Questions tagged [asp.net-mvc]
a web application framework implementing the Model View Controller (MVC) pattern.
69 questions
4
votes
3
answers
420
views
Using ID token for role-base authorization in ASP.NET Core MVC
We have an ASP.NET Core MVC web application that signs in users (assuming that this is the correct app type). It is pretty simple, users can sign-in via their Entra ID account. Within Entra ID they ...
- 143
0
votes
1
answer
985
views
Is the .AspNet.Application cookie vulnerable to CSRF attacks?
I have an MVC application that has undergone SAST. The scan detects a potential XSRF/CSRF vulnerability.
The application rewrites the .AspNet.ApplicationCookie setting SameSite=Strict:
protected void ...
0
votes
1
answer
741
views
ASP.NET Core - are files put in the Shared folder under Pages (where the Razor pages reside) publicly accessible?
Are files put into the Pages/Shared folder public to the whole WWW if the website is hosted publicly? I am asking since I want to implement a partial view load thru a controller and want to know ...
- 264
9
votes
2
answers
10k
views
Passing a C# object to Javascript in ASP.NET MVC
Several answers on StackOverflow suggest that a C# object can be passed to JavaScript in ASP.NET MVC by the following:
<script type="text/javascript">
var obj = @Html.Raw(Json....
- 34.4k
0
votes
0
answers
525
views
CWE-915 (overpost/mass assignment) and antiforgery when not saving posted object to storage
Veracode has found overpost or mass-assignment flaws (CWE 915) in our MVC portal. Technically, this is true, but I am wondering how much of an effort we would need to put into this, especially since ...
- 103
0
votes
0
answers
470
views
prevent dom based - xss from js file in mvc
I'm using a free template as a front end in my application and the main javascript file came out as a high risk as it's vulnerable to a dom based cross site scripting.Is there a way to sanitize the ...
- 1
0
votes
2
answers
606
views
Content-Type and Code Execution
I just got a message from a security guy that my application is executing remote code if they pass a Content-Type: image/asp. For now he does not disclose anything. Now my question is that if I am ...
2
votes
2
answers
152
views
how to deal with with authentication tokens in the client browser and in my database?
I am building an asp .net mvc project and I want to save the user who is currently logged in , So I read about sessions and cookies and I found that authentication tokens stored in a cookies are a ...
- 23
0
votes
1
answer
216
views
Why ASP.Net Identity sends sensitive information to clients?
As far as I understand, Identity sends to the user an encrypted token with some user information like the user name and expiration date. Then, when a new request arrives to the server, it decrypts it ...
- 123
1
vote
1
answer
208
views
Validating JWT in server-to-auth-server scenario
The main question here is: If you are using a backend server to authenticate a user with a third party provider such as Auth0, do you need to validate the JWT received in this scenario?
I am looking ...
- 153
1
vote
1
answer
2k
views
How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)?
I have a web application with a log in page.
In the log in page, I've set maxlength for the username input and the password input, which looks like the code below.
@Html.TextBoxFor(m => m....
- 121
1
vote
0
answers
1k
views
Active Directory authentication with a Login form ASP.NET MVC5
I want to create a web application with a login form and authenticate with Active Directory account. Our users sometimes use a device that users cannot log in, so we don't want to use Windows ...
- 11
2
votes
1
answer
2k
views
Preventing CSRF with SameSite="strict" without degrading user experience?
ASP.NET will soon begin reflecting Google's decision to default cookies to SameSite="strict" in a defense against CSRF attacks:
https://devblogs.microsoft.com/aspnet/upcoming-samesite-cookie-changes-...
- 123
0
votes
1
answer
653
views
Risks of allowing users to upload PDF and XML files to be stored/retrieved from a DB (ASPNET MVC 5)
I'm modifying an ASPNET MVC 5 web site and a requirement is to allow users to upload an XML and PDF file.
The XML file will be used to layout text on the PDF based on variables coming from within the ...
- 101
1
vote
3
answers
4k
views
When is it okay not to use anti-forgery token in login page?
In this post, there is a paragraph that mentions a scenario where there is no need to validate anti-forgery token in login page:
When is it OK to leave off the anti-forgery token? In general, if the ...
- 111
2
votes
1
answer
2k
views
OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]
In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie).
