healthcare-api-security-demo

A .NET 10 healthcare API security demo focused on Application Security, secure SDLC, regulated systems, and governance-aware engineering.

Purpose

This project demonstrates how to design and implement a secure API for a regulated healthcare-style environment.

It focuses on:

• patient data access control
• BOLA / IDOR prevention
• role-based authorization
• policy-based authorization
• JWT authentication
• audit logging
• secure error handling
• rate limiting
• secure headers
• input validation
• least privilege
• OWASP API Top 10 mapping

Portfolio Value

This repository supports positioning as:

• Application Security transition candidate
• Secure Software Engineer
• Secure SDLC Engineer
• Healthcare Cybersecurity candidate
• Governance-aware engineer
• Cloud/security-oriented .NET engineer

Demo Roles

Role	Capabilities
Doctor	View assigned patients and create medical notes
Nurse	View assigned patients, no record creation
Patient	View only their own profile and records
Auditor	View audit logs, no medical record modification
Admin	Manage high-level system data

Demo Credentials

doctor@example.com / Doctor123!
nurse@example.com / Nurse123!
patient@example.com / Patient123!
auditor@example.com / Auditor123!
admin@example.com / Admin123!

Run Locally

dotnet restore
dotnet build
dotnet test
dotnet run --project src/HealthcareApiSecurityDemo.Api

Swagger:

https://localhost:5001/swagger

Key Security Scenarios

BOLA / IDOR Prevention

Patients can only access their own records. Doctors and nurses can only access assigned patients.

Auditability

Sensitive actions are logged with:

• user
• role
• action
• resource
• timestamp
• correlation ID

Least Privilege

Each role gets only the minimum required access.

Secure API Responses

The API uses DTOs and avoids exposing internal entities directly.

Documentation

See:

• docs/THREAT_MODEL.md
• docs/OWASP_API_TOP_10_MAPPING.md
• docs/SECURITY_CONTROLS.md