ASP.NET Core meets OWASP Top 10 2025

on YouTube ↗58m

" summary

Compares OWASP Top 10 2025 item by item and shows which risks ASP.NET Core actually mitigates: data protection API handles IVs/keys and authenticated encryption but requires explicit key storage to avoid production breaks; built-in anti-forgery plus same-site defends CSRF; authorization policies, resource-based checks and a RequireAssertion false fallback enable secure-by-default access control; SQL and XSS risk drop thanks to LINQ and automatic escaping; supply chain remains weak (example: a malicious NuGet source-generator risk); audit logging and transactional error flows still need custom design.

AI-written summary · about

" chapters (14)

1. 0:00Introduction
2. 1:10OWASP Top 10 2025 overview
3. 3:16Broken access control
4. 12:24Open redirects and CSRF
5. 20:11Security misconfiguration
6. 21:58Supply chain failures
7. 26:53Cryptographic failures
8. 34:01Injection vulnerabilities
9. 38:15Insecure design
10. 40:47Authentication failures
11. 44:39Integrity failures
12. 46:56Logging limitations
13. 51:08Exception handling
14. 55:24Final verdict and Q&A

" related talks

• 54mASP.NET Core Meets Owasp Top 10Anders Abel · NDC Security 2022
• 52mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Dominick Baier · NDC Copenhagen 2019
• 39mA guided tour of ASP.NET core securityAnders Abel · Øredev 2016
• 58mSecurity in ASP.NET Core 2.0Barry Dorrans · NDC Oslo 2017
• 01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Brock Allen · NDC Minnesota 2019
• 47mAPIs Exposed!Layla Porter · NDC London 2019
• 01h 00mWeb Application Security Risks: A Look at OWASP Top Ten 2017Christian Wenz · NDC Oslo 2017
• 50mAttack Mitigation Mechanisms in ASP.NET CoreMykhayl Shcherbakov · .NET Fest 2017