While accessing the application I ...
- 121
3
votes
0
answers
277
views
String Serialization in .NET [closed]
I am currently performing a secure code review of Fortify reported issues and segments of code flagged relates to current session state being stored in memory.
By default, the framework .NET ...
- 39
3
votes
0
answers
475
views
What trivial attacks is ASP.NET MVC mixed-mode auth vulnerable to?
In a 2012 MSDN blog post, Microsoft discourages mixed-mode authentication in
ASP.NET MVC for being vulnerable to trivial attacks:
The ASP.NET team doesn’t support using mixed-mode authentication in ...
- 130
1
vote
1
answer
300
views
Hosted Payment Page - Security perspective implementation
We are implementing a .NET MVC application and planning to use a Hosted Payment Page for Secure Payments and from PCI Stand point.
Am worried the about the data which we might expose in the return ...
- 113
2
votes
1
answer
170
views
Are there any risks with prepopulating a username from a querystring on a login page?
So, we've got a fairly standard login page on a web application.
We want to make a slight change so that if a user gets their password wrong, the page reloads (as it currently does) but the username ...
- 121
0
votes
2
answers
3k
views
Can I trust a session Id for uniqueness?
I have an old ASP classic web app that generates an Id for a user when they log in. The Id is put into an authentication cookie in plain text and also stored in the database.
Inside of this website, ...
- 1,177
1
vote
2
answers
778
views
Direct Access to Administration Pages ,The web server or application server are configured in an insecure way
Application Security Scan performed on our application using IBM's AppScan standard tool and below issue has been reported. I am a .net developer, and unaware of these security terms. Could somebody ...
- 11
2
votes
3
answers
4k
views
Is it valid to defend an CSRF token against replay (e.g. with a timestamp)?
I have an MVC app that is using the AntiForgeryToken capability of ASP.NET MVC. AFAICT this uses an encrypted synchronizer token variation where it validates the payload of the tokens.
A customer has ...
- 127
2
votes
1
answer
241
views
Security considerations for a web application without log in feature
We were told to send an email with a link to the users. The users will get a token in the URL where they will be able to chose some options and post their selection. Example URL: https://example.com/...
- 143
0
votes
1
answer
175
views
HMAC API exposed through public site?
(I also asked this question over on StackOverflow.)
What steps can I take to prevent unauthorised access to a method on an unauthenticated controller?
Background
The diagram below illustrates a ...
- 125
2
votes
2
answers
2k
views
What is the purpose of the default header/cookie in an MVC anti-forgery token?
I've read that the MVC anti-forgery token defeats CSRF attacks by storing security tokens in a form field and then comparing the default header/cookie value sent automatically by the browser to the ...
- 153
1
vote
0
answers
149
views
Minimizing high risk obsolete application entry points
I am working on a .NET MVC based project involving an application with over 50,000 unique entry points.
Using our own custom static code analysis built using the .NET reflection libraries we have ...
- 525
3
votes
2
answers
1k
views
Manage Browser Cookie Editing for web application in .Net Mvc
I am developing a sensitive web application with .net MVC and I am saving my user credentials after login with cookies.
The problem is, one user is able to login with their username and password. ...
- 31
2
votes
0
answers
646
views
Potential Issues and downfalls of the "honeyPot" in asp.net mvc
Within the last few weeks I have been noticing massive amounts of bot traffic coming out of a small geographical area. I have implemented the robots.txt into my ASP.net project, but as I understand it,...
- 157
1
vote
2
answers
655
views
Potential issues with a HTTPS to HTTP conversion
I am experiencing an issue with certain emails coming from exterior services such as yahoo, and google. Specifically that requested resources can only be accessed via SSL. I found the following ...
- 157
1
vote
1
answer
100
views
Returning parameterised view
So I just came across this nasty looking piece of code.
public ActionResult Display(string viewName)
{
return View(viewName);
}
I would avoid having that parameter or at least I would get ...
- 13
1
vote
0
answers
204
views
How can I audit the modules and stage markers in OWIN's authentication pipeline?
ASP.NET's OWIN (in MVC4 and Katana) allows for various objects to be added to the HTTP processing pipeline.
I want to ensure that there are
no rogue Nuget packages
no hard to find partial classes ...
