Questions tagged [asp.net-mvc]

a web application framework implementing the Model View Controller (MVC) pattern.

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

Is Antiforgery Validation really needed for Login page when external return URL is not allowed?

I fallen in a scenario that User opens two tabs for login page and try to login on both Instead of showing an error message to user (I can't think of a good meaningful message to explain antiforgery ...
user avatar
0 votes
1 answer
173 views

ASP.NET Core - are files put in the Shared folder under Pages (where the Razor pages reside) publicly accessible?

Are files put into the Pages/Shared folder public to the whole WWW if the website is hosted publicly? I am asking since I want to implement a partial view load thru a controller and want to know ...
user avatar
  • 190
6 votes
1 answer
1k views

Passing a C# object to Javascript in ASP.NET MVC

Several answers on StackOverflow suggest that a C# object can be passed to JavaScript in ASP.NET MVC by the following: <script type="text/javascript"> var obj = @Html.Raw(Json....
user avatar
  • 28.5k
0 votes
0 answers
109 views

CWE-915 (overpost/mass assignment) and antiforgery when not saving posted object to storage

Veracode has found overpost or mass-assignment flaws (CWE 915) in our MVC portal. Technically, this is true, but I am wondering how much of an effort we would need to put into this, especially since ...
user avatar
0 votes
0 answers
249 views

prevent dom based - xss from js file in mvc

I'm using a free template as a front end in my application and the main javascript file came out as a high risk as it's vulnerable to a dom based cross site scripting.Is there a way to sanitize the ...
user avatar
  • 1
0 votes
1 answer
152 views

Content-Type and Code Execution

I just got a message from a security guy that my application is executing remote code if they pass a Content-Type: image/asp. For now he does not disclose anything. Now my question is that if I am ...
user avatar
  • 2,449
2 votes
2 answers
100 views

how to deal with with authentication tokens in the client browser and in my database?

I am building an asp .net mvc project and I want to save the user who is currently logged in , So I read about sessions and cookies and I found that authentication tokens stored in a cookies are a ...
user avatar
0 votes
1 answer
150 views

Why ASP.Net Identity sends sensitive information to clients?

As far as I understand, Identity sends to the user an encrypted token with some user information like the user name and expiration date. Then, when a new request arrives to the server, it decrypts it ...
user avatar
  • 123
1 vote
1 answer
141 views

Validating JWT in server-to-auth-server scenario

The main question here is: If you are using a backend server to authenticate a user with a third party provider such as Auth0, do you need to validate the JWT received in this scenario? I am looking ...
user avatar
  • 153
0 votes
1 answer
1k views

How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)?

I have a web application with a log in page. In the log in page, I've set maxlength for the username input and the password input, which looks like the code below. @Html.TextBoxFor(m => m....
user avatar
  • 111
1 vote
0 answers
1k views

Active Directory authentication with a Login form ASP.NET MVC5

I want to create a web application with a login form and authenticate with Active Directory account. Our users sometimes use a device that users cannot log in, so we don't want to use Windows ...
user avatar
  • 11
2 votes
1 answer
1k views

Preventing CSRF with SameSite="strict" without degrading user experience?

ASP.NET will soon begin reflecting Google's decision to default cookies to SameSite="strict" in a defense against CSRF attacks: https://devblogs.microsoft.com/aspnet/upcoming-samesite-cookie-changes-...
user avatar
0 votes
1 answer
316 views

Risks of allowing users to upload PDF and XML files to be stored/retrieved from a DB (ASPNET MVC 5)

I'm modifying an ASPNET MVC 5 web site and a requirement is to allow users to upload an XML and PDF file. The XML file will be used to layout text on the PDF based on variables coming from within the ...
user avatar
1 vote
3 answers
3k views

When is it okay not to use anti-forgery token in login page?

In this post, there is a paragraph that mentions a scenario where there is no need to validate anti-forgery token in login page: When is it OK to leave off the anti-forgery token? In general, if the ...
user avatar
  • 111
2 votes
1 answer
740 views

OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie). While accessing the application I ...
user avatar
3 votes
0 answers
230 views

String Serialization in .NET [closed]

I am currently performing a secure code review of Fortify reported issues and segments of code flagged relates to current session state being stored in memory. By default, the framework .NET ...
user avatar
3 votes
0 answers
406 views

What trivial attacks is ASP.NET MVC mixed-mode auth vulnerable to?

