.NET Integration Guide

The ZTLayer.AspNetCore package provides a native ASP.NET Core Middleware that integrates directly into your Program.cs request pipeline, protecting your APIs from OWASP Top 10 threats.

1. Installation

Install the package via the NuGet Package Manager or the .NET CLI.

dotnet add package ZTLayer.AspNetCore

2. Configuration

Add your API Key to your appsettings.json or Environment Variables.

{
  "ZTLayer": {
    "ApiKey": "zt_live_xxxxxxxxxxxxxxxxxxxxxxxx",
    "FailMode": "Open"
  }
}

(Note: In production, store this in Azure Key Vault or AWS Secrets Manager, not appsettings.json)

3. Registering the Middleware

[!IMPORTANT] Order matters. Ensure you call UseZTLayer() after UseForwardedHeaders() (if applicable) but before UseAuthentication(), UseAuthorization(), and MapControllers().

// Program.cs
using ZTLayer.AspNetCore;
 
var builder = WebApplication.CreateBuilder(args);
 
// 1. Add ZTLayer Services via Configuration
builder.Services.AddZTLayer(builder.Configuration.GetSection("ZTLayer"));
 
builder.Services.AddControllers();
 
var app = builder.Builder();
 
// 2. Configure proxy trusting (Required if behind AWS ALB/Azure Front Door)
app.UseForwardedHeaders();
 
// 3. Attach ZTLayer Middleware
app.UseZTLayer();
 
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();
 
app.Run();

4. Bypassing Specific Endpoints

If you have specific internal endpoints (like health checks) that should not be inspected, you can decorate your controllers or actions with the [BypassZTLayer] attribute.

using Microsoft.AspNetCore.Mvc;
using ZTLayer.AspNetCore.Attributes;
 
[ApiController]
[Route("api/[controller]")]
public class HealthController : ControllerBase
{
    [HttpGet]
    [BypassZTLayer] // Skips security inspection for this route
    public IActionResult Get()
    {
        return Ok(new { status = "healthy" });
    }
}