Questions tagged [asp.net-core]

For use only on 'ASP.NET Core' related. ASP.NET Core is a lean and composable framework for building web and cloud applications. This is not used for 'ASP.NET Framework'.

Filter by
Sorted by
Tagged with
0 votes
1 answer
92 views

What are the best practices to create a secure ASP.NET app? [closed]

I've read a ton of articles that we need to write applications that are secure. That it's critical to write defensively from the start and implement all best practice secure suggestions. What I can't ...
David Thielen's user avatar
0 votes
0 answers
1k views

Using `react-oidc-context` and storing the `access_token` and `refresh_token` together

I am looking for a "best practises" approach for creating SPAs protected using OIDC + PKCE. Most of our applications are hosted on two independent web servers with a load balancer routing ...
user1913559's user avatar
0 votes
1 answer
631 views

ASP.NET Core - are files put in the Shared folder under Pages (where the Razor pages reside) publicly accessible?

Are files put into the Pages/Shared folder public to the whole WWW if the website is hosted publicly? I am asking since I want to implement a partial view load thru a controller and want to know ...
Munchkin's user avatar
  • 254
-1 votes
1 answer
174 views

Is it ok to use the same SSL certificate (pfx) used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis?

Is it secure enough to use the SSL certificate used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis? Or must I use a separate certificate just for this ...
Jagan's user avatar
  • 99
2 votes
0 answers
138 views

What are these requests that appear to be phoning home?

I have a .NET 5 application running on AWS which has these requests constantly attempting to run: GET http://app-10-irules.com/ GET http://www.simpleexample.com/ GET http://ssl-app-default-backend.com/...
yeahtheboys's user avatar
1 vote
0 answers
94 views

Why is the .NET 5.0 antiforgery byte array length in bits not a common multiple of 6 and 8?

I was learning how antiforgery tokens work behind the scenes and wrote this article on the possible values a token can have. When the byte array is converted to base64, there are four left over bits ...
David Klempfner's user avatar
0 votes
0 answers
533 views

Is Microsoft CVE-2020-1045 a credible threat?

Microsoft released CVE-2020-1045 in September 2020. A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names. The ASP.NET Core cookie parser ...
speciesUnknown's user avatar
2 votes
1 answer
2k views

Is there benefit to an Anti-forgery cookie with sameSite:none?

We have a form that is using asp.net core AntiForgery validation. Recently encountered an issue with a form on the site hosted on www.domain.ie not being able to POST to the API at api.domain.co.uk ...
Fishcake's user avatar
  • 123
1 vote
0 answers
400 views

How is .NET Core isolated storage "secured" on various OS's?

I'm looking for a consolidated list of how and where isolated storage is managed on each operating system... (Windows, MacOS, Linux, (mobile?), ...) Does such a list exist? What considerations might ...
TLDR's user avatar
  • 700
0 votes
0 answers
157 views

2 person 2-factor authentication?

I'm trying to build a system as follows: User 1 is a low permission user. They will be using their phone and at some point will need to do a secure action. User 2 is an admin user and will be in the ...
Simon's user avatar
  • 1
3 votes
2 answers
2k views

Is CSRF prevention logic required for api that is consumed only by mobile app?

I am developing an ASP.NET Core web api project whose only client will be a mobile app developed in Xamarin. There will be no web frontend for the application. Can CSRF attacks be executed if the ...
CristisS's user avatar
  • 133
3 votes
1 answer
251 views

A couple of questions about ASP.Net Core default implementation for login security

By default, ASP.Net Core configures the login exercise with a couple of things that seem strange to me. I'd like someone who knows more about infosec than I to comment on these please. First, it ...
Bob.at.Indigo.Health's user avatar
0 votes
0 answers
236 views

Does Asp.Net Core exposes too much information for required enums that were not supplied?

I have a simple code for an input model: public class MyClass { [Required] public MyEnum? Type { get; set; } } Now if I do not send Type as a part of json to the request, I get this error ...
Ilya Chernomordik's user avatar
1 vote
0 answers
324 views

Using IdentityServer to call API on behalf of a Client not User?

I am thinking of using IdentityServer4 for a new project. I am new to this and have done some reading and seen some of the demo clients in action. Most of the clients in the samples allow login as a ...
AliK's user avatar
  • 111
27 votes
2 answers
5k views

How to avoid using System.String with Rfc2898DeriveBytes in C#

I am creating a .NET core webapp in C# that takes in a user password and hashes it to be stored on a server. I'm using Rfc2898DeriveBytes along with a randomly generated salt. I've read, however, that ...
Jeff's user avatar
  • 373
2 votes
2 answers
5k views

Alternative to bcrypt in .NET Core?