In a 2012 MSDN blog post, Microsoft discourages mixed-mode authentication in ASP.NET MVC for being vulnerable to trivial attacks: The ASP.NET team doesn’t support using mixed-mode authentication in ...
user avatar
1 vote
1 answer
226 views

Hosted Payment Page - Security perspective implementation

We are implementing a .NET MVC application and planning to use a Hosted Payment Page for Secure Payments and from PCI Stand point. Am worried the about the data which we might expose in the return ...
user avatar
  • 113
2 votes
1 answer
127 views

Are there any risks with prepopulating a username from a querystring on a login page?

So, we've got a fairly standard login page on a web application. We want to make a slight change so that if a user gets their password wrong, the page reloads (as it currently does) but the username ...
user avatar
0 votes
2 answers
2k views

Can I trust a session Id for uniqueness?

I have an old ASP classic web app that generates an Id for a user when they log in. The Id is put into an authentication cookie in plain text and also stored in the database. Inside of this website, ...
user avatar
1 vote
2 answers
612 views

Direct Access to Administration Pages ,The web server or application server are configured in an insecure way

Application Security Scan performed on our application using IBM's AppScan standard tool and below issue has been reported. I am a .net developer, and unaware of these security terms. Could somebody ...
user avatar
2 votes
3 answers
3k views

Is it valid to defend an CSRF token against replay (e.g. with a timestamp)?

I have an MVC app that is using the AntiForgeryToken capability of ASP.NET MVC. AFAICT this uses an encrypted synchronizer token variation where it validates the payload of the tokens. A customer has ...
user avatar
  • 127
2 votes
1 answer
196 views

Security considerations for a web application without log in feature

We were told to send an email with a link to the users. The users will get a token in the URL where they will be able to chose some options and post their selection. Example URL: https://example.com/...
user avatar
  • 143
0 votes
1 answer
129 views

HMAC API exposed through public site?

(I also asked this question over on StackOverflow.) What steps can I take to prevent unauthorised access to a method on an unauthenticated controller? Background The diagram below illustrates a ...
user avatar
2 votes
2 answers
2k views

What is the purpose of the default header/cookie in an MVC anti-forgery token?

I've read that the MVC anti-forgery token defeats CSRF attacks by storing security tokens in a form field and then comparing the default header/cookie value sent automatically by the browser to the ...
user avatar
  • 153
1 vote
0 answers
119 views

Minimizing high risk obsolete application entry points

I am working on a .NET MVC based project involving an application with over 50,000 unique entry points. Using our own custom static code analysis built using the .NET reflection libraries we have ...
user avatar
  • 493
3 votes
2 answers
808 views

Manage Browser Cookie Editing for web application in .Net Mvc

I am developing a sensitive web application with .net MVC and I am saving my user credentials after login with cookies. The problem is, one user is able to login with their username and password. ...
user avatar
2 votes
0 answers
522 views

Potential Issues and downfalls of the "honeyPot" in asp.net mvc

Within the last few weeks I have been noticing massive amounts of bot traffic coming out of a small geographical area. I have implemented the robots.txt into my ASP.net project, but as I understand it,...
user avatar
  • 157
1 vote
2 answers
622 views

Potential issues with a HTTPS to HTTP conversion

I am experiencing an issue with certain emails coming from exterior services such as yahoo, and google. Specifically that requested resources can only be accessed via SSL. I found the following ...
user avatar
  • 157
1 vote
1 answer
70 views

Returning parameterised view

So I just came across this nasty looking piece of code. public ActionResult Display(string viewName) { return View(viewName); } I would avoid having that parameter or at least I would get ...
user avatar
1 vote
0 answers
164 views

How can I audit the modules and stage markers in OWIN's authentication pipeline?

ASP.NET's OWIN (in MVC4 and Katana) allows for various objects to be added to the HTTP processing pipeline. I want to ensure that there are no rogue Nuget packages no hard to find partial classes ...
user avatar
2 votes
1 answer
373 views

First time penetration testing code check

In the following scenario the website allows users to upload an excel document that contains information that will be loaded to the database, and stored as values that can later be accessed by the ...
user avatar
  • 157
3 votes
2 answers
2k views

Security risks of file upload-download systems

I know that there are many posts about these topic. But those posts usually talk about restricting the file types and sizes on so on. Hence non serves to my needs as my system does not have any ...
user avatar
1 vote
1 answer
325 views

Securing a Web API in MVC

I've got a simple ASP MVC 6 WebAPI I'm currently working on in which registered users can call request data using a sample of the URL below: http://localhost:7988/api/b8pE5Qodiw/elections/Prop1/Prop2/...
user avatar
  • 113
1 vote
1 answer
1k views

Do IIS / ASP.NET / MVC version headers reveal patch presence?

Quick question: does anyone know whether the IIS / ASP.NET / MVC version headers, like this: Server: Microsoft-IIS/8.5 X-AspNetMvc-Version: 5.2 X-AspNet-Version: 4.0.30319 can be used to determine ...
user avatar
  • 1,311
3 votes
1 answer
1k views

Membership.GeneratePassword

I am looking for a method to generate a onetime password for provisioning purposes in ASP.NET-MVC. I came across the Membership.GeneratePassword which is in the System.Web.Security namespace. Is this ...
user avatar
  • 187
2 votes
1 answer
446 views

Security concerns with an ASP.net server error [duplicate]

Are there any security problems that could arise from a server error generated by ASP.net and being sent to the user? I am aware of the potential issues from sensitive information being sent in the ...
user avatar
  • 23
1 vote
2 answers
1k views

Practical benefit of using SqlCredential vs username/password in connection string

Currently I'm using SQL Server Authentication with the username/password as part of the connection string for my web application. As far as I know this standard procedure within the .NET world and ...
user avatar
  • 303
10 votes
1 answer
29k views

How client certificate works for authentication (in Web API)

I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: http://www.asp.net/web-api/overview/security/working-with-ssl-in-web-...
user avatar
  • 211
19 votes
1 answer
42k views

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

I've made a Web API in ASP.NET that acts as the entry point into a SQL Server database for report data. This service has a "token" endpoint that authenticates a user via ASP Identity and return a 20-...
user avatar
4 votes
3 answers
3k views

How to prevent someone guessing the token in a reset password link

Currently I have the following set-up for handling users that forgot their password. A user types in his/her e-mail address and presses the forgot password button. I look up the user belonging to ...
user avatar
  • 189
2 votes
0 answers
536 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
user avatar
2 votes
2 answers
1k views

Security of an SQL database server used in web app

At my organisation we have a website survey that one of the managers here uses for equality purposes. They designed and implemented the survey in Adobe FormsCentral which is now being retired, so I ...
user avatar
  • 23
1 vote
2 answers
5k views

Table or row level security in ASP.NET MVC 5 and Entity Framework 6

I've already asked this question on Stack Overflow, but no one answered, so maybe it's a more appropriate place to discuss it. Please let me know if I'm wrong and having duplicated question on ...
user avatar
  • 145
4 votes
1 answer
4k views

ASP.NET Machinekey encryption

In Asp.NET you can use the MachineKey.Protect to encrypt data. We are thinking of using this to encrypt some data which will be stored in a hidden fields within a web page, these hidden fields are ...
user avatar
  • 181
1 vote
2 answers
695 views

Separate web and app server windows authentication

I understand that separate web and app server can improve security. Your web server sits in a dmz and then there is firewall between it and the app server. We provide solutions to clients within an ...
user avatar
  • 181
1 vote
1 answer
303 views

User Authentication for a public website in 2015 [closed]

I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...
user avatar
  • 11
3 votes
2 answers
5k views

How to stop revealing web directories in ASP.Net MVC

We have built a web application using ASP.Net MVC3 and SQL Server 2008 which has features like credit card payment, etc. We engaged a 3rd party to perform vulnerability assessment and penetration ...
user avatar
3 votes
1 answer
10k views

MVC 5 and Multiple AntiForgeryTokens: What is happening?

I have a simple login form. In it, I put an AntiForegeryToken. @using (Html.BeginForm("Login", "Account")) { @Html.AntiForgeryToken() <p> <label>Email</label> ...
user avatar
  • 133
0 votes
1 answer
213 views

How to identify hackers based on ip addresses and the pages that were accessed

I saw some suspicious errors being generated on my site based on pages that were requested. My error is logging the path that the user is trying to access. Because of these errors (and the paths that ...
user avatar
  • 103