[HttpGet("users/{id}")]
[Authorize] // Ensure user is authenticated
public IActionResult GetUser(int id)
{
    var currentUserId = User.GetUserId();
    
    // Check authorization
    if (currentUserId != id && !User.IsInRole("Admin"))
        return Forbid();
    
    var user = _userService.GetById(id);
    return Ok(user);
}

app.get('/api/user/:id', authMiddleware, (req, res) => {
  if (req.user.id !== parseInt(req.params.id) && 
      !req.user.isAdmin) {
    return res.status(403).json({error: 'Access denied'});
  }
  const user = getUserById(req.params.id);
  res.json(user);
});

using Microsoft.AspNetCore.Identity;

// Use ASP.NET Core Identity
public class ApplicationUser : IdentityUser 
{
    // Password handled securely by Identity
}

// Manual implementation with proper hashing
public string HashPassword(string password)
{
    return BCrypt.Net.BCrypt.HashPassword(password, 12);
}

// Secure configuration
services.Configure<DataProtectionOptions>(options => {
    options.ApplicationDiscriminator = "MyApp";
});

const bcrypt = require('bcrypt');

// Proper password hashing
const saltRounds = 12;
const hashedPassword = await bcrypt.hash(password, saltRounds);

// Verification
const isValid = await bcrypt.compare(password, hashedPassword);

// Environment-based secrets
const secretKey = process.env.JWT_SECRET; // Not hardcoded!

// Entity Framework (safest)
var user = context.Users
    .Where(u => u.Email == email)
    .FirstOrDefault();

// Parameterized queries
var query = "SELECT * FROM Users WHERE Email = @Email";
var result = connection.QueryFirstOrDefault<User>(query, 
    new { Email = email });

// Parameterized query
const query = 'SELECT * FROM users WHERE email = ?';
const result = await db.query(query, [email]);

// ORM usage (Sequelize)
const user = await User.findOne({
  where: { email: email } // Automatically parameterized
});

// Production appsettings.json
{
  "Logging": {
    "LogLevel": {
      "Default": "Warning"
    }
  },
  "DetailedErrors": false,
  "ConnectionStrings": {
    "Default": "#{ConnectionString}#" // Tokenized
  }
}

// Secure error handling
app.use((err, req, res, next) => {
  // Log detailed error internally
  logger.error(err.stack);
  
  // Return generic message to user
  res.status(500).json({
    error: 'Internal server error'
  });
});

{
  "dependencies": {
    "lodash": "^4.17.21",      // Current version
    "express": "^4.18.2",      // Latest stable
    "mongoose": "^6.8.0",      // Supported version
    "jsonwebtoken": "^9.0.0"   // Patched version
  }
}

<PackageReference Include="Newtonsoft.Json" 
                  Version="13.0.2" />

<PackageReference Include="Microsoft.AspNetCore" 
                  Version="7.0.0" />

<!-- Enable security auditing -->
<NuGetAudit>true</NuGetAudit>

// Strong password policy
services.Configure<IdentityOptions>(options => {
    options.Password.RequireDigit = true;
    options.Password.RequiredLength = 12;
    options.Password.RequireNonAlphanumeric = true;
    
    // Account lockout
    options.Lockout.MaxFailedAccessAttempts = 3;
    options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(15);
});

// Enable 2FA
services.AddAuthentication()
    .AddMicrosoftAccount(options => { });

// Secure session management
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: true,      // HTTPS only
    httpOnly: true,    // No XSS access
    maxAge: 1800000    // 30min timeout
  }
}));

// Rate limiting
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5 // limit each IP to 5 requests per windowMs
});

# Dockerfile
FROM node:18.17.0-alpine  # Pinned version

# Verify checksums
RUN wget -O acme.sh https://get.acme.sh && \
    echo "expected_hash acme.sh" | sha256sum -c && \
    sh acme.sh

# Lock file for reproducible builds
COPY package-lock.json ./
RUN npm ci  # Uses lock file

// .NET - Safe deserialization
[HttpPost("data")]
public IActionResult ProcessData([FromBody] MyDataModel data)
{
    // Model binding is safe
    if (!ModelState.IsValid)
        return BadRequest(ModelState);
    
    // Work with strongly typed object
    return Ok(ProcessSafeData(data));
}

[HttpPost("login")]
public async Task<IActionResult> Login(LoginModel model)
{
    var result = await _signInManager.PasswordSignInAsync(
        model.Email, model.Password, false, true);
    
    if (result.Succeeded)
    {
        _logger.LogInformation("User {Email} logged in successfully", 
            model.Email);
        return RedirectToAction("Dashboard");
    }
    
    _logger.LogWarning("Failed login attempt for {Email} from {IP}", 
        model.Email, HttpContext.Connection.RemoteIpAddress);
    
    return View("Login");
}

app.post('/transfer', authMiddleware, (req, res) => {
  const { from, to, amount } = req.body;
  const userId = req.user.id;
  
  // Audit critical operations
  logger.info('Money transfer initiated', {
    userId,
    from,
    to,
    amount,
    timestamp: new Date().toISOString(),
    ip: req.ip
  });
  
  transferMoney(from, to, amount);
  res.json({ success: true });
});

