This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of ".NET Security Cheat Sheet"
From OWASP
Xandersherry (talk | contribs) (Clarified forms auth timeouts and hashing guidance, added SQL Server auth guidance, and cleanup.) |
m (Data Access: Enums are still vulnerable to unexpected values because .NET only validates a successful cast to the underlying data type, integer by default.) |
||
| Line 28: | Line 28: | ||
* Do not use [http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlcommand.aspx SqlCommand] with a string parameter made up of a [http://msdn.microsoft.com/en-us/library/ms182310.aspx concatenated SQL String]. | * Do not use [http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlcommand.aspx SqlCommand] with a string parameter made up of a [http://msdn.microsoft.com/en-us/library/ms182310.aspx concatenated SQL String]. | ||
* Whitelist allowable values coming from the user. Use enums, [http://msdn.microsoft.com/en-us/library/f02979c7.aspx TryParse] or lookup values to assure that the data coming from the user is as expected. | * Whitelist allowable values coming from the user. Use enums, [http://msdn.microsoft.com/en-us/library/f02979c7.aspx TryParse] or lookup values to assure that the data coming from the user is as expected. | ||
| + | ** Enums are still vulnerable to unexpected values because .NET only validates a successful cast to the underlying data type, integer by default. [https://msdn.microsoft.com/en-us/library/system.enum.isdefined Enum.IsDefined] can validate whether the input value is valid within the list of defined constants. | ||
* Apply the principle of least privilege when setting up the Database User in your database of choice. The database user should only be able to access items that make sense for the use case. | * Apply the principle of least privilege when setting up the Database User in your database of choice. The database user should only be able to access items that make sense for the use case. | ||
* Use of the [http://msdn.microsoft.com/en-us/data/ef.aspx Entity Framework] is a very effective [http://msdn.microsoft.com/en-us/library