.NET Security Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T14:18:46Z

Point to the official site

Thunder-Son: Migration to GitHub

2019-02-13T08:36:28Z

Migration to GitHub

Show changes

Bill Sempf: Added Sam as a contributor.

2018-08-03T21:56:48Z

Added Sam as a contributor.

Bill Sempf: Added .NET Core CSRF deets, and some formatting fixes.

2018-08-03T21:55:16Z

Added .NET Core CSRF deets, and some formatting fixes.

SebastienGioria: /* ASP.NET Web Forms Guidance */ update customError link to a maintain page

2018-07-12T09:05:35Z

‎ASP.NET Web Forms Guidance: update customError link to a maintain page

Bill Sempf: Added Xander

2017-09-20T15:02:02Z

Added Xander

Bill Sempf: Added contributors.

2017-09-20T15:00:25Z

Added contributors.

Bill Sempf: Reformatted A9

2017-09-20T14:56:10Z

Reformatted A9

Bill Sempf: Added logout code to CSRF.

2017-09-20T14:54:54Z

Added logout code to CSRF.

Bill Sempf: Highlighted the sections in ASP.NET MVC for clarity.

2017-09-20T14:50:58Z

Highlighted the sections in ASP.NET MVC for clarity.

← Older revision		Revision as of 14:18, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/DotNet_Security_Cheat_Sheet.md .NET Security Cheat Sheet] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html .NET Security Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 510: / Line 510: @@
 Steve Bamelis
 Xander Sherry
 == Other Cheatsheets ==

@@ Line 397: / Line 397: @@
          @Html.AntiForgeryToken()
          &lt;ul class="nav nav-pills"&gt;
-&lt;li role="presentation"&gt;Logged on as @User.Identity.Name
+            &lt;li role="presentation"&gt;Logged on as @User.Identity.Name
              &lt;li role="presentation"&gt;&lt;a href="javascript:document.getElementById('logoutForm').submit()"&gt;Log off&lt;/a&gt;&lt;/li&gt;
          &lt;/ul&gt;
@@ Line 426: / Line 426: @@
 NB: You will need to attach the anti-forgery token to Ajax requests.
 * '''A9 Using components with known vulnerabilities'''

@@ Line 3: / Line 3: @@
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
-| valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
+| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 == Introduction  ==
@@ Line 59: / Line 59: @@
 * Always use [http://support.microsoft.com/kb/324069 HTTPS].
 * Enable [http://msdn.microsoft.com/en-us/library/system.web.configuration.httpcookiessection.requiressl.aspx requireSSL] on cookies and form elements and [http://msdn.microsoft.com/en-us/library/system.web.configuration.httpcookiessection.httponlycookies.aspx HttpOnly] on cookies in the web.config.
-* Implement [http://msdn.microsoft.com/en-us/library/h0hfz6fc(v=VS.71).aspx customErrors].
+* Implement [https://msdn.microsoft.com/library/h0hfz6fc.aspx customErrors].
 * Make sure [http://www.iis.net/configreference/system.webserver/tracing tracing] is turned off.
 * While viewstate isn't always appropriate for web development, using it can provide CSRF mitigation. To make the ViewState protect against CSRF attacks you need to set the [http://msdn.microsoft.com/en-us/library/ms972969.aspx#securitybarriers_topic2 ViewStateUserKey]:
@@ Line 115: / Line 115: @@
+      {
          // Validate the Anti-XSRF token
-        if ((string)ViewState[AntiXsrfTokenKey] != _antiXsrfTokenValue ||
+if ((string)ViewState[AntiXsrfTokenKey] != _antiXsrfTokenValue ||
             (string)ViewState[AntiXsrfUserNameKey] != (Context.User.Identity.Name ?? String.Empty))
+         {
@@ Line 356: / Line 356: @@
 DO: Have a strong TLS policy (see [http://www.ssllabs.com/projects/best-practises/ SSL Best Practises]), use TLS 1.2 wherever possible. Then check the configuration using [https://www.ssllabs.com/ssltest/ SSL Test]
-DO: Ensure headers are not disclosing information about your application. See [https://github.com/johnstaveley/SecurityEssentials/blob/master/SecurityEssentials/Core/HttpHeaders.cs HttpHeaders.cs] , [https://github.com/Dionach/StripHeaders/ Dionach StripHeaders ] or disable via web.config:
+DO: Ensure headers are not disclosing information about your application. See [https://github.com/johnstaveley/SecurityEssentials/blob/master/SecurityEssentials/Core/HttpHeaders.cs HttpHeaders.cs] , [https://github.com/Dionach/StripHeaders/ Dionach StripHeaders] or disable via web.config:
      &lt;system.web&gt;
          &lt;httpRuntime enableVersionHeader="false"/&gt;
@@ Line 397: / Line 397: @@
          @Html.AntiForgeryToken()
          &lt;ul class="nav nav-pills"&gt;
-            &lt;li role="presentation"&gt;Logged on as @User.Identity.Name</li>
+&lt;li role="presentation"&gt;Logged on as @User.Identity.Name
              &lt;li role="presentation"&gt;&lt;a href="javascript:document.getElementById('logoutForm').submit()"&gt;Log off&lt;/a&gt;&lt;/li&gt;
          &lt;/ul&gt;
@@ Line 492: / Line 492: @@
 == Authors and Primary Editors  ==
-Bill Sempf - bill.sempf(at)owasp.org<br/>
+Bill Sempf - bill.sempf(at)owasp.org<br />
-Troy Hunt - troyhunt(at)hotmail.com<br/>
+Troy Hunt - troyhunt(at)hotmail.com<br />
 Jeremy Long - jeremy.long(at)owasp.org<br />
@@ Line 509: / Line 509: @@
 |}
-[[Category:Cheatsheets]][[Category:OWASP .NET Project]]
+[[Category:Cheatsheets]]

