Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [asp.net-mvc]

a web application framework implementing the Model View Controller (MVC) pattern.

1
vote
0answers
22 views

OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie). While accessing the application I ...
3
votes
0answers
96 views

String Serialization in .NET [closed]

I am currently performing a secure code review of Fortify reported issues and segments of code flagged relates to current session state being stored in memory. By default, the framework .NET ...
2
votes
0answers
139 views

What trivial attacks is ASP.NET MVC mixed-mode auth vulnerable to?

In a 2012 MSDN blog post, Microsoft discourages mixed-mode authentication in ASP.NET MVC for being vulnerable to trivial attacks: The ASP.NET team doesn’t support using mixed-mode authentication in ...
1
vote
1answer
91 views

Hosted Payment Page - Security perspective implementation

We are implementing a .NET MVC application and planning to use a Hosted Payment Page for Secure Payments and from PCI Stand point. Am worried the about the data which we might expose in the return ...
2
votes
1answer
65 views

Are there any risks with prepopulating a username from a querystring on a login page?

So, we've got a fairly standard login page on a web application. We want to make a slight change so that if a user gets their password wrong, the page reloads (as it currently does) but the username ...
0
votes
2answers
215 views

Can I trust a session Id for uniqueness?

I have an old ASP classic web app that generates an Id for a user when they log in. The Id is put into an authentication cookie in plain text and also stored in the database. Inside of this website, ...
1
vote
2answers
253 views

Direct Access to Administration Pages ,The web server or application server are configured in an insecure way

Application Security Scan performed on our application using IBM's AppScan standard tool and below issue has been reported. I am a .net developer, and unaware of these security terms. Could somebody ...
1
vote
2answers
498 views

Is it valid to defend an CSRF token against replay (e.g. with a timestamp)?

I have an MVC app that is using the AntiForgeryToken capability of ASP.NET MVC. AFAICT this uses an encrypted synchronizer token variation where it validates the payload of the tokens. A customer has ...
2
votes
1answer
114 views

Security considerations for a web application without log in feature

We were told to send an email with a link to the users. The users will get a token in the URL where they will be able to chose some options and post their selection. Example URL: https://example.com/...
0
votes
1answer
57 views

HMAC API exposed through public site?

(I also asked this question over on StackOverflow.) What steps can I take to prevent unauthorised access to a method on an unauthenticated controller? Background The diagram below illustrates a ...
2
votes
2answers
1k views

What is the purpose of the default header/cookie in an MVC anti-forgery token?

I've read that the MVC anti-forgery token defeats CSRF attacks by storing security tokens in a form field and then comparing the default header/cookie value sent automatically by the browser to the ...
1
vote
0answers
82 views

Minimizing high risk obsolete application entry points

I am working on a .NET MVC based project involving an application with over 50,000 unique entry points. Using our own custom static code analysis built using the .NET reflection libraries we have ...
3
votes
2answers
440 views

Manage Browser Cookie Editing for web application in .Net Mvc

I am developing a sensitive web application with .net MVC and I am saving my user credentials after login with cookies. The problem is, one user is able to login with their username and password. ...
2
votes
0answers
201 views

Potential Issues and downfalls of the “honeyPot” in asp.net mvc

Within the last few weeks I have been noticing massive amounts of bot traffic coming out of a small geographical area. I have implemented the robots.txt into my ASP.net project, but as I understand it,...
1
vote
2answers
356 views

Potential issues with a HTTPS to HTTP conversion

I am experiencing an issue with certain emails coming from exterior services such as yahoo, and google. Specifically that requested resources can only be accessed via SSL. I found the following ...
1
vote
1answer
36 views

Returning parameterised view

So I just came across this nasty looking piece of code. public ActionResult Display(string viewName) { return View(viewName); } I would avoid having that parameter or at least I would get ...
1
vote
0answers
94 views

How can I audit the modules and stage markers in OWIN's authentication pipeline?

ASP.NET's OWIN (in MVC4 and Katana) allows for various objects to be added to the HTTP processing pipeline. I want to ensure that there are no rogue Nuget packages no hard to find partial classes ...
3
votes
1answer
205 views

First time penetration testing code check

In the following scenario the website allows users to upload an excel document that contains information that will be loaded to the database, and stored as values that can later be accessed by the ...
3
votes
2answers
2k views

Security risks of file upload-download systems

I know that there are many posts about these topic. But those posts usually talk about restricting the file types and sizes on so on. Hence non serves to my needs as my system does not have any ...
1
vote
1answer
219 views

Securing a Web API in MVC

I've got a simple ASP MVC 6 WebAPI I'm currently working on in which registered users can call request data using a sample of the URL below: http://localhost:7988/api/b8pE5Qodiw/elections/Prop1/Prop2/...
1
vote
1answer
744 views

Do IIS / ASP.NET / MVC version headers reveal patch presence?

