OWASP ASP.NET MVC Boilerplate Project
ASP.NET MVC Boilerplate Project
The default ASP.NET MVC project template uses insecure defaults and omits many security features altogether. ASP.NET MVC Boilerplate is a Visual Studio project template that enables security features by default and adds liberal comments and links to further resources to help developers (Who often do not have a lot of knowledge on the subject) get started.
A professional ASP.NET MVC template for building secure, fast, robust and adaptable web applications or sites. It provides the minimum amount of code required on top of the default MVC template provided by Microsoft to provide security by default.
The default MVC template provided by Microsoft is not as secure as it could be. There are various settings (Mostly in the web.config file) which are insecure by default. For example, it leaks information about which version of IIS you are using and allows external scripts to access cookies by default! ASP.NET MVC Boilerplate makes everything secure by default.
TLS and HTTPS
Setting up TLS, so that your site runs over HTTPS is very difficult in ASP.NET MVC as it requires several steps to do it correctly. ASP.NET MVC Boilerplate makes this easy with step by step instructions and links.
Several HTTP headers are also used to provide better security using the NWebSec NuGet packages:
- Content Security Policy (CSP).
- Strict-Transport-Security (HSTS)
- Public-Key-Pins (HPKP)
Subresource Integrity (SRI)
ASP.NET MVC Boilerplate has Subresource Integrity (SRI) implemented by default using a custom ASP.NET MVC 6 TagHelper.
ASP.NET MVC Boilerplate provides detailed comments and links to official documentation explaining all of the security features.
ASP.NET MVC Boilerplate provides a check-list of steps the developer needs to take to secure the site.
ASP.NET MVC Boilerplate attempts to thwart fingerprinting tools by removing the IIS and .NET version HTTP headers and also changing several defaults including session and anti-forgery cookie names.
Dynamic IP Security
ASP.NET MVC Boilerplate enables IIS Dynamic IP Security to limit the maximum number of concurrent requests to thwart DDOS attacks.
This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License 2.0 as published by the Free Software Foundation 2015.
- GitHub Project Home Page where you can view source code, log issues and view the change log.
- Visual Studio Gallery where you can install the project template, rate/review it.
- My RehanSaeed.com blog where I post articles detailing features of the project. The project template itself links to many of the articles so that developers can get detailed information if they need it.
News and Events
Read all of the blog articles about this project here.
All are welcome to get involved. Simply visit the GitHub site and raise a pull request for your code.
A Visual Studio Project Template which you can download here