Skip to main content
6 votes

Passing a C# object to Javascript in ASP.NET MVC

Use an HTML data-* attribute to store the object as JSON and later parse it with JS. This has several security and design advantages over injecting directly into an inline <script>. Example Let'...
Arminius's user avatar
  • 44.9k
4 votes
Accepted

Is it valid to defend an CSRF token against replay (e.g. with a timestamp)?

If the CSRF token can be intercepted then the session cookie can usually be intercepted as well, so CSRF wouldn't be the immediate concern in that scenario. Some CSRF token implementations have ...
AndrolGenhald's user avatar
4 votes
Accepted

What is the purpose of the default header/cookie in an MVC anti-forgery token?

ASP.NET MVC uses a variation of synchronizer token pattern. In a typical implementation, syncrhonizer token pattern works by generating a large random token and preserving it in two locations: ...
Marko Vodopija's user avatar
3 votes

Is it valid to defend an CSRF token against replay (e.g. with a timestamp)?

We've had this discussion with many clients over the years. The most valid solution for CSRF protection is one where the server tracks what 'page' was sent to the client, then only accepts valid data ...
mgargiullo's user avatar
3 votes
Accepted

First time penetration testing code check

Without seeing the code it's impossible to say for sure what is going on. Based on my own experience I suspect the following is what is happening. Lets say you have a vulnerable piece of code that ...
Abe Miessler's user avatar
  • 8,185
3 votes

Manage Browser Cookie Editing for web application in .Net Mvc

Use a cryptographically safe cookie value such that modification of the value would invalidate the session. In other words cookie = encrypt(username, expiration, secret) Where only your application ...
Steve's user avatar
  • 15.3k
2 votes

Potential issues with a HTTPS to HTTP conversion

I am experiencing an issue with certain emails coming from exterior services such as yahoo, and google. Specifically that requested resources can only be accessed via SSL. Okay, so you receive ...
gowenfawr's user avatar
  • 72.9k
2 votes
Accepted

Potential issues with a HTTPS to HTTP conversion

The issue that they're referring to is sensitive cookie exposure, in particular, cookies that contain an authentication or session token. In this case specifically, you should never force an ...
Xander's user avatar
  • 35.8k
2 votes
Accepted

Securing a Web API in MVC

There's one pretty major issue that's immediately apparent, but may be an artifact of your development environment: the request is transmitted over plain ol' http, which means the API key is available ...
Xiong Chiamiov's user avatar
2 votes

Do IIS / ASP.NET / MVC version headers reveal patch presence?

No, these headers don't say anything about the server itself, only that it's running Windows (Because of the IIS). The other two headers are the .Net and MVC framework version, which both are ...
Robin Hilber's user avatar
2 votes

Are there any risks with prepopulating a username from a querystring on a login page?

The only security issue I can see with this is that you will have your usernames appear in all sorts of logs and in your users browser history. For most applications, that wouldn't really be a problem ...
Anders's user avatar
  • 65.6k
2 votes

When is it okay not to use anti-forgery token in login page?

Visiting a URL can cause a side effect. For instance, if I'm logged into Amazon, visiting a URL may cause an item to be purchased and shipped to me (one-click buy). That's a side effect. Or, it ...
D.W.'s user avatar
  • 99.9k
2 votes
Accepted

Preventing CSRF with SameSite="strict" without degrading user experience?

Short answer: No, there's no way to have the benefit of Strict SameSite without the drawbacks of Strict SameSite. However, you can get most of the benefits (and fewer drawbacks) by using Lax SameSite. ...
CBHacking's user avatar
  • 49.3k
2 votes
Accepted

Content-Type and Code Execution

IIS, like most web application servers, automatically recognizes requests for URLs that contain server-side code and executes that code on the server. This means that, if I can upload a .ASP or .ASPX ...
CBHacking's user avatar
  • 49.3k
2 votes

Is the .AspNet.Application cookie vulnerable to CSRF attacks?