- 51.1k
2
votes
1
answer
529
views
First time penetration testing code check
In the following scenario the website allows users to upload an excel document that contains information that will be loaded to the database, and stored as values that can later be accessed by the ...
- 157
4
votes
2
answers
3k
views
Security risks of file upload-download systems
I know that there are many posts about these topic. But those posts usually talk about restricting the file types and sizes on so on. Hence non serves to my needs as my system does not have any ...
- 141
1
vote
1
answer
360
views
Securing a Web API in MVC
I've got a simple ASP MVC 6 WebAPI I'm currently working on in which registered users can call request data using a sample of the URL below:
http://localhost:7988/api/b8pE5Qodiw/elections/Prop1/Prop2/...
- 113
1
vote
1
answer
2k
views
Do IIS / ASP.NET / MVC version headers reveal patch presence?
Quick question: does anyone know whether the IIS / ASP.NET / MVC version headers, like this:
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.2
X-AspNet-Version: 4.0.30319
can be used to determine ...
- 1,361
3
votes
1
answer
2k
views
Membership.GeneratePassword
I am looking for a method to generate a onetime password for provisioning purposes in ASP.NET-MVC. I came across the Membership.GeneratePassword which is in the System.Web.Security namespace. Is this ...
- 187
2
votes
1
answer
610
views
Security concerns with an ASP.net server error [duplicate]
Are there any security problems that could arise from a server error generated by ASP.net and being sent to the user? I am aware of the potential issues from sensitive information being sent in the ...
- 23
1
vote
2
answers
2k
views
Practical benefit of using SqlCredential vs username/password in connection string
Currently I'm using SQL Server Authentication with the username/password as part of the connection string for my web application. As far as I know this standard procedure within the .NET world and ...
- 303
10
votes
1
answer
30k
views
How client certificate works for authentication (in Web API)
I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: http://www.asp.net/web-api/overview/security/working-with-ssl-in-web-...
- 211
19
votes
1
answer
45k
views
Where to store access and refresh tokens on ASP.NET client web app - calling a REST API
I've made a Web API in ASP.NET that acts as the entry point into a SQL Server database for report data. This service has a "token" endpoint that authenticates a user via ASP Identity and return a 20-...
- 291
4
votes
3
answers
3k
views
How to prevent someone guessing the token in a reset password link
Currently I have the following set-up for handling users that forgot their password.
A user types in his/her e-mail address and presses the forgot password button.
I look up the user belonging to ...
- 189
2
votes
0
answers
562
views
Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)
XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
- 51.1k
2
votes
2
answers
2k
views
Security of an SQL database server used in web app
At my organisation we have a website survey that one of the managers here uses for equality purposes. They designed and implemented the survey in Adobe FormsCentral which is now being retired, so I ...
- 23
1
vote
2
answers
5k
views
Table or row level security in ASP.NET MVC 5 and Entity Framework 6
I've already asked this question on Stack Overflow, but no one answered, so maybe it's a more appropriate place to discuss it. Please let me know if I'm wrong and having duplicated question on ...
- 145
4
votes
1
answer
5k
views
ASP.NET Machinekey encryption
In Asp.NET you can use the MachineKey.Protect to encrypt data. We are thinking of using this to encrypt some data which will be stored in a hidden fields within a web page, these hidden fields are ...
- 181
1
vote
2
answers
750
views
Separate web and app server windows authentication
I understand that separate web and app server can improve security. Your web server sits in a dmz and then there is firewall between it and the app server.
We provide solutions to clients within an ...
- 181
2
votes
1
answer
328
views
User Authentication for a public website in 2015 [closed]
I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...
- 21
3
votes
2
answers
5k
views
How to stop revealing web directories in ASP.Net MVC
We have built a web application using ASP.Net MVC3 and SQL Server 2008 which has features like credit card payment, etc. We engaged a 3rd party to perform vulnerability assessment and penetration ...
- 31
3
votes
1
answer
11k
views
MVC 5 and Multiple AntiForgeryTokens: What is happening?
I have a simple login form. In it, I put an AntiForegeryToken.
@using (Html.BeginForm("Login", "Account"))
{
@Html.AntiForgeryToken()
<p>
<label>Email</label>
...
- 133