Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [asp.net-mvc]

a web application framework implementing the Model View Controller (MVC) pattern.

78
votes
2answers
36k views

Should I use AntiForgeryToken in all forms, even login and registration?

I'm running a rather large site with thousands of visits every day, and a rather large userbase. Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...
17
votes
1answer
32k views

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

I've made a Web API in ASP.NET that acts as the entry point into a SQL Server database for report data. This service has a "token" endpoint that authenticates a user via ASP Identity and return a 20-...
14
votes
2answers
17k views

Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?

If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this? What is the extent and ...
11
votes
2answers
2k views

What unique risks does MVC model binding bring to a website? What additional vigilance is needed?

From what I understand, "model binding" is where a website based on ASP.NET MVC or Ruby on Rails (there are others...) takes parameters in HTTP's GET statement and passes them as variables to code ...
9
votes
1answer
8k views

Drawbacks of storing an authentication token on the client side?

I am working on an ASP.NET MVC web application, which fetches its data from an API in the back. So authentication is currently done via ASP.NET Forms Authentication, which means the client sends email ...
8
votes
2answers
26k views

Javascript and jQuery not secure over https

I am building an ASP.NET MVC 3 app which will run in Azure. Everything was working well, until I switched to https. Now most of my jQuery plugins and some other javascript are not secure. I'm using ...
8
votes
3answers
2k views

What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?

I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional. My intent is to gracefully ...
5
votes
1answer
19k views

How client certificate works for authentication (in Web API)

I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: http://www.asp.net/web-api/overview/security/working-with-ssl-in-web-...
5
votes
2answers
2k views

Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation

I'm hesitant to implement the proposed anti-JSON hijacking solutions since The recommended solutions to mitigating JSON hijacking involve non-REST-full JSON POSTs to GET data The alternate solution ...
4
votes
3answers
457 views

Can a mismatched server encoding on HTTP POST or GET result in a security issue?

It is possible for a server to parse HTTP POST and GET data with a fixed encoding or one that is dynamic with the client's response. Consider the situation where a client uses UTF7,32 or any other ...
4
votes
2answers
3k views

Windows Authentication and Session Ids

After a penetration test made upon an intranet application I'm developing, in ASP.NET MVC, one of the concerns raised was that the application supports concurrent user sessions and it is recommended ...
4
votes
1answer
342 views

What are the implementation details and rationale of ASP.NET MVC3's AntiForgeryToken?

The AntiForgeryToken is used to prevent CSRF attacks, however the links on MSDN don't give me much insight to what exactly the AntiForgeryToken does, or how it works, or why things are done the way ...
3
votes
2answers
3k views

How to stop revealing web directories in ASP.Net MVC

We have built a web application using ASP.Net MVC3 and SQL Server 2008 which has features like credit card payment, etc. We engaged a 3rd party to perform vulnerability assessment and penetration ...
3
votes
2answers
2k views

Security risks of file upload-download systems

I know that there are many posts about these topic. But those posts usually talk about restricting the file types and sizes on so on. Hence non serves to my needs as my system does not have any ...
3
votes
2answers
186 views

Website file being altered

I have recently had random spam links inserted into 3 ASP.NET websites. The links are inserted into the physical file so it is not SQL injection attack. The websites have very little in common other ...
3
votes
2answers
486 views

Manage Browser Cookie Editing for web application in .Net Mvc

I am developing a sensitive web application with .net MVC and I am saving my user credentials after login with cookies. The problem is, one user is able to login with their username and password. ...
3
votes
1answer
246 views

First time penetration testing code check

In the following scenario the website allows users to upload an excel document that contains information that will be loaded to the database, and stored as values that can later be accessed by the ...
3
votes
1answer
3k views

ASP.NET Machinekey encryption

In Asp.NET you can use the MachineKey.Protect to encrypt data. We are thinking of using this to encrypt some data which will be stored in a hidden fields within a web page, these hidden fields are ...
3
votes
2answers
2k views

How to stop Forced browsing ? - Saving information from being compromised by url change

I have a ASP.NET MVC 4 application. In some webpages or views, I have information displayed in table. Column values are rendered as links. Problems: 1. When I hover over the link, it's URL is ...
3
votes
1answer
638 views

Membership.GeneratePassword

I am looking for a method to generate a onetime password for provisioning purposes in ASP.NET-MVC. I came across the Membership.GeneratePassword which is in the System.Web.Security namespace. Is this ...
3
votes
1answer
9k views

MVC 5 and Multiple AntiForgeryTokens: What is happening?

I have a simple login form. In it, I put an AntiForegeryToken. @using (Html.BeginForm("Login", "Account")) { @Html.AntiForgeryToken() <p> <label>Email</label> ...
3
votes
0answers
115 views

String Serialization in .NET [closed]

I am currently performing a secure code review of Fortify reported issues and segments of code flagged relates to current session state being stored in memory. By default, the framework .NET ...
2
votes
2answers
1k views

What is the purpose of the default header/cookie in an MVC anti-forgery token?

I've read that the MVC anti-forgery token defeats CSRF attacks by storing security tokens in a form field and then comparing the default header/cookie value sent automatically by the browser to the ...
2
votes
1answer
66 views

Are there any risks with prepopulating a username from a querystring on a login page?