From the RFC: "SameSite" cookies offer a robust defense against CSRF attack when deployed in strict mode, and when supported by the client. It is, however, prudent to ensure that this ...
Christiaan's user avatar
1 vote
Accepted

ASP.NET Core - are files put in the Shared folder under Pages (where the Razor pages reside) publicly accessible?

By default, no. Those are files used to render pages on server side. If you will not modify the configuration of where from static files are hosted or the IIS setup (open directory browser feature) ...
Bartosz Rosa's user avatar
1 vote
Accepted

Why ASP.Net Identity sends sensitive information to clients?

DISCLAIMER: I am not a Microsoft employee and I do not know the exact causes of presenting ASP.NET Identity. My opinion base on documentation and some practical experience. The main purpose of ...
Bartosz Rosa's user avatar
1 vote

Validating JWT in server-to-auth-server scenario

I have found the library that is used in this sample code here: https://github.com/auth0/auth0.net/blob/master/src/Auth0.AuthenticationApi/AuthenticationApiClient.cs The sample is using the Resource ...
Bartosz Rosa's user avatar
1 vote

How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)?

It could be a False Positive. You can mark the alert as such, just double click it and set Confidence to False Positive. If you're seeing it a lot you could go into the Scan Policy and disable that ...
kingthorin's user avatar
1 vote

When is it okay not to use anti-forgery token in login page?

My understanding is the real issue is cookies that store the auth credentials because the browser automatically sends it to the URL. If you don't use cookies and don't have some script that always ...
kevin's user avatar
  • 111
1 vote

OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

When you use the cookie based authentication it means that your app base on stateless authentication, where stateless means you fully rely on data (cookie) that comes from user agent. In this case it ...
Bartosz Rosa's user avatar
1 vote
Accepted

Hosted Payment Page - Security perspective implementation

Summarizing my understanding based on question and comments: You are using PxPay 2.0 from Payment Express You using the Redirect method (as opposed to Iframe) You expect the customer's browser to ...
gowenfawr's user avatar
  • 72.9k
1 vote
Accepted

Can I trust a session Id for uniqueness?

Although there is an accepted answer here, it is somewhat misleading. Can I trust a Session ID for Uniqueness? If uniqueness is the only constraint, then the short answer is yes. If you are ...
symcbean's user avatar
  • 18.7k
1 vote

Direct Access to Administration Pages ,The web server or application server are configured in an insecure way

Administrative interfaces should not be exposed to the internet where possible as whilst it is not necessary exploitable, it still gives attackers an insight into the software you are using and ...
deadb1t's user avatar
  • 41
1 vote

Security considerations for a web application without log in feature

When using a One-Time-Token like that, you usually have at least four problems: Time frame of validity. If the token is valid for too long, it might get compromised, if too short, the method of ...
Tobi Nary's user avatar
  • 14.4k
1 vote
Accepted

HMAC API exposed through public site?

prevent unauthorised access to a method on an unauthenticated controller If you don't have any authentication and authorization ("unauthenticated controller") then there can be no such thing as an ...
Steffen Ullrich's user avatar
1 vote

Security risks of file upload-download systems

On a server perspective, you're allowing others to put things directly into the file system without (much) validation. Database storage is comparatively safer, as binary data is not directly ...
kevin's user avatar
  • 933
1 vote

Security risks of file upload-download systems

Usually regular path on web hacking could be in a quick summarized way something like: Find a vulnerability (scanning, fingerprinting, etc) exploit the vulnerability Write some kind of evil payload/...
OscarAkaElvis's user avatar
1 vote

Practical benefit of using SqlCredential vs username/password in connection string

If you set user-password in the connection string instead of using the SqlConnection.Credential property (which internally uses SecureString), a malicious administrator can dump the memory of a ...
Dejan's user avatar
  • 111

Only top scored, non community-wiki answers of a minimum length are eligible