I'm porting an app from Node to ASP.NET Core, and discovered that the .NET Core framework doesn't have a bcrypt implementation. There are community supported bcrypt implementations but they are very ...
lonix's user avatar
  • 445
4 votes
0 answers
126 views

Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core

I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future. A pattern I ...
Mark McGookin's user avatar
3 votes
2 answers
1k views

Why are top-level wildcard bindings unsafe?

Microsoft has the following to say about configuring asp.net core with http.sys: Top-level wildcard bindings (http://*:80/ and http://+:80) should not be used. Top-level wildcard bindings create ...
Voo's user avatar
  • 670
2 votes
1 answer
1k views

My ASP.NET core application executable detected as Trojan

I wanted to copy from a local publish location of my ASP.NET Core project on a production IIS Server, and Windows Defender detected a Trojan in my main executable file. When I scan this folder on my ...
vpetrovic's user avatar
  • 133
3 votes
1 answer
463 views

Why is TLS still commonly referred to as SSL? [duplicate]

I am developing in Visual Studio 2017 and I'm writing an asp.net core 2.0 web application. In the project properties there is a checkbox for Enable SSL. Any idea why this is called SSL instead of TLS? ...
IEnjoyEatingVegetables's user avatar
1 vote
1 answer
717 views

JWT for authentication and authorization and protecting an API. It's feasible / secure?

I'm developing a web application which manages security and hygiene at work so the clients can access information about medical stuff, like exams, reports, accidents, ability to work, things like that....
LuisMorais's user avatar
2 votes
0 answers
203 views

Web application making a call to a REST API when already authenticated

I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
Paul Nearney's user avatar
2 votes
1 answer
1k views

Are there any security risks associated with having static files on the server be publicly available?

I am going to frame this question using ASP.NET Core in mind since that is what I'm using, though my question is applicable to any scenario in which you have a client that makes requests to a server ...
Drew's user avatar
  • 123
0 votes
1 answer
831 views

Requiring e-mail from user when using ASP.NET Identity password reset features

I am implementing ASP.NET Core Identity with IdentityServer4. One feature is password reset, and I found that all the examples (e.g. the IdentityServer4 quick start and the ASP.NET Identity example) ...
Jeroen's user avatar
  • 859
6 votes
2 answers
3k views

Is it ok to write OidC Bearer token to log?

During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive ...
Michael Freidgeim's user avatar
5 votes
1 answer
3k views

ASP.NET - why default SecurityStamp validation interval is set to 30 minutes?

I'm currently studying authentication mechanisms in ASP.NET Core and came across SecurityStamp feature, which is known also from ASP.NET Standard. From what I understand from the answer here, this was ...
PJDev's user avatar
  • 165
-1 votes
2 answers
1k views

.Net Core MVC Clickjacking attack [closed]

How can we prevent a clickjacking attack using iframes etc. in .Net MVC core application?
Rithu Bimasha's user avatar
2 votes
1 answer
593 views

ASP NET Core Identity password reset form prompts for email address

I notice that the default ASP.NET Core Identity templates ask for email address after the reset email notification link has been followed (i.e. the "choose a new password" form in the ResetPassword....
Steve S's user avatar
  • 121
1 vote
1 answer
99 views

How can we guarantee our custom auth implementation to a client?

Context In .Net 4.6 my team used Microsoft's built in authentication/authorization systems primarily through its Owin tools. In .Net Core Microsoft decided NOT to port that segment of tools. So, we ...
rayepps's user avatar
  • 111
0 votes
1 answer
1k views

Secure authentication on SPA/Javascript application with “remember me” support

I have 3 website projects as follows; identity.example.com (asp.netcore + IdentityServer4) api.example.com (asp.netcore webapi) www.example.com (asp.netcore + aurelia) I am able to authenticate the ...
Hasan's user avatar
  • 101
1 vote
1 answer
405 views

encrypted information that is not accessible to database administrators

I work with asp.net core 1 and I will introduce an encrypted storage of user data. These data must not be accessible to the database administrator but only for users with a passphrase. I thought of ...
Sergio's user avatar
  • 11
1 vote
0 answers
189 views

How can I audit the modules and stage markers in OWIN's authentication pipeline?

ASP.NET's OWIN (in MVC4 and Katana) allows for various objects to be added to the HTTP processing pipeline. I want to ensure that there are no rogue Nuget packages no hard to find partial classes ...
makerofthings7's user avatar