Secure Your MQTT Client in C# with Basic Authentication

It’s tempting to use quick examples without credentials, but in a real-world scenario you must authenticate your MQTT client. In this post we’ll show how to add basic authentication in C# and discuss brute-force risks and how to mitigate them.

---

Basic Authentication Setup

Using the MQTTnet library, simply call .WithCredentials() when building the client options:

using MQTTnet;
using MQTTnet.Client;
using MQTTnet.Client.Options;
using System;
using System.Text;
using System.Threading.Tasks;

class Program
{
    static async Task Main()
    {
        var options = new MqttClientOptionsBuilder()
            .WithTcpServer("broker.hivemq.com", 1883)
            .WithClientId("dotnet-iot-secure-demo")
            .WithCredentials("myUser", "myStrongPassword") // ← basic authentication
            .Build();

        var factory = new MqttFactory();
        var client = factory.CreateMqttClient();

        client.UseConnectedHandler(async _ =>
        {
            Console.WriteLine("Connected with basic authentication");
            await client.SubscribeAsync("iot/door/status");
        });

        client.UseApplicationMessageReceivedHandler(e =>
        {
            var payload = Encoding.UTF8.GetString(e.ApplicationMessage.Payload);
            Console.WriteLine($"Message received: {payload}");
        });

        await client.ConnectAsync(options);
        Console.WriteLine("Press ENTER to exit...");
        Console.ReadLine();
    }
}

Note: Even with username/password, it’s critical that your broker and client use TLS (port 8883) so credentials aren’t sent in plaintext.

Best Practices to Harden Security Strong Passwords

Use ≥16 characters and mix uppercase, lowercase, numbers, and symbols.

Attempt Limiting
Lock out after N failed attempts (e.g., 5 failures → 5-minute lock).

IP Filtering
Restrict connections to trusted IP ranges (e.g., your corporate network).

Enforce TLS
Never transmit credentials in plaintext; require TLS on both client and broker. .WithTls

Credential Rotation
Change usernames/passwords regularly (every 3–6 months).

Monitoring & Alerts
Log failed logins and set up alerts when thresholds are exceeded.