ASP.NET Core 5 Secure Coding Cookbook: Practical recipes for tackling vulnerabilities in your ASP.NET web applications

enter ASP.NET Core 5 Secure Coding Cookbook Foreword Contributors About the author About the reviewers Preface Who this book is for What this book covers To get the most out of this book Download the example code files Download the color images Conventions used Sections Getting ready How to do it… How it works… There's more… See also Get in touch Share Your Thoughts Chapter 1: Secure Coding Fundamentals Technical requirements Input validation Enabling whitelist validation using validation attributes Getting ready How to do it… How it works… Whitelist validation using the FluentValidation library Getting ready How to do it… How it works… There's more… See also… Syntactic and semantic validation Creating a custom validation attribute to implement semantic validation Getting ready How to do it… How it works… Input sanitization Getting ready How to do it… How it works… Input sanitization using the HTMLSanitizer library Getting ready How to do it… How it works… Output encoding Output encoding using HtmlEncoder Getting ready How to do it… How it works… Output encoding using UrlEncoder Getting ready How to do it… How it works… Output encoding using JavascriptEncoder Getting ready How to do it… How it works… Protecting sensitive data using the Data Protection API Getting ready How to do it… How it works… See also Chapter 2: Injection Flaws Technical requirements What is SQL injection? Fixing SQL injection with Entity Framework Getting ready How to do it… How it works… There's more… Fixing SQL injection in ADO.NET Getting ready How to do it… How it works… There's more… Fixing NoSQL injection Getting ready How to do it… How it works… There's more… Fixing command injection Getting ready How to do it… How it works… There's more… Fixing LDAP injection Getting ready How to do it… How it works… Fixing XPath injection Getting ready How to do it… How it works… There's more… Chapter 3: Broken Authentication Technical requirements Fixing the incorrect restrictions of excessive authentication attempts Getting ready How to do it… How it works… There's more… Fixing insufficiently protected credentials Getting ready How to do it… How it works… Fixing user enumeration Getting ready How to do it… How it works… Fixing weak password requirements Getting ready How to do it… How it works… Fixing insufficient session expiration Getting ready How to do it… How it works… Chapter 4: Sensitive Data Exposure Technical requirements Fixing insufficient protection of data in transit Getting ready How to do it… How it works… Fix missing HSTS headers Getting ready How to do it… How it works… There's more… Fixing weak protocols Getting ready How to do it… How it works… Fixing hardcoded cryptographic keys Getting ready How to do it… How it works… There's more… Disabling caching for critical web pages Getting ready How to do it… How it works… Chapter 5: XML External Entities Technical requirements Enabling XML validation Getting ready How to do it… How it works… There's more… Fixing XXE injection with XmlDocument Getting ready How to do it… How it works… There's more… Fixing XXE injection with XmlTextReader Getting ready How to do it… How it works… Fixing XXE injection with LINQ to XML Getting ready How to do it… How it works… Chapter 6: Broken Access Control Technical requirements Fixing IDOR Getting ready How to do it… How it works… Fixing improper authorization Testing improper authorization Getting ready How to do it… How it works… Fixing missing access control Getting ready How to do it… How it works… Fixing open redirect vulnerabilities Getting ready How to do it… How it works… Chapter 7: Security Misconfiguration Technical requirements Disabling debugging features in non-development environments Getting ready How to do it… How it works… Fixing disabled security features Getting ready How to do it… How it works… Disabling unnecessary features Getting ready How to do it… How it works… Fixing information exposure through an error message Getting ready How to do it… How it works Fixing information exposure through insecure cookies Getting ready How to do it… How it works Chapter 8: Cross-Site Scripting Technical requirements Fixing reflected XSS Getting ready How to do it… How it works… Fixing stored/persistent XSS Getting ready How it works… There's more… Fixing DOM XSS Getting ready How to do it… How it works… Chapter 9: Insecure Deserialization Technical requirements Fixing unsafe deserialization Getting ready Testing unsafe deserialization How to do it… How it works… There's more… Fixing the use of insecure deserializers Getting ready How to do it… How it works… There's more… Fixing untrusted data deserialization Testing untrusted data deserialization Getting ready How to do it… How it works… Chapter 10: Using Components with Known Vulnerabilities Technical requirements Fixing the use of a vulnerable third-party JavaScript library Getting ready Testing outdated and vulnerable third-party libraries How to do it… How it works… There's more… See also Fixing the use of a vulnerable NuGet package Getting ready Testing vulnerable NuGet packages How to do it… How it works… Fixing the use of a library hosted from an untrusted source Getting ready How to do it… How it works… There's more… Chapter 11: Insufficient Logging and Monitoring Technical requirements Fixing insufficient logging of exceptions Getting ready How to do it… How it works… Fixing insufficient logging of DB transactions How to do it… How it works… Fixing excessive information logging How to do it… How it works… Fixing a lack of security monitoring How to do it… How it works… There's more… Chapter 12: Miscellaneous Vulnerabilities Technical requirements Fixing the disabled anti-Cross-Site Request Forgery protection Getting ready How to do it… How it works… There's more… Preventing Server-Side Request Forgery Getting ready How to do it… How it works… There's more… Preventing log injection Getting ready How to do it… How it works… There's more… Preventing HTTP response splitting Getting ready How to do it… How it works… There's more… Preventing clickjacking Getting ready Clickjacking proof of concept (PoC) How to do it… How it works… Fixing insufficient randomness Getting ready How to do it… How it works… Chapter 13: Best Practices Technical requirements Getting ready Proper exception handling Getting ready How to do it… How it works… There's more… Using security-related cookie attributes Getting ready How to do it… How it works… Using a Content Security Policy Getting ready How to do it… How it works… There's more… Fixing leftover debug code Getting ready How to do it… How it works… There's more… Why subscribe? Other Books You May Enjoy Packt is searching for authors like you Share Your Thoughts