ASP.Net Security

xxAtrain223 · July 24th, 2014, 10:11 PM

I was watching a couple computerphile videos on youtube, specifically the javascript and SQL injection videos, and that had me wondering, does ASP.Net take care of these security concerns, or do we need to handle it?

I have a website i'm developing that had a 'contact us' page that was similarly designed to the one in the book, so I tried putting in:

Code:

<script>alert("Vulnerability Detected");</script>

IE and VS throw an exception that catches the threat, but i'm not entirely convinced that my website will be safe in a live environment.

I found that I can (in my contact form) set ValidateRequestMode to disabled and then sanitize all of the input using HttpUtility.HtmlEncode(). So, I know this works when I specifically write code to prevent security threats, but does ASP.Net catch other vulnerabilties that I miss?

I'm still reading through the Database chapters, so I don't know if we will have a text box whose value is sent to a database, but is there some protection for them, or do we have to 'manually' check the text for malicious intent?

Here are the videos that I was referring to:
Cross Site Request Forgery (javascript injection)
Hacking Websites with SQL Injection

Imar · July 26th, 2014, 08:09 AM

Hi there,

It's a broad topic, but yes, ASP.NET has support for this. Various encoding methods, the colon to output content,l request validation and more can help make your applications secure. However, it doesn't prevent all possible scenarios out of the box, so you'll need to be careful yourself as well.

For SQL Injection: it depends. Entity Framework is safe in general as the underlying technology uses parameterized queries. Sames is true for ADO.NET: it has support for parameterized queries. However, it's also possible to write unsafe code if you accept input from a user and inject it in a SQL statement directly.

This article might be a good start: http://msdn.microsoft.com/en-us/magazine/hh708755.aspx, but Google has a lot more information about the subject.

Cheers,

Imar

mmorgan30 · July 29th, 2014, 02:40 AM

I agree with Imar ASP.net 2.0 and above has some safegaurd with input validation. But, I would not leave it to ASP.net to make your websites secure. You must employ techniques that safeguard your applications. Just a few but not limited to are: you application regardless of input should be aware of its own input, meaning it should validate all input for exactly what you are expecting. Validation should occur at a minimum on the client side, it is recommended to do both client and server side. It is also good practice before rendering output such as label, textboxes, and bindable data displays to html encode persisted or pass through data, pass through mean it is enter on a UI and after post back is displayed on a UI. This helps guard against cross site scripting. Never and repeat never create SQL where you are concatating a base SQL statement with inputs from a UI, this will infect your site with SQL injection, always use frameworks like entity frame work or parameterized SQL commands. In short it takes a bit of reading on web exploits and for you to develop a set of practices that can safe guard you