Questions tagged [asp.net-core]

For use only on 'ASP.NET Core' related. ASP.NET Core is a lean and composable framework for building web and cloud applications. This is not used for 'ASP.NET Framework'.

Filter by
Sorted by
Tagged with
27
votes
2answers
4k views

How to avoid using System.String with Rfc2898DeriveBytes in C#

I am creating a .NET core webapp in C# that takes in a user password and hashes it to be stored on a server. I'm using Rfc2898DeriveBytes along with a randomly generated salt. I've read, however, that ...
0
votes
1answer
393 views

Alternative to bcrypt in .NET Core?

I'm porting an app from Node to ASP.NET Core, and discovered that the .NET Core framework doesn't have a bcrypt implementation. There are community supported bcrypt implementations but they are very ...
3
votes
0answers
48 views

Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core

I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future. A pattern I ...
1
vote
2answers
173 views

Why are top-level wildcard bindings unsafe?

Microsoft has the following to say about configuring asp.net core with http.sys: Top-level wildcard bindings (http://*:80/ and http://+:80) should not be used. Top-level wildcard bindings create ...
2
votes
1answer
192 views

My ASP.NET core application executable detected as Trojan

I wanted to copy from a local publish location of my ASP.NET Core project on a production IIS Server, and Windows Defender detected a Trojan in my main executable file. When I scan this folder on my ...
3
votes
1answer
250 views

Why is TLS still commonly referred to as SSL? [duplicate]

I am developing in Visual Studio 2017 and I'm writing an asp.net core 2.0 web application. In the project properties there is a checkbox for Enable SSL. Any idea why this is called SSL instead of TLS? ...
1
vote
1answer
521 views

JWT for authentication and authorization and protecting an API. It's feasible / secure?

I'm developing a web application which manages security and hygiene at work so the clients can access information about medical stuff, like exams, reports, accidents, ability to work, things like that....
2
votes
0answers
133 views

Web application making a call to a REST API when already authenticated

I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
1
vote
1answer
112 views

Are there any security risks associated with having static files on the server be publicly available?

I am going to frame this question using ASP.NET Core in mind since that is what I'm using, though my question is applicable to any scenario in which you have a client that makes requests to a server ...
0
votes
1answer
425 views

Requiring e-mail from user when using ASP.NET Identity password reset features

I am implementing ASP.NET Core Identity with IdentityServer4. One feature is password reset, and I found that all the examples (e.g. the IdentityServer4 quick start and the ASP.NET Identity example) ...
4
votes
2answers
641 views

Is it ok to write OidC Bearer token to log?

During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive ...
4
votes
1answer
666 views

ASP.NET - why default SecurityStamp validation interval is set to 30 minutes?

I'm currently studying authentication mechanisms in ASP.NET Core and came across SecurityStamp feature, which is known also from ASP.NET Standard. From what I understand from the answer here, this was ...
-2
votes
2answers
715 views

.Net Core MVC Clickjacking attack [closed]

How can we prevent a clickjacking attack using iframes etc. in .Net MVC core application?
2
votes
1answer
457 views

ASP NET Core Identity password reset form prompts for email address

I notice that the default ASP.NET Core Identity templates ask for email address after the reset email notification link has been followed (i.e. the "choose a new password" form in the ResetPassword....
1
vote
1answer
36 views

How can we guarantee our custom auth implementation to a client?

Context In .Net 4.6 my team used Microsoft's built in authentication/authorization systems primarily through its Owin tools. In .Net Core Microsoft decided NOT to port that segment of tools. So, we ...
0
votes
1answer
797 views

Secure authentication on SPA/Javascript application with “remember me” support

I have 3 website projects as follows; identity.example.com (asp.netcore + IdentityServer4) api.example.com (asp.netcore webapi) www.example.com (asp.netcore + aurelia) I am able to authenticate the ...
1
vote
1answer
108 views

encrypted information that is not accessible to database administrators

I work with asp.net core 1 and I will introduce an encrypted storage of user data. These data must not be accessible to the database administrator but only for users with a passphrase. I thought of ...
1
vote
0answers
109 views

How can I audit the modules and stage markers in OWIN's authentication pipeline?

ASP.NET's OWIN (in MVC4 and Katana) allows for various objects to be added to the HTTP processing pipeline. I want to ensure that there are no rogue Nuget packages no hard to find partial classes ...