The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
0answers
15 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as ...
2
votes
2answers
73 views

Security of an SQL database server used in web app

At my organisation we have a website survey that one of the managers here uses for equality purposes. They designed and implemented the survey in Adobe FormsCentral which is now being retired, so I ...
0
votes
2answers
224 views

Table or row level security in ASP.NET MVC 5 and Entity Framework 6

I've already asked this question on Stack Overflow, but no one answered, so maybe it's a more appropriate place to discuss it. Please let me know if I'm wrong and having duplicated question on ...
1
vote
1answer
77 views

ASP.NET Machinekey encryption

In Asp.NET you can use the MachineKey.Protect to encrypt data. We are thinking of using this to encrypt some data which will be stored in a hidden fields within a web page, these hidden fields are ...
0
votes
2answers
56 views

Separate web and app server windows authentication

I understand that separate web and app server can improve security. Your web server sits in a dmz and then there is firewall between it and the app server. We provide solutions to clients within an ...
1
vote
1answer
144 views

User Authentication for a public website in 2015 [closed]

I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...
2
votes
2answers
291 views

How to stop revealing web directories in ASP.Net MVC

We have built a web application using ASP.Net MVC3 and SQL Server 2008 which has features like credit card payment, etc. We engaged a 3rd party to perform vulnerability assessment and penetration ...
2
votes
1answer
462 views

MVC 5 and Multiple AntiForgeryTokens: What is happening?

I have a simple login form. In it, I put an AntiForegeryToken. @using (Html.BeginForm("Login", "Account")) { @Html.AntiForgeryToken() <p> <label>Email</label> ...
0
votes
1answer
117 views

How to identify hackers based on ip addresses and the pages that were accessed

I saw some suspicious errors being generated on my site based on pages that were requested. My error is logging the path that the user is trying to access. Because of these errors (and the paths that ...
0
votes
1answer
75 views

Is sharing the Membership Provider with other devs a security risk?

I hope this is a good place for this, but I am looking to be safe while sharing my ASP MVC project. If a page was designed with a membership provider is is possible to share this project with out ...
2
votes
2answers
676 views

How to stop Forced browsing ? - Saving information from being compromised by url change

I have a ASP.NET MVC 4 application. In some webpages or views, I have information displayed in table. Column values are rendered as links. Problems: 1. When I hover over the link, it's URL is ...
0
votes
2answers
949 views

Malicious query string removal ASP.Net MVC5

My web application is built with ASP.Net MVC5. One of the method accept query string params. Security testing has reported that it accepts malicious query string and displays in the body without any ...
4
votes
2answers
1k views

Windows Authentication and Session Ids

After a penetration test made upon an intranet application I'm developing, in ASP.NET MVC, one of the concerns raised was that the application supports concurrent user sessions and it is recommended ...
3
votes
3answers
288 views

Can a mismatched server encoding on HTTP POST or GET result in a security issue?

It is possible for a server to parse HTTP POST and GET data with a fixed encoding or one that is dynamic with the client's response. Consider the situation where a client uses UTF7,32 or any other ...
1
vote
2answers
549 views

How should developers handle Form POST variables that conflict with route variables?

In ASP.NET MVC, when I perform a HTTP post to /controller/action/UserID ... and have a corresponding route /controller/action/{UserID} ... and if I do a Form POST, the POSTed data UserID ...
7
votes
1answer
5k views

Drawbacks of storing an authentication token on the client side?

I am working on an ASP.NET MVC web application, which fetches its data from an API in the back. So authentication is currently done via ASP.NET Forms Authentication, which means the client sends email ...
0
votes
1answer
213 views

CSRF mitigation in MVC

I'm wondering about the best way to protect against CSRF in MVC or any other stateless web app. Due to the stateless nature, we can not keep a secret token in the session and compare it to the secret ...
8
votes
2answers
1k views

What unique risks does MVC model binding bring to a website? What additional vigilance is needed?

From what I understand, "model binding" is where a website based on ASP.NET MVC or Ruby on Rails (there are others...) takes parameters in HTTP's GET statement and passes them as variables to code ...
1
vote
1answer
153 views

How does window.w3ssss hack occur

Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site. While we have cleaned it up, I have not been able to ...
7
votes
2answers
18k views

Javascript and jQuery not secure over https

I am building an ASP.NET MVC 3 app which will run in Azure. Everything was working well, until I switched to https. Now most of my jQuery plugins and some other javascript are not secure. I'm using ...
3
votes
2answers
148 views

Website file being altered

I have recently had random spam links inserted into 3 ASP.NET websites. The links are inserted into the physical file so it is not SQL injection attack. The websites have very little in common other ...
2
votes
1answer
443 views

What threats does a stateless web application have? (as opposed to a “state-full” sessions)

I'm comparing the pros and cons between having an authenticated "stateless" ASP.NET MVC session versus a ASP.NET Forms application with viewstate. Assuming that there is a webfarm of more than 1 web ...
10
votes
2answers
9k views

Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?

If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this? What is the extent and ...
41
votes
2answers
13k views

When the use of a AntiForgeryToken is not required /needed?

I'm running a rather large site with thousands of visits every day, and a rather large userbase. Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...
4
votes
1answer
282 views

What are the implementation details and rationale of ASP.NET MVC3's AntiForgeryToken?

The AntiForgeryToken is used to prevent CSRF attacks, however the links on MSDN don't give me much insight to what exactly the AntiForgeryToken does, or how it works, or why things are done the way ...
5
votes
2answers
2k views

Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation

I'm hesitant to implement the proposed anti-JSON hijacking solutions since The recommended solutions to mitigating JSON hijacking involve non-REST-full JSON POSTs to GET data The alternate ...
6
votes
3answers
1k views

What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?

I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional. My intent is to gracefully ...