations to |
| AuthenticationSchemeOptions.ForwardDefaultSelector | Function that selects a default scheme for the current request that authentication handlers should forward all authentication operations to |
| AuthenticateResult | Contains the result of an Authenticate call |
| PolicySchemeOptions | Options used by a policy scheme handler |
| JwtBearer | Namespace that contains types that enable support for JWT bearer based authentication |
| Cookies | Contains types that support cookie based authentication |
| OAuth | Contains types that enable support for OAuth based authentication |
| OpenIdConnect | Contains types that enable support for OpenIdConnect based authentication |
| Negotiate | Contains types that enable support for Negotiate (also known as Windows, Kerberos, or NTLM) based authentication |
Microsoft.AspNetCore.Authorization
Section titled “Microsoft.AspNetCore.Authorization”| Library Component | Description |
|---|---|
| AllowAnonymousAttribute | Specifies that the class or method that this attribute is applied to does not require authorization |
| AuthorizationBuilder | Used to configure authorization |
| AuthorizationBuilder.AddPolicy | Adds a policy which can be used by an authorization service |
| AuthorizationOptions | Options to configure authorization for an application |
| AuthorizationOptions.AddPolicy | Add an authorization policy |
| AuthorizationPolicy | Collection of authorization requirements and the scheme or schemes they are evaluated against, all of which must succeed for authorization to succeed |
| AuthorizationPolicy.AuthenticationSchemes | List of the authentication schemes the policy requirements are evaluated against |
| AuthorizationPolicyBuilder | Used for building policies |
| AuthorizationPolicyBuilder.AddAuthenticationSchemes | Adds the specified authentication schemes to the builder |
| AuthorizationPolicyBuilder.Build | Builds a new authorization policy from the requirements in this instance |
| AuthorizeAttribute | Specifies that the class or method that this attribute is applied to requires the specified authorization |
| IAuthorizeData | Interface defining the data required to apply authorization rules to a resource |
| IAuthorizeData.AuthenticationSchemes | Comma-delimited list of schemes from which user information is constructed |
| IAuthorizeData.Policy | Policy name that determines access to the resource |
Microsoft.AspNetCore.Identity
Section titled “Microsoft.AspNetCore.Identity”| Library Component | Description |
|---|---|
| IdentityBuilder | Helper functions for configuring identity services |
| IdentityConstants | Values used to configure the identity system’s cookies middleware |
Legacy ASP.NET
Section titled “Legacy ASP.NET”NightVision also discovers controller actions from legacy System.Web.Mvc applications and Web API 2 controllers derived from System.Web.Http.ApiController. It follows attribute routes and conventional public actions carrying an HTTP verb attribute. Web API controllers without an explicit route use the conventional {controller}/{action} shape.
For classic applications, an application-level Web.config with <authentication mode="Forms"> produces an API-key security scheme in the configured forms-auth cookie (default .ASPXAUTH). <authentication mode="Windows"> produces an HTTP Negotiate scheme. Authentication configuration scoped only to a nested path is not applied to the entire project.
Authentication and security schemes
Section titled “Authentication and security schemes”ASP.NET Core authentication registrations, default schemes, forwarding rules, policies, [Authorize], [AllowAnonymous], RequireAuthorization, and direct AuthenticateAsync calls are combined to describe each operation. Supported registrations include cookies, JWT bearer, basic/custom schemes, OAuth2/OpenID Connect providers, Negotiate, Microsoft Identity Web, Duende IdentityServer, and OpenIddict server and validation hosts.
OpenIddict host builders register bearer schemes only when the ASP.NET Core server or validation integration is used. AddOpenIddict() by itself does not state how requests are authenticated.
DAST sink hints
Section titled “DAST sink hints”Operations from ASP.NET Core controllers and minimal APIs, legacy ASP.NET MVC, and Web API 2 can carry x-nv-dast-sinks for modeled ADO.NET and ORM access, process execution, outbound requests, redirects, dynamic code, template rendering, and file uploads. See DAST sink hints for the vocabulary and interpretation.