// Secure URL fetcher with comprehensive validation
private static readonly HashSet<string> AllowedHosts = new()
{
    "api.github.com",
    "httpbin.org", 
    "jsonplaceholder.typicode.com"
};

private static readonly HashSet<string> BlockedHosts = new()
{
    "169.254.169.254", // AWS metadata
    "metadata.google.internal",
    "localhost", "127.0.0.1", "0.0.0.0"
};

[HttpGet("secure-fetch")]
public async Task<IActionResult> SecureFetch(string url)
{
    // Step 1: Basic URL validation
    if (!Uri.TryCreate(url, UriKind.Absolute, out var uri))
        return BadRequest("Invalid URL format");
    
    // Step 2: Protocol allowlist (HTTPS only)
    if (uri.Scheme != "https")
        return BadRequest("Only HTTPS protocol allowed");
    
    // Step 3: Host allowlist validation
    if (!AllowedHosts.Contains(uri.Host.ToLowerInvariant()))
        return BadRequest($"Host '{uri.Host}' not in allowlist");
    
    // Step 4: Explicit blocklist check
    if (BlockedHosts.Contains(uri.Host.ToLowerInvariant()))
        return BadRequest("Blocked host detected");
    
    // Step 5: Check for private IP ranges
    if (IsPrivateOrReservedIP(uri.Host))
        return BadRequest("Private/reserved IP ranges blocked");
    
    // Step 6: Port restrictions
    var allowedPorts = new[] { 80, 443 };
    if (uri.Port != -1 && !allowedPorts.Contains(uri.Port))
        return BadRequest("Port not allowed");
    
    using var client = new HttpClient();
    client.Timeout = TimeSpan.FromSeconds(10);
    
    try {
        var response = await client.GetAsync(uri);
        var content = await response.Content.ReadAsStringAsync();
        
        // Log the request for monitoring
        _logger.LogInformation("External request made to {Url}", uri);
        
        return Ok(new { content = content[..Math.Min(1000, content.Length)] });
    }
    catch (Exception ex) {
        _logger.LogWarning("Failed request to {Url}: {Error}", uri, ex.Message);
        return StatusCode(500, "Request failed");
    }
}

private static bool IsPrivateOrReservedIP(string hostname)
{
    if (!IPAddress.TryParse(hostname, out var ip)) return false;
    
    var bytes = ip.GetAddressBytes();
    return bytes[0] == 10 || // 10.x.x.x
           (bytes[0] == 172 && bytes[1] >= 16 && bytes[1] <= 31) || // 172.16-31.x.x
           (bytes[0] == 192 && bytes[1] == 168) || // 192.168.x.x
           (bytes[0] == 169 && bytes[1] == 254); // 169.254.x.x (link-local)
}

const allowedHosts = [
  'api.github.com',
  'httpbin.org',
  'jsonplaceholder.typicode.com'
];

const blockedHosts = [
  '169.254.169.254',
  'metadata.google.internal',
  'localhost', '127.0.0.1', '0.0.0.0'
];

function isPrivateIP(hostname) {
  if (!hostname) return true;
  
  // Block localhost variations
  if (['localhost', '127.0.0.1', '0.0.0.0', '::1'].includes(hostname)) {
    return true;
  }
  
  // Check private IP ranges
  const ipRegex = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
  const match = hostname.match(ipRegex);
  
  if (match) {
    const [, a, b, c, d] = match.map(Number);
    
    // Private ranges: 10.x.x.x, 172.16-31.x.x, 192.168.x.x
    if (a === 10) return true;
    if (a === 172 && b >= 16 && b <= 31) return true;
    if (a === 192 && b === 168) return true;
    if (a === 169 && b === 254) return true; // AWS metadata
  }
  
  return false;
}

app.post('/secure-webhook', async (req, res) => {
  const { callbackUrl } = req.body;
  
  try {
    const url = new URL(callbackUrl);
    
    // Protocol validation
    if (url.protocol !== 'https:') {
      return res.status(400).json({
        error: 'Only HTTPS protocol allowed'
      });
    }
    
    // Host allowlist check
    if (!allowedHosts.includes(url.hostname)) {
      return res.status(400).json({
        error: `Host '${url.hostname}' not in allowlist`
      });
    }
    
    // Explicit blocklist check
    if (blockedHosts.includes(url.hostname)) {
      return res.status(400).json({
        error: 'Blocked host detected'
      });
    }
    
    // Private IP validation
    if (isPrivateIP(url.hostname)) {
      return res.status(400).json({
        error: 'Private/internal IPs are blocked'
      });
    }
    
    // Port restrictions
    const allowedPorts = [80, 443];
    const port = parseInt(url.port) || (url.protocol === 'https:' ? 443 : 80);
    if (!allowedPorts.includes(port)) {
      return res.status(400).json({
        error: 'Port not allowed'
      });
    }
    
    // Make request with timeout and size limits
    const controller = new AbortController();
    const timeoutId = setTimeout(() => controller.abort(), 10000);
    
    const response = await fetch(url.toString(), {
      method: 'POST',
      signal: controller.signal,
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify(req.body.data)
    });
    
    clearTimeout(timeoutId);
    
    // Log for monitoring
    console.log(`External request made to ${url.toString()}`);
    
    const data = await response.text();
    res.json({ 
      success: true,
      response: data.substring(0, 1000) // Limit response size
    });
    
  } catch (error) {
    console.warn(`Failed request: ${error.message}`);
    res.status(400).json({ 
      error: 'Invalid or failed request' 
    });
  }
});