Web Security Fundamentals in .NET

Common Web Vulnerabilities

Understanding common web vulnerabilities is the first step in building secure applications. Some of the most prevalent threats include:

• Cross-Site Scripting (XSS): Injection of malicious scripts into web pages viewed by other users.
• SQL Injection: Manipulation of database queries to gain unauthorized access or modify data.
• Cross-Site Request Forgery (CSRF): Forcing an end user to execute unwanted actions on a web application in which they are currently authenticated.
• Authentication and Authorization Bypass: Gaining unauthorized access to resources by exploiting weaknesses in authentication or authorization mechanisms.
• Insecure Direct Object References (IDOR): Exposing internal implementation objects by directly exposing references to them.
• Security Misconfigurations: Weaknesses arising from improperly configured security settings.

Authentication in .NET

Authentication is the process of verifying the identity of a user or client. .NET offers several robust authentication mechanisms:

ASP.NET Core Identity

ASP.NET Core Identity is a membership system that provides user management, authentication, and authorization. It supports features like:

• User registration and login
• Password management (hashing, complexity rules)
• Email confirmation and password reset
• Two-factor authentication (2FA)
• External login providers (Google, Facebook, etc.)

The framework handles credential storage securely using strong hashing algorithms like PBKDF2.

JWT Bearer Authentication

For API scenarios and single-page applications (SPAs), JSON Web Tokens (JWT) are commonly used for authentication. .NET Core provides middleware for validating JWTs, ensuring that requests are authorized based on a trusted token.

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = Configuration["Jwt:Issuer"],
            ValidAudience = Configuration["Jwt:Audience"],
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:Key"]))
        };
    });

Authorization in .NET

Authorization determines what an authenticated user is allowed to do. .NET provides flexible authorization capabilities:

Role-Based Authorization

Assign users to roles and grant access to resources based on those roles. This is commonly implemented using the [Authorize(Roles = "Admin,Manager")] attribute.

Policy-Based Authorization

Define authorization policies that can combine multiple requirements, such as roles, claims, or custom authorization logic. Policies are configured in the Startup.cs (or Program.cs in .NET 6+) file.

// In Startup.cs (ConfigureServices method)
services.AddAuthorization(options =>
{
    options.AddPolicy("RequireAdminRole", policy => policy.RequireRole("Admin"));
    options.AddPolicy("CanEditArticles", policy =>
        policy.RequireAssertion(context =>
            context.User.HasClaim(c => c.Type == "CanEdit") ||
            context.User.IsInRole("Editor")
        )
    );
});

// In a Controller or Razor Page
[Authorize(Policy = "CanEditArticles")]
public IActionResult EditArticle() { ... }

Protecting Against Common Attacks

Preventing XSS

ASP.NET Core automatically encodes HTML output by default, which helps prevent XSS attacks. Ensure that you are not manually disabling this encoding or explicitly rendering unencoded HTML from untrusted sources.

Preventing CSRF

.NET Core includes built-in support for anti-forgery tokens. Use the @Html.AntiForgeryToken() helper in your forms and the [ValidateAntiForgeryToken] attribute on your action methods.

<form asp-controller="Account" asp-action="Login" method="post">
    <!-- ... form fields ... -->
    <--@Html.AntiForgeryToken()--> @* Razor syntax is @AntiForgeryToken()*@
    <input type="hidden" name="__RequestVerificationToken" value="@GetAntiForgeryToken()" />
    <button type="submit">Login</button>
</form>

[HttpPost]
[ValidateAntiForgeryToken]
public IActionResult Login(LoginViewModel model) { ... }

Securely Handling Passwords

Always hash passwords using strong, salted hashing algorithms. ASP.NET Core Identity handles this automatically. Avoid storing passwords in plain text or using weak hashing algorithms like MD5 or SHA1.

HTTPS Enforcement

Always use HTTPS to encrypt communication between the client and server. Configure your application to redirect HTTP requests to HTTPS.

// In Startup.cs (Configure method)
app.UseHttpsRedirection();

Additional Security Considerations

• Input Validation: Validate all user input on both the client-side and server-side to prevent malformed data and potential exploits.
• Secure Cookie Handling: Configure cookies with appropriate flags like HttpOnly and Secure.
• Logging and Monitoring: Implement robust logging to detect and investigate security incidents.
• Dependency Management: Regularly update your .NET runtime, libraries, and dependencies to patch known vulnerabilities.
• OWASP Top 10: Familiarize yourself with the OWASP Top 10 list of critical web application security risks and implement mitigation strategies.