A guided tour of ASP.NET core security

on YouTube ↗39m

" summary

ASP.NET Core presents a new, extensible security model: a pluggable cookie middleware that extracts and restores identities, a policy-driven authorization system with policy requirement handlers that let code load resources and enforce complex rules, built-in Razor HTML escaping to prevent XSS, an anti-forgery token flow for CSRF, Data Protection APIs that encrypt and sign cookies and form fields, and the option to embed IdentityServer4 to issue bearer tokens for REST APIs. Concrete configuration and middleware wiring determine whether these protections actually work.

AI-written summary · about

" chapters (16)

1. 0:00A Guided Tour of Malmo
2. 2:00Owasp top 10 2013
3. 3:14Injection
4. 5:39Authentication and Session Management
5. 9:322. The Default Template
6. 10:53IdentityServer4
7. 12:38Cross Site Scripting (XSS)
8. 14:28Insecure Direct Object References
9. 17:32Requirement
10. 20:29Resource Based Authorization
11. 24:16Security Misconfiguration
12. 25:37Sensitive Data Exposure
13. 29:56Missing Function Level Access Control
14. 33:14Using Components with known Vulnerabilities
15. 35:21Invalid Redirects and Forwards
16. 37:55ASP.NET Core Security Summary

" related talks

• 52mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Dominick Baier · NDC Copenhagen 2019
• 01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Brock Allen · NDC Minnesota 2019
• 54mASP.NET Core Meets Owasp Top 10Anders Abel · NDC Security 2022
• 58mSecurity in ASP.NET Core 2.0Barry Dorrans · NDC Oslo 2017
• 01h 01mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Dominick Baier · NDC Security Oslo 2019
• 40mSecurity in ASP.NET Core 2.1Barry Dorrans · Øredev 2018
• 59mASP.NET Core Authentication and Authorization - the Key ConceptsAnders Abel · NDC Oslo 2024
• 53mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Dominick Baier, Brock Allen · NDC Porto 2019