Building Secure ASP.NET Core MVC Applications
summary
Shows that ASP.NET Core MVC defaults reduce common mistakes but require explicit fixes: controllers are convention‑discovered, model binding enables overposting unless view models or Bind whitelists are used, and POST actions need ValidateAntiForgeryToken (or a global filter) to prevent CSRF. Returning text/html still allows reflective XSS so use the built‑in HTML/JS encoders or Razor (avoid Html.Raw). Demonstrates adding SameSite cookies via cookie policy in 2.0 and using Roslyn analyzers to flag missing ModelState checks and antiforgery attributes; demo code is on GitHub.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:33ASPNET Core
- 3:52ModelViewController
- 4:24Starting a New Project
- 5:49Controllers
- 8:04Advanced Controller
- 12:30Data Processing
- 15:10Data Assignment
- 18:01Content Result
- 20:48Input Validation
- 21:52SameSide Cookies
- 24:54Using SameSide Cookies
- 26:46Code Analysis
- 27:37Limitations
- 29:23Conclusion
related talks
39mA guided tour of ASP.NET core security
01h 01mLessons learned building ASP.NET Core MVC
01h 02mAdapting ASP.NET Core MVC to your needs
54mASP.NET Core Meets Owasp Top 10
01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
58mASP.NET Core meets OWASP Top 10 2025
01h 18mASP.NET MVC in 2024: A Powerful Choice for Modern Web Development?
53mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0