So, we've got a fairly standard login page on a web application. We want to make a slight change so that if a user gets their password wrong, the page reloads (as it currently does) but the username ...
2
votes
1answer
626 views

What threats does a stateless web application have? (as opposed to a “state-full” sessions)

I'm comparing the pros and cons between having an authenticated "stateless" ASP.NET MVC session versus a ASP.NET Forms application with viewstate. Assuming that there is a webfarm of more than 1 web ...
2
votes
1answer
126 views

Security considerations for a web application without log in feature

We were told to send an email with a link to the users. The users will get a token in the URL where they will be able to chose some options and post their selection. Example URL: https://example.com/...
2
votes
1answer
158 views

Security concerns with an ASP.net server error [duplicate]

Are there any security problems that could arise from a server error generated by ASP.net and being sent to the user? I am aware of the potential issues from sensitive information being sent in the ...
2
votes
0answers
217 views

What trivial attacks is ASP.NET MVC mixed-mode auth vulnerable to?

In a 2012 MSDN blog post, Microsoft discourages mixed-mode authentication in ASP.NET MVC for being vulnerable to trivial attacks: The ASP.NET team doesn’t support using mixed-mode authentication in ...
2
votes
0answers
232 views

Potential Issues and downfalls of the “honeyPot” in asp.net mvc

Within the last few weeks I have been noticing massive amounts of bot traffic coming out of a small geographical area. I have implemented the robots.txt into my ASP.net project, but as I understand it,...
2
votes
0answers
476 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
2
votes
2answers
1k views

Security of an SQL database server used in web app

At my organisation we have a website survey that one of the managers here uses for equality purposes. They designed and implemented the survey in Adobe FormsCentral which is now being retired, so I ...
1
vote
3answers
2k views

How to prevent someone guessing the token in a reset password link

Currently I have the following set-up for handling users that forgot their password. A user types in his/her e-mail address and presses the forgot password button. I look up the user belonging to ...
1
vote
2answers
407 views

Potential issues with a HTTPS to HTTP conversion

I am experiencing an issue with certain emails coming from exterior services such as yahoo, and google. Specifically that requested resources can only be accessed via SSL. I found the following ...
1
vote
2answers
671 views

Is it valid to defend an CSRF token against replay (e.g. with a timestamp)?

I have an MVC app that is using the AntiForgeryToken capability of ASP.NET MVC. AFAICT this uses an encrypted synchronizer token variation where it validates the payload of the tokens. A customer has ...
1
vote
1answer
209 views

How does window.w3ssss hack occur

Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site. While we have cleaned it up, I have not been able to ...
1
vote
1answer
244 views

Securing a Web API in MVC

I've got a simple ASP MVC 6 WebAPI I'm currently working on in which registered users can call request data using a sample of the URL below: http://localhost:7988/api/b8pE5Qodiw/elections/Prop1/Prop2/...
1
vote
1answer
789 views

Do IIS / ASP.NET / MVC version headers reveal patch presence?

Quick question: does anyone know whether the IIS / ASP.NET / MVC version headers, like this: Server: Microsoft-IIS/8.5 X-AspNetMvc-Version: 5.2 X-AspNet-Version: 4.0.30319 can be used to determine ...
1
vote
2answers
638 views

Practical benefit of using SqlCredential vs username/password in connection string

Currently I'm using SQL Server Authentication with the username/password as part of the connection string for my web application. As far as I know this standard procedure within the .NET world and ...
1
vote
1answer
107 views

Hosted Payment Page - Security perspective implementation

We are implementing a .NET MVC application and planning to use a Hosted Payment Page for Secure Payments and from PCI Stand point. Am worried the about the data which we might expose in the return ...
1
vote
2answers
289 views

Direct Access to Administration Pages ,The web server or application server are configured in an insecure way

Application Security Scan performed on our application using IBM's AppScan standard tool and below issue has been reported. I am a .net developer, and unaware of these security terms. Could somebody ...
1
vote
2answers
4k views

Table or row level security in ASP.NET MVC 5 and Entity Framework 6

I've already asked this question on Stack Overflow, but no one answered, so maybe it's a more appropriate place to discuss it. Please let me know if I'm wrong and having duplicated question on ...
1
vote
2answers
550 views

Separate web and app server windows authentication

I understand that separate web and app server can improve security. Your web server sits in a dmz and then there is firewall between it and the app server. We provide solutions to clients within an ...
1
vote
2answers
2k views

How should developers handle Form POST variables that conflict with route variables?

In ASP.NET MVC, when I perform a HTTP post to /controller/action/UserID ... and have a corresponding route /controller/action/{UserID} ... and if I do a Form POST, the POSTed data UserID ...
1
vote
0answers
218 views

OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie). While accessing the application I ...
1
vote
0answers
82 views

Minimizing high risk obsolete application entry points

I am working on a .NET MVC based project involving an application with over 50,000 unique entry points. Using our own custom static code analysis built using the .NET reflection libraries we have ...
1
vote
1answer
36 views

Returning parameterised view

So I just came across this nasty looking piece of code. public ActionResult Display(string viewName) { return View(viewName); } I would avoid having that parameter or at least I would get ...
1
vote
0answers
102 views

How can I audit the modules and stage markers in OWIN's authentication pipeline?

ASP.NET's OWIN (in MVC4 and Katana) allows for various objects to be added to the HTTP processing pipeline. I want to ensure that there are no rogue Nuget packages no hard to find partial classes ...
1
vote
1answer
244 views

User Authentication for a public website in 2015 [closed]

I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...
0
votes
1answer
172 views

How to identify hackers based on ip addresses and the pages that were accessed

I saw some suspicious errors being generated on my site based on pages that were requested. My error is logging the path that the user is trying to access. Because of these errors (and the paths that ...
0
votes
1answer
62 views

HMAC API exposed through public site?

(I also asked this question over on StackOverflow.) What steps can I take to prevent unauthorised access to a method on an unauthenticated controller? Background The diagram below illustrates a ...