ASP.NET Core 5 Secure Coding Cookbook

Book description

Learn how to secure your ASP.NET Core web app through robust and secure code

Key Features

  • Discover the different types of security weaknesses in ASP.NET Core web applications and learn how to fix them
  • Understand what code makes an ASP.NET Core web app unsafe
  • Build your secure coding knowledge by following straightforward recipes

Book Description

ASP.NET Core developers are often presented with security test results showing the vulnerabilities found in their web apps. While the report may provide some high-level fix suggestions, it does not specify the exact steps that you need to take to resolve or fix weaknesses discovered by these tests.

In ASP.NET Secure Coding Cookbook, you’ll start by learning the fundamental concepts of secure coding and then gradually progress to identifying common web app vulnerabilities in code. As you progress, you’ll cover recipes for fixing security misconfigurations in ASP.NET Core web apps. The book further demonstrates how you can resolve different types of Cross-Site Scripting. A dedicated section also takes you through fixing miscellaneous vulnerabilities that are no longer in the OWASP Top 10 list. This book features a recipe-style format, with each recipe containing sample unsecure code that presents the problem and corresponding solutions to eliminate the security bug. You’ll be able to follow along with each step of the exercise and use the accompanying sample ASP.NET Core solution to practice writing secure code.

By the end of this book, you’ll be able to identify unsecure code causing different security flaws in ASP.NET Core web apps and you’ll have gained hands-on experience in removing vulnerabilities and security defects from your code.

What you will learn

  • Understand techniques for squashing an ASP.NET Core web app security bug
  • Discover different types of injection attacks and understand how you can prevent this vulnerability from being exploited
  • Fix security issues in code relating to broken authentication and authorization
  • Eliminate the risks of sensitive data exposure by getting up to speed with numerous protection techniques
  • Prevent security misconfiguration by enabling ASP.NET Core web application security features
  • Explore other ASP.NET web application vulnerabilities and secure coding best practices

Who this book is for

This ASP.NET Core book is for intermediate-level ASP.NET Core web developers and software engineers who use the framework to develop web applications and are looking to focus on their security using coding best practices. The book is also for application security engineers, analysts, and specialists who want to know more about securing ASP.NET Core using code and understand how to resolve issues identified by the security tests they perform daily.

Table of contents

  1. ASP.NET Core 5 Secure Coding Cookbook
  2. Foreword
  3. Contributors
  4. About the author
  5. About the reviewers
  6. Preface
    1. Who this book is for
    2. What this book covers
    3. To get the most out of this book
      1. Download the example code files
    4. Download the color images
    5. Conventions used
    6. Sections
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
      5. See also
    7. Get in touch
    8. Share Your Thoughts
  7. Chapter 1: Secure Coding Fundamentals
    1. Technical requirements
    2. Input validation
    3. Enabling whitelist validation using validation attributes
      1. Getting ready
      2. How to do it…
      3. How it works…
    4. Whitelist validation using the FluentValidation library
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
      5. See also…
    5. Syntactic and semantic validation
      1. Creating a custom validation attribute to implement semantic validation
      2. Getting ready
      3. How to do it…
      4. How it works…
    6. Input sanitization
      1. Getting ready
      2. How to do it…
      3. How it works…
    7. Input sanitization using the HTMLSanitizer library
      1. Getting ready
      2. How to do it…
      3. How it works…
    8. Output encoding
    9. Output encoding using HtmlEncoder
      1. Getting ready
      2. How to do it…
      3. How it works…
    10. Output encoding using UrlEncoder
      1. Getting ready
      2. How to do it…
      3. How it works…
    11. Output encoding using JavascriptEncoder
      1. Getting ready
      2. How to do it…
      3. How it works…
    12. Protecting sensitive data using the Data Protection API
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. See also
  8. Chapter 2: Injection Flaws
    1. Technical requirements
    2. What is SQL injection?
    3. Fixing SQL injection with Entity Framework
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    4. Fixing SQL injection in ADO.NET
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    5. Fixing NoSQL injection
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    6. Fixing command injection
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    7. Fixing LDAP injection
      1. Getting ready
      2. How to do it…
      3. How it works…
    8. Fixing XPath injection
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
  9. Chapter 3: Broken Authentication
    1. Technical requirements
    2. Fixing the incorrect restrictions of excessive authentication attempts
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    3. Fixing insufficiently protected credentials
      1. Getting ready
      2. How to do it…
      3. How it works…
    4. Fixing user enumeration
      1. Getting ready
      2. How to do it…
      3. How it works…
    5. Fixing weak password requirements
      1. Getting ready
      2. How to do it…
      3. How it works…
    6. Fixing insufficient session expiration
      1. Getting ready
      2. How to do it…
      3. How it works…
  10. Chapter 4: Sensitive Data Exposure
    1. Technical requirements
    2. Fixing insufficient protection of data in transit
      1. Getting ready
      2. How to do it…
      3. How it works…
    3. Fix missing HSTS headers
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    4. Fixing weak protocols
      1. Getting ready
      2. How to do it…
      3. How it works…
    5. Fixing hardcoded cryptographic keys
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    6. Disabling caching for critical web pages
      1. Getting ready
      2. How to do it…
      3. How it works…
  11. Chapter 5: XML External Entities
    1. Technical requirements
    2. Enabling XML validation
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    3. Fixing XXE injection with XmlDocument
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    4. Fixing XXE injection with XmlTextReader
      1. Getting ready
      2. How to do it…
      3. How it works…
    5. Fixing XXE injection with LINQ to XML
      1. Getting ready
      2. How to do it…
      3. How it works…
  12. Chapter 6: Broken Access Control
    1. Technical requirements
    2. Fixing IDOR
      1. Getting ready
      2. How to do it…
      3. How it works…
    3. Fixing improper authorization
      1. Testing improper authorization
      2. Getting ready
      3. How to do it…
      4. How it works…
    4. Fixing missing access control
      1. Getting ready
      2. How to do it…
      3. How it works…
    5. Fixing open redirect vulnerabilities
      1. Getting ready
      2. How to do it…
      3. How it works…
  13. Chapter 7: Security Misconfiguration
    1. Technical requirements
    2. Disabling debugging features in non-development environments
      1. Getting ready
      2. How to do it…
      3. How it works…
    3. Fixing disabled security features
      1. Getting ready
      2. How to do it…
      3. How it works…
    4. Disabling unnecessary features
      1. Getting ready
      2. How to do it…
      3. How it works…
    5. Fixing information exposure through an error message
      1. Getting ready
      2. How to do it…
      3. How it works
    6. Fixing information exposure through insecure cookies
      1. Getting ready
      2. How to do it…
      3. How it works
  14. Chapter 8: Cross-Site Scripting
    1. Technical requirements
    2. Fixing reflected XSS
      1. Getting ready
      2. How to do it…
      3. How it works…
    3. Fixing stored/persistent XSS
      1. Getting ready
      2. How it works…
      3. There's more…
    4. Fixing DOM XSS
      1. Getting ready
      2. How to do it…
      3. How it works…
  15. Chapter 9: Insecure Deserialization
    1. Technical requirements
    2. Fixing unsafe deserialization
      1. Getting ready
      2. Testing unsafe deserialization
      3. How to do it…
      4. How it works…
      5. There's more…
    3. Fixing the use of insecure deserializers
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    4. Fixing untrusted data deserialization
      1. Testing untrusted data deserialization
      2. Getting ready
      3. How to do it…
      4. How it works…
  16. Chapter 10: Using Components with Known Vulnerabilities
    1. Technical requirements
    2. Fixing the use of a vulnerable third-party JavaScript library
      1. Getting ready
      2. Testing outdated and vulnerable third-party libraries
      3. How to do it…
      4. How it works…
      5. There's more…
      6. See also
    3. Fixing the use of a vulnerable NuGet package
      1. Getting ready
      2. Testing vulnerable NuGet packages
      3. How to do it…
      4. How it works…
    4. Fixing the use of a library hosted from an untrusted source
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
  17. Chapter 11: Insufficient Logging and Monitoring
    1. Technical requirements
    2. Fixing insufficient logging of exceptions
      1. Getting ready
      2. How to do it…
      3. How it works…
    3. Fixing insufficient logging of DB transactions
      1. How to do it…
      2. How it works…
    4. Fixing excessive information logging
      1. How to do it…
      2. How it works…
    5. Fixing a lack of security monitoring
      1. How to do it…
      2. How it works…
      3. There's more…
  18. Chapter 12: Miscellaneous Vulnerabilities
    1. Technical requirements
    2. Fixing the disabled anti-Cross-Site Request Forgery protection
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    3. Preventing Server-Side Request Forgery
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    4. Preventing log injection
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    5. Preventing HTTP response splitting
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    6. Preventing clickjacking
      1. Getting ready
      2. Clickjacking proof of concept (PoC)
      3. How to do it…
      4. How it works…
    7. Fixing insufficient randomness
      1. Getting ready
      2. How to do it…
      3. How it works…
  19. Chapter 13: Best Practices
    1. Technical requirements
      1. Getting ready
    2. Proper exception handling
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    3. Using security-related cookie attributes
      1. Getting ready
      2. How to do it…
      3. How it works…
    4. Using a Content Security Policy
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    5. Fixing leftover debug code
      1. Getting ready
      2. How to do it…
      3. How it works…
      4. There's more…
    6. Why subscribe?
  20. Other Books You May Enjoy
    1. Packt is searching for authors like you
    2. Share Your Thoughts

Product information

  • Title: ASP.NET Core 5 Secure Coding Cookbook
  • Author(s): Roman Canlas
  • Release date: July 2021
  • Publisher(s): Packt Publishing
  • ISBN: 9781801071567