[Asp.net] security precautions for developing Web Applications

Source: Internet
Author: User

When writing web development, security issues are often ignored.

Let's discuss the security technologies that I usually use when implementing projects.

1. SQL Injection

This is an old topic. However, you may writeProgramThis problem may occur occasionally. Because such injection attacks are potentially more likely in a program as the project grows.

The solution is:

Strictly control user input and strictly control data. This includes user character input, data form verification, and deliberate tampering with parameters.

For example, use the ado.net API. Stored procedures.

2. Cross-Site Scripting

Converts HTML tags submitted by users to htmlencode.

For example, label1.text = server. htmlencode (feedback. Text)

In this way, you can replace a script such as <SCRIPT> </SCRIPT>.

3. _ viewstate

For Asp.net, __viewstate records page data information. The data is encrypted using base64. We need to strictly verify it.


Modify web. config:

<Pages buffer = "true" enablesessionstate = "true" enableviewstate = "true" enableviewstatemac = "true" autoeventwireup = "true" validaterequest = "true"> </pages>


<Machinekey validationkey = "autogenerate" decryptionkey = "autogenerate, isolateapps" validation = "sha1"/>

4. Verify

Strict authentication of identity and Directory Security.

For example, use Form Verification of Web. config. Strictly control directories, identities, and Operation permissions.

5. handle errors

It is prohibited to return sensitive information such as program content to the user when a program error occurs.

For example, modify <customerrors>

<Customerrors mode = "on" defaultredirect = "error.htm"/>

6. Web Service

Disable useless Web Services. Disable auto-generated WSDL


The above is just a simple setting for the security of a single web application. If you need to configure a sound environment, it involves more and more.

For more information about security configuration, see:


Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.