@@ Line 501: / Line 501: @@
 John Staveley
 Steve Bamelis
 == Other Cheatsheets ==

@@ Line 430: / Line 430: @@
 DO: Keep the .Net framework updated with the latest patches
-DO: Keep your NuGet packages up to date, many will contain their own vulnerabilities. So Run the OWASP Dependency checker against your application as part of your build process and act on any high level vulnerabilities. [[https://www.owasp.org/index.php/OWASP_Dependency_Check OWASP Dependency Checker]]
 * '''A10 Unvalidated redirects and forwards'''

@@ Line 407: / Line 407: @@
          '''[ValidateAntiForgeryToken]'''
          public ActionResult LogOff()
 NB: You will need to attach the anti-forgery token to Ajax requests.

@@ Line 209: / Line 209: @@
 ASP.NET MVC (Model-View-Controller) is a contemporary web application framework that uses more standardized HTTP communication than the Web Forms postback model. The OWASP Top 10 lists the most prevalent and dangerous threats to web security in the world today and is reviewed every 3 years. This section is based on this. Your approach to securing your web application should be to start at the top threat A1 below and work down, this will ensure that any time spent on security will be spent most effectively spent and cover the top threats first and lesser threats afterwards. After covering the top 10 it is generally advisable to assess for other threats or get a professionally completed Penetration Test.
-* A1 SQL Injection
+* '''A1 SQL Injection'''
 DO: Using an object relational mapper (ORM) or stored procedures is the most effective way of countering the SQL Injection vulnerability.
@@ Line 231: / Line 231: @@
 DO: Practise Least Privilege - Connect to the database using an account with a minimum set of permissions required to do it's job i.e. not the sa account
-* A2 Weak Account management
+* '''A2 Weak Account management'''
 Ensure cookies are sent via httpOnly:
@@ Line 269: / Line 269: @@
-* A3 XSS
+* '''A3 Cross Site Scripting'''
 DO NOT: Trust any data the user sends you, prefer white lists (always safe) over black lists
@@ Line 292: / Line 292: @@
                  ...
-* A4 Insecure Direct object references
+* '''A4 Insecure Direct object references'''
 When you have a resource (object) which can be accessed by a reference (in the sample below this is the id) then you need to ensure that the user is intended to be there
@@ Line 316: / Line 316: @@
+         }
-* A5 Security Misconfiguration
+* '''A5 Security Misconfiguration'''
 Ensure debug and trace are off in production. This can be enforced using web.config transforms:
@@ Line 340: / Line 340: @@
+		}
-* A6 Sensitive data exposure
+* '''A6 Sensitive data exposure'''
 DO NOT: Store encrypted passwords.
@@ Line 374: / Line 374: @@
      &lt;/httpProtocol&gt;
-* A7 Missing function level access control
+* '''A7 Missing function level access control'''
 DO: Authorize users on all externally facing endpoints. The .Net framework has many ways to authorize a user, use them at method level:
@@ Line 389: / Line 389: @@
 You can also check roles in code using identity features in .net: System.Web.Security.Roles.IsUserInRole(userName, roleName)
-* A8 Cross site request forgery
+* '''A8 Cross site request forgery'''
 DO: Send the anti-forgery token with every Post/Put request:
@@ Line 410: / Line 410: @@
 NB: You will need to attach the anti-forgery token to Ajax requests.
-* A9 Using components with known vulnerabilities
+* '''A9 Using components with known vulnerabilities'''
 DO: Keep the .Net framework updated with the latest patches
 DO: Keep your NuGet packages up to date, many will contain their own vulnerabilities. So Run the OWASP Dependency checker against your application as part of your build process and act on any high level vulnerabilities. [[https://www.owasp.org/index.php/OWASP_Dependency_Check OWASP Dependency Checker]]
-* A10 Unvalidated redirects and forwards
+* '''A10 Unvalidated redirects and forwards'''
 A protection against this was introduced in Mvc 3 template. Here is the code: