ASP.NET OAuth Guides

Includes all steps and details.
http://beabigrockstar.com/guides/aspnet-oauth

6 Ways To Avoid Mass Assignment in ASP.NET MVC

http://odetocode.com/Blogs/scott/archive/2012/03/11/complete-guide-to-mass-assignment-in-asp-net-mvc.aspx

Prevent Cross-Site Request Forgery (CSRF) using ASP.NET MVC’s AntiForgeryToken() helper

http://blog.stevensanderson.com/2008/09/01/prevent-cross-site-request-forgery-csrf-using-aspnet-mvcs-antiforgerytoken-helper/

Ways to stop CSRF

There are two main ways to block CSRF:

• Check that incoming requests have a Referer header referencing your domain. This will stop requests unwittingly submitted from a third-party domain. However, some people disable their browser’s Refererheader for privacy reasons, and attackers can sometimes spoof that header if the victim has certain versions of Adobe Flash installed. This is a weak solution.
• Put a user-specific token as a hidden field in legitimate forms, and check that the right value was submitted. If, for example, this token is the user’s password, then a third-party can’t forge a valid form post, because they don’t know each user’s password. However, don’t expose the user’s password this way: Instead, it’s better to use some random value (such as a GUID) which you’ve stored in the visitor’s Session collection or into a Cookie

ASP.NET MVC Authentication - Customizing Authentication and Authorization The Right Way

http://weblogs.asp.net/jgalloway/archive/2012/05/04/asp-net-mvc-authentication-customizing-authentication-and-authorization-the-right-way.aspx

Security and the ASP.NET View State

http://radicaldevelopment.net/security-and-the-asp-net-view-state/
<pages enableViewState="true" enableViewStateMac="true" viewStateEncryptionMode="Auto"></pages>

How To: Secure your ASP.NET MVC application and use Active Directory as the Membership Provider

http://ricardodsanchez.com/2012/04/18/how-to-secure-your-asp-net-mvc-application-and-use-active-directory-as-the-membership-provider/

ASP.NET Forms Authentication Blocks Images and CSS Files

http://www.codingbeaver.com/myblog/index.php/2012/04/11/asp-net-forms-authentication-blocks-images-and-css-files/

<modules runAllManagedModulesForAllRequests="true" />

Making your ASP.NET Web API’s secure

a ASP.NET Web API that requires requests to be under the HTTPS protocol, requires an encrypted authorization token and requires traffic to only come from a predefined population of IP addresses.

http://codebetter.com/johnvpetersen/2012/04/02/making-your-asp-net-web-apis-secure/

Securing your ASP.NET MVC 4 App and the new AllowAnonymous Attribute

You cannot use routing or web.config files to secure your MVC application. The only supported way to secure your MVC application is to apply the Authorize attribute to each controller and use the new  AllowAnonymous attribute on the login and register actions.

http://blogs.msdn.com/b/rickandy/archive/2012/03/23/securing-your-asp-net-mvc-4-app-and-the-new-allowanonymous-attribute.aspx

How to test a web page for security purpose

Reference:
http://forums.asp.net/t/1782142.aspx/1


the security testing for your web application can be divded into two steps:
1) the first step is focus on the server-side web application/pages code. You can do some manual code review according to some code best practice(you can search the Microsoft Pattern and Practice center for references) for any potential issues in code. And You can also leverage some automation code analysis tools like the FxCop (or the Visual Studio Code analysis functions) to perform code checking based on some predefined rules. And there are some existing rules for checking security vulnerability. Here are some reference for your information:
#Fxcop ASP.NET security rules
http://fxcopaspnetsecurity.codeplex.com/
#Code Analysis for Managed Code Overview h
ttp://msdn.microsoft.com/en-us/library/3z0aeatx.aspx
#Microsoft Code Analysis Tool .NET (CAT.NET) v1 CTP - 32 bit
http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=19968
2) The second steps is to perform live security testing. There are some automation tools which can help automatically detect potential secuirty issues based on the HTTP traffice between browser and your web application. The Watcher tool is one of them which is open and free. You can run watcher as a fiddler add-in function and checking security issues for your web pages or service endpoints.
#watcher: Web security testing tool and passive vulnerability scanner
http://websecuritytool.codeplex.com/

ASP.NET authentication cookies and their security

http://www.campusmvp.net/web-security-asp-net-authentication-cookies-and-their-security/

What is stored in a cookie?

