Analysis on ASP. NET Web Security

1. ASP. NET developers should always adhere to the practice

If you are reading this article, you may not need to instill in you the fact that security in Web applications is becoming increasingly important. You may need some practical suggestions on how to implement security in ASP. NET applications. The bad news is that there is no development platform-including ASP. NET-to ensure that once this platform is adopted, you can write secure code. If anyone says so, they will be lying. The good news is that, for ASP. NET, ASP. NET, especially version 1.1 and the forthcoming version 2.0, integrate some easy-to-use built-in defense barriers.

Simply applying all of these features is not enough to protect Web applications from any possible and foreseeable attacks. However, if combined with other defense techniques and security policies, the built-in ASP. NET feature can constitute a powerful toolkit that helps ensure that applications run in a secure environment.

ASP. NET Web security is the sum of various factors, and is the result of a policy that far beyond a single application. This policy involves database management, network configuration, social engineering, and phishing. the purpose of this article is to describe ASP. NET developers should always adhere to the practice in order to maintain a reasonable level of security standards. This is the most important aspect of security: remain vigilant and never relax, making it increasingly difficult for bad people to launch hacker attacks.

Next, let's take a look at what ASP. NET provides to simplify this job.

Ii. Sources of threats

What are the key facts displayed in the list? In my opinion, there are at least three points:
1. Whenever you insert user input into the browser tag, you may expose yourself to code injection attacks against any SQL injection and XSS variants.
2. Database Access must be implemented in a safe way, that is, the database should be given as few permissions as possible and roles should be used to divide the responsibilities of each user.
3. Never send sensitive data over the network, let alone plain text), and store sensitive data on the server in a secure manner.

Interestingly, the above three points are for ASP. NET Web security in three different aspects, and the combination of these three aspects is the only reasonable way to generate anti-attack and anti-tampering applications. ASP. NET Web security can be summarized as follows:

1. Encoding practices: data verification, type and buffer length check, anti-tampering measures

2. Data Access Policy: use decision-making to protect the weakest account, and use stored procedures or at least parameterized commands.

3. effective storage and management: Do not send key data to the client, use hash code to detect operations, authenticate the user, and protect the identity. Apply strict password policies, as shown in what you see, secure applications can only be generated through the joint efforts of developers, architects and administrators. Do not assume that you can achieve the same purpose in other ways.

When compiling ASP. NET applications, you are not alone facing the hacking army: the only weapon is the line of code typed through your own brain, skills, and fingers. ASP. NET 1.1 and later versions provide a helping hand. They have some specific functions that can automatically increase the defense against certain threats listed above. Next we will view them in detail.

3. ViewStateUserKey

Introduced from ASP. NET 1.1, ViewStateUserKey is a string attribute of the Page class, with only a few developers

1. Analysis on ASP. NET Web Security
2. Session State of ASP. NET
3. Analysis on the attribute ASP. NET of IsPostBack
4. ASP. NET architecture and security mechanism
5. Overview ASP. NET Crystal Reports