چگونه API های عمومی را در ASP.NET Core ایمن کنیم؟

[HttpGet()]
[ValidateReferrer]
[RequestLimit("Test-Action", NoOfRequest = 3, Seconds = 10)]
publicasync Task<actionresult>GetAsync(CancellationTokenct)
{
// code here  
}</actionresult>

      namespace Security.Api.Filters
{
    using System;
    using System.Net;
    using Microsoft.AspNetCore.Mvc;
    using Microsoft.AspNetCore.Mvc.Filters;
    using Microsoft.Extensions.Caching.Memory;
    [AttributeUsage(AttributeTargets.Method)]
    public class RequestAttribute :ActionFilterAttribute
    {
        public RequestAttribute(string name)
        {
            Name = name;
        }
        public string Name
        {
            get;
        }
        public intNoOfRequest
        {
            get;
            set;
        } = 1;
        public int Seconds
        {
            get;
            set;
        } = 1;
        private static MemoryCachememoryCache
        {
            get;
        } = new MemoryCache(new MemoryCacheOptions());
        public override void OnActionExecuting(ActionExecutingContext context)
        {
varipAddress = context.HttpContext.Request.HttpContext.Connection.RemoteIpAddress;
varmemoryCacheKey = $ "{Name}-{ipAddress}";
memoryCache.TryGetValue(memoryCacheKey, out intprevReqCount);
            if (prevReqCount>= NoOfRequest)
            {
context.Result = new ContentResult
                {
                    Content = $ "Request is exceeded. Try again in seconds.",
                };
context.HttpContext.Response.StatusCode = (int)HttpStatusCode.TooManyRequests;
            }
            else
            {
varcacheEntryOptions = new MemoryCacheEntryOptions().SetAbsoluteExpiration(TimeSpan.FromSeconds(Seconds));
memoryCache.Set(memoryCacheKey, (prevReqCount + 1), cacheEntryOptions);
            }
        }
    }
}

[HttpGet()]
[ValidateReferrer]
publicasync Task<actionresult>GetAsync(CancellationTokenct)
{
// your code here  
}</actionresult>

namespace Security.Api.Filters
{
    using Microsoft.AspNetCore.Http;
    using Microsoft.AspNetCore.Mvc;
    using Microsoft.AspNetCore.Mvc.Filters;
    using Microsoft.Extensions.Configuration;
    using System;
    using System.Linq;
    using System.Net;
    [AttributeUsage(AttributeTargets.Method)]
    public sealed class ValidateAttribute :ActionFilterAttribute
    {
        private IConfiguration _configuration;
        public ValidateAttribute() { }
        public override void OnActionExecuting(ActionExecutingContext context)
        {
            _configuration = (IConfiguration)context.HttpContext.RequestServices.GetService(typeof(IConfiguration));
base.OnActionExecuting(context);
            if (!IsValidRequest(context.HttpContext.Request))
            {
context.Result = new ContentResult
                {
                    Content = $ "Invalid header"
                };
context.HttpContext.Response.StatusCode = (int)HttpStatusCode.ExpectationFailed;
            }
        }
        private bool IsValidRequest(HttpRequest request)
        {
            string referrerURL = "";
            if (request.Headers.ContainsKey("Referer"))
            {
referrerURL = request.Headers["Referer"];
            }
            if (string.IsNullOrWhiteSpace(referrerURL)) return false;
           //Allows to check customer list
varUrls = _configuration.GetSection("CorsOrigin").Get<string[]>()?.Select(url => new Uri(url).Authority).ToList();
            //add current host for swagger calls    
var host = request.Host.Value;
Urls.Add(host);
            bool isValidClient = Urlsl.Contains(new Uri(referrerURL).Authority);
            // comapre with base uri
            return isValidClient;
        }
    }
}
</string[]>

 namespace Security.Api.Middlewares
{
    using Microsoft.AspNetCore.Http;
    using System.Collections.Generic;
    using System.Linq;
    using System.Net;
    using System.Threading.Tasks;
    using System.Timers;
    public sealed class DosAttackMiddleware
    {
        private static IDictionary _IpAdresses = new Dictionary();
        private static Stack _Banded = new Stack();
        private static Timer _Timer = CreateTimer();
        private static Timer _BannedTimer = CreateBanningTimer();
        private
        const int BANNED_REQUESTS = 10;
        private
        const int REDUCTION_INTERVAL = 1000;
        private
        const int RELEASE_INTERVAL = 3 * 60 * 1000; // 3 minutes    
        private RequestDelegate _next;
        public DosAttackMiddleware(RequestDelegate next)
        {
            _next = next;
        }
        public async Task InvokeAsync(HttpContexthttpContext)
        {
            string ip = httpContext.Connection.RemoteIpAddress.ToString();
            if (_Banned.Contains(ip))
            {
httpContext.Response.StatusCode = (int)HttpStatusCode.Forbidden;
            }
CheckIpAddress(ip);
            await _next(httpContext);
        }
        private static void CheckIpAddress(string ip)
        {
            if (!_IpAdresses.ContainsKey(ip))
            {
                _IpAdresses[ip] = 1;
            }
            else if (_IpAdresses[ip] == BANNED_REQUESTS)
            {
                _Banned.Push(ip);
                _IpAdresses.Remove(ip);
            }
            else
            {
                _IpAdresses[ip]++;
            }
        }
        private static Timer CreateTimer()
        {
            Timer timer = GetTimer(REDUCTION_INTERVAL);
timer.Elapsed += new ElapsedEventHandler(TimerElapsed);
            return timer;
        }
        private static Timer CreateTimer()
        {
            Timer timer = GetTimer(RELEASE_INTERVAL);
timer.Elapsed += delegate {
                if (_Banned.Any()) _Banned.Pop();
            };
            return timer;
        }
        private static Timer GetTimer(int interval)
        {
            Timer timer = new Timer();
timer.Interval = interval;
timer.Start();
            return timer;
        }
        private static TimerElapsed(object sender, ElapsedEventArgs e)
        {
            foreach (string key in _IpAdresses.Keys.ToList())
            {
                _IpAdresses[key]--;
                if (_IpAdresses[key] == 0) _IpAdresses.Remove(key);
            }
        }
    }
}