Questions tagged [asp.net-mvc]
a web application framework implementing the Model View Controller (MVC) pattern.
68
questions
0
votes
1
answer
150
views
Is sharing the Membership Provider with other devs a security risk?
I hope this is a good place for this, but I am looking to be safe while sharing my ASP MVC project. If a page was designed with a membership provider is is possible to share this project with out ...
3
votes
2
answers
5k
views
How to stop Forced browsing ? - Saving information from being compromised by url change
I have a ASP.NET MVC 4 application.
In some webpages or views, I have information displayed in table. Column values are rendered as links.
Problems:
1. When I hover over the link, it's URL is ...
- 33
0
votes
2
answers
7k
views
Malicious query string removal ASP.Net MVC5
My web application is built with ASP.Net MVC5. One of the method accept query string params. Security testing has reported that it accepts malicious query string and displays in the body without any ...
- 101
4
votes
2
answers
4k
views
Windows Authentication and Session Ids
After a penetration test made upon an intranet application I'm developing, in ASP.NET MVC, one of the concerns raised was that the application supports concurrent user sessions and it is recommended ...
- 215
4
votes
3
answers
709
views
Can a mismatched server encoding on HTTP POST or GET result in a security issue?
It is possible for a server to parse HTTP POST and GET data with a fixed encoding or one that is dynamic with the client's response.
Consider the situation where a client uses UTF7,32 or any other ...
- 50.9k
1
vote
2
answers
2k
views
How should developers handle Form POST variables that conflict with route variables?
In ASP.NET MVC, when I perform a HTTP post to /controller/action/UserID ...
and have a corresponding route /controller/action/{UserID} ...
and if I do a Form POST, the POSTed data UserID ...
- 50.9k
10
votes
1
answer
9k
views
Drawbacks of storing an authentication token on the client side?
I am working on an ASP.NET MVC web application, which fetches its data from an API in the back. So authentication is currently done via ASP.NET Forms Authentication, which means the client sends email ...
- 233
0
votes
1
answer
336
views
CSRF mitigation in MVC
I'm wondering about the best way to protect against CSRF in MVC or any other stateless web app. Due to the stateless nature, we can not keep a secret token in the session and compare it to the secret ...
- 21
11
votes
2
answers
3k
views
What unique risks does MVC model binding bring to a website? What additional vigilance is needed?
From what I understand, "model binding" is where a website based on ASP.NET MVC or Ruby on Rails (there are others...) takes parameters in HTTP's GET statement and passes them as variables to code ...
- 50.9k
1
vote
1
answer
263
views
How does window.w3ssss hack occur
Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site.
While we have cleaned it up, I have not been able to ...
- 13
8
votes
2
answers
29k
views
Javascript and jQuery not secure over https
I am building an ASP.NET MVC 3 app which will run in Azure. Everything was working well, until I switched to https. Now most of my jQuery plugins and some other javascript are not secure.
I'm using ...
- 183
3
votes
2
answers
247
views
Website file being altered
I have recently had random spam links inserted into 3 ASP.NET websites. The links are inserted into the physical file so it is not SQL injection attack.
The websites have very little in common other ...
- 131
2
votes
1
answer
894
views
What threats does a stateless web application have? (as opposed to a "state-full" sessions)
I'm comparing the pros and cons between having an authenticated "stateless" ASP.NET MVC session versus a ASP.NET Forms application with viewstate.
Assuming that there is a webfarm of more ...
- 50.9k
15
votes
2
answers
23k
views
Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?
If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this?
What is the extent and ...
- 50.9k
87
votes
2
answers
45k
views
Should I use AntiForgeryToken in all forms, even login and registration?
I'm running a rather large site with thousands of visits every day, and a rather large userbase. Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...
- 973
4
votes
1
answer
396
views
What are the implementation details and rationale of ASP.NET MVC3's AntiForgeryToken?
The AntiForgeryToken is used to prevent CSRF attacks, however the links on MSDN don't give me much insight to what exactly the AntiForgeryToken does, or how it works, or why things are done the way ...
- 50.9k
6
votes
2
answers
3k
views
Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation
I'm hesitant to implement the proposed anti-JSON hijacking solutions since
The recommended solutions to mitigating JSON hijacking involve non-REST-full JSON POSTs to GET data
The alternate solution (...
- 50.9k
8
votes
3
answers
2k
views
What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?
I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional.
My intent is to gracefully ...
- 50.9k