This cookie contains the Forms authentication ticket. This ticket, represented by the FormsAuthenticationTicket class, contains the following data/members:

• Version: the version of ticket’s format.
• Name: current user’s name, unique for the whole system and main key to restore the authenticated session. In addition, it’s used for binding with other ASP.NET APIs such as Roles or Profile.
• Expiration: when the ticket (and the cookie) expires.
• IssueDate: date in which it was generated.
• IsPersistent: if the cookie will be saved on the hard disk.
• UserData: extra data about the user. Usually this is an empty string since it’s written from the Membership provider and the default implementations do not write anything here.
• CookiePath: relative path from where the cookie is stored. Default is “/”.

This information is serialized and encrypted by setting a cookie that is stored on the client side. There is a private method in the FormsAuthentication class named MakeTicketIntoBinaryBlob which is in charge of serializing the information. This is called from another private method, Encrypt, which is in charge of the encryption.

How is a cookie encrypted?

We can set some properties to handle this kind of authentication from the cookies configuration in the<forms> node in the web.config. One of these properties is protection. It can take the following values:

• Encryption: with this value the ticket is encrypted before being saved in the cookie.
• Validation: requires cookies validation.
• All: It’s the default value and also the recommended one. Requires both validation and encryption of the cookie that contains the authentication ticket.
• None: does not validate or encrypt the cookie. It’s not recommended to use this value since there is no protection for cookies. Performance is improved because it steers clear of additional cryptology processes.

Encryption is performed using specific information in the section <machineKey> in web.config. From .NET 2.0 and later the AES algorithm is used (Advanced Encryption Standard also known as Rijndael, the standard for best balance between security and speed in symmetric encryption), but other less secure algorithms, such as DES and 3DES, are supported.

How to Prevent SQL Injection in ASP.NET

http://web.securityinnovation.com/appsec-weekly/blog/bid/79150/How-to-Prevent-SQL-Injection-in-ASP-NET


Step 1. Constrain Input
You should validate all input to your ASP.NET applications for type, length, format, and range. By constraining the input used in your data access queries, you can protect your application from SQL injection.

Step 2. Use Parameters with Stored Procedures
Using stored procedures does not necessarily prevent SQL injection. The important thing to do is use parameters with stored procedures. If you do not use parameters, your stored procedures can be susceptible to SQL injection if they use unfiltered input as described in the "Overview" section of this document.

Step 3. Use Parameters with Dynamic SQL

Attack Code Published for Serious ASP.NET DoS Vulnerability

http://www.csoonline.com/article/697771/attack-code-published-for-serious-asp.net-dos-vulnerability

OWASP Top 10 for .NET developers part 9: Insufficient Transport Layer Protection

http://www.troyhunt.com/2011/11/owasp-top-10-for-net-developers-part-9.html

Asp.net web application Security Review: Do's & Don't

http://www.codeproject.com/KB/web-security/webSecurity.aspx

How to avoid the Session fixation vulnerability in ASP.NET

http://www.dotnetfunda.com/articles/article1395-how-to-avoid-the-session-fixation-vulnerability-in-aspnet-.aspx

ASP.NET: Integrating Customized Roles, Membership and Profiles in ASP.NET 4.0

ASP.NET: Integrating Customized Roles, Membership and Profiles in ASP.NET 4.0

Microsoft patches 34 vulnerabilities

http://www.net-security.org/secworld.php?id=11168

Prevent Cross-Site Request Forgery (CSRF) using ASP.NET MVC’s AntiForgeryToken() helper « Steve Sanderson’s blog

Prevent Cross-Site Request Forgery (CSRF) using ASP.NET MVC’s AntiForgeryToken() helper « Steve Sanderson’s blog

Securing your ASP.NET MVC 3 Application

You cannot use routing or web.config files to secure your MVC application. The only supported way to secure your MVC application is to apply the [Authorize] attribute to each controller and action method (except for the login/register methods). Making security decisions based on the current area is a Very Bad Thing and will open your application to vulnerabilities

http://blogs.msdn.com/b/rickandy/archive/2011/05/02/securing-your-asp-net-mvc-3-application.aspx