ASP.NET is a Web application framework developed and marketed by Microsoft to allow programmers to build dynamic Web sites, Web applications and Web services.

learn more… | top users | synonyms

4
votes
2answers
91 views

When I turn off request validation in asp.net, am I vulnerable?

So I have request validation off in my web application. You can add /foo?=<script>and my web application won't catch it -it doesn't filter it- Does this make me vulnerable to attacks; should I ...
1
vote
1answer
26 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
2
votes
0answers
405 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as ...
2
votes
0answers
187 views

Hydra - Possible to follow redirects

I'm trying to use Hydra on an ASP web application. Their login page uses the following method: site/Login: username/password If successful, I am redirect back to site/Login but with a newly set ...
1
vote
0answers
56 views

Is it secure to use HttpSessionState.Session to store Identifying Information

I am writing an ASP.NET web app. Is there anything that is insecure to store in HttpSessionState.Session? More specifically, is it ad practice to store such information as UserID, or security ...
0
votes
0answers
41 views

Framework to authenticate web API requests from legacy application

I have a legacy ASP.NET MVC application that uses pretty standard forms authentication which validates logins against an application database. The scope to change this application is limited, however ...
0
votes
0answers
103 views

C# app and ASP.NET api: validating requests/responses

So I have one C# WPF desktop app (client), which communicates with my web api to login for the user, get info, etc. The C# WPF app will communicate with a hardware device as well. However, there is a ...