🛡️ Fortress Auth — Secure Authentication System (.NET 8)

Tech Stack: .NET 8 • C# • EF Core (SQLite) • BCrypt • JWT (RS256) • OAuth2-style Tokens • TOTP MFA • Rate Limiting • HSTS & Security Headers • Docker Support

---

⚙️ Local Setup

# 1️⃣ Restore dependencies
dotnet restore

# 2️⃣ Build in Debug mode
dotnet build -c Debug

# 3️⃣ Run the API project
dotnet run --project src/FortressAuth.Api

The API will start on https://localhost:5001 and use a development HTTPS certificate generated by .NET. A default admin account is automatically created on first run: Email: admin@fortress.local Password: P@ssw0rd!ChangeMe ⚠️ Change the default password before deploying to production.

🧰 Configuration Overview

All main settings are in src/FortressAuth.Api/appsettings.json:
JWT issuer, audience, and token lifetime
Database connection string (SQLite by default)
Rate Limiting settings
Admin seed user credentials
Keys: RSA key pairs for JWT signing are automatically generated into the keys/ folder (for development).
In production, use secure key management — such as AWS KMS, Azure Key Vault, or HashiCorp Vault.