Quick question: does anyone know whether the IIS / ASP.NET / MVC version headers, like this: Server: Microsoft-IIS/8.5 X-AspNetMvc-Version: 5.2 X-AspNet-Version: 4.0.30319 can be used to determine ...
3
votes
1answer
566 views

Membership.GeneratePassword

I am looking for a method to generate a onetime password for provisioning purposes in ASP.NET-MVC. I came across the Membership.GeneratePassword which is in the System.Web.Security namespace. Is this ...
2
votes
1answer
145 views

Security concerns with an ASP.net server error [duplicate]

Are there any security problems that could arise from a server error generated by ASP.net and being sent to the user? I am aware of the potential issues from sensitive information being sent in the ...
1
vote
2answers
575 views

Practical benefit of using SqlCredential vs username/password in connection string

Currently I'm using SQL Server Authentication with the username/password as part of the connection string for my web application. As far as I know this standard procedure within the .NET world and ...
5
votes
1answer
19k views

How client certificate works for authentication (in Web API)

I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: http://www.asp.net/web-api/overview/security/working-with-ssl-in-web-...
17
votes
1answer
30k views

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

I've made a Web API in ASP.NET that acts as the entry point into a SQL Server database for report data. This service has a "token" endpoint that authenticates a user via ASP Identity and return a 20-...
1
vote
3answers
2k views

How to prevent someone guessing the token in a reset password link

Currently I have the following set-up for handling users that forgot their password. A user types in his/her e-mail address and presses the forgot password button. I look up the user belonging to ...
2
votes
0answers
469 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
2
votes
2answers
1k views

Security of an SQL database server used in web app

At my organisation we have a website survey that one of the managers here uses for equality purposes. They designed and implemented the survey in Adobe FormsCentral which is now being retired, so I ...
1
vote
2answers
4k views

Table or row level security in ASP.NET MVC 5 and Entity Framework 6

I've already asked this question on Stack Overflow, but no one answered, so maybe it's a more appropriate place to discuss it. Please let me know if I'm wrong and having duplicated question on ...
3
votes
1answer
2k views

ASP.NET Machinekey encryption

In Asp.NET you can use the MachineKey.Protect to encrypt data. We are thinking of using this to encrypt some data which will be stored in a hidden fields within a web page, these hidden fields are ...
1
vote
2answers
533 views

Separate web and app server windows authentication

I understand that separate web and app server can improve security. Your web server sits in a dmz and then there is firewall between it and the app server. We provide solutions to clients within an ...
1
vote
1answer
244 views

User Authentication for a public website in 2015 [closed]

I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...
3
votes
2answers
3k views

How to stop revealing web directories in ASP.Net MVC

We have built a web application using ASP.Net MVC3 and SQL Server 2008 which has features like credit card payment, etc. We engaged a 3rd party to perform vulnerability assessment and penetration ...
3
votes
1answer
8k views

MVC 5 and Multiple AntiForgeryTokens: What is happening?

I have a simple login form. In it, I put an AntiForegeryToken. @using (Html.BeginForm("Login", "Account")) { @Html.AntiForgeryToken() <p> <label>Email</label> ...
0
votes
1answer
171 views

How to identify hackers based on ip addresses and the pages that were accessed

I saw some suspicious errors being generated on my site based on pages that were requested. My error is logging the path that the user is trying to access. Because of these errors (and the paths that ...
0
votes
1answer
96 views

Is sharing the Membership Provider with other devs a security risk?

I hope this is a good place for this, but I am looking to be safe while sharing my ASP MVC project. If a page was designed with a membership provider is is possible to share this project with out ...
3
votes
2answers
2k views

How to stop Forced browsing ? - Saving information from being compromised by url change

I have a ASP.NET MVC 4 application. In some webpages or views, I have information displayed in table. Column values are rendered as links. Problems: 1. When I hover over the link, it's URL is ...
0
votes
2answers
3k views

Malicious query string removal ASP.Net MVC5

My web application is built with ASP.Net MVC5. One of the method accept query string params. Security testing has reported that it accepts malicious query string and displays in the body without any ...
4
votes
2answers
3k views

Windows Authentication and Session Ids

After a penetration test made upon an intranet application I'm developing, in ASP.NET MVC, one of the concerns raised was that the application supports concurrent user sessions and it is recommended ...
4
votes
3answers
441 views

Can a mismatched server encoding on HTTP POST or GET result in a security issue?

It is possible for a server to parse HTTP POST and GET data with a fixed encoding or one that is dynamic with the client's response. Consider the situation where a client uses UTF7,32 or any other ...
1
vote
2answers
2k views

How should developers handle Form POST variables that conflict with route variables?

In ASP.NET MVC, when I perform a HTTP post to /controller/action/UserID ... and have a corresponding route /controller/action/{UserID} ... and if I do a Form POST, the POSTed data UserID ...
9
votes
1answer
8k views

Drawbacks of storing an authentication token on the client side?

I am working on an ASP.NET MVC web application, which fetches its data from an API in the back. So authentication is currently done via ASP.NET Forms Authentication, which means the client sends email ...
0
votes
1answer
267 views

CSRF mitigation in MVC

I'm wondering about the best way to protect against CSRF in MVC or any other stateless web app. Due to the stateless nature, we can not keep a secret token in the session and compare it to the secret ...
11
votes
2answers
2k views

What unique risks does MVC model binding bring to a website? What additional vigilance is needed?

From what I understand, "model binding" is where a website based on ASP.NET MVC or Ruby on Rails (there are others...) takes parameters in HTTP's GET statement and passes them as variables to code ...
1
vote
1answer
201 views

How does window.w3ssss hack occur

Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site. While we have cleaned it up, I have not been able to ...
8
votes
2answers
26k views

Javascript and jQuery not secure over https

I am building an ASP.NET MVC 3 app which will run in Azure. Everything was working well, until I switched to https. Now most of my jQuery plugins and some other javascript are not secure. I'm using ...
3
votes
2answers
184 views

Website file being altered

I have recently had random spam links inserted into 3 ASP.NET websites. The links are inserted into the physical file so it is not SQL injection attack. The websites have very little in common other ...
2
votes
1answer
615 views

What threats does a stateless web application have? (as opposed to a “state-full” sessions)

I'm comparing the pros and cons between having an authenticated "stateless" ASP.NET MVC session versus a ASP.NET Forms application with viewstate. Assuming that there is a webfarm of more than 1 web ...
13
votes
2answers
17k views

Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?

If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this? What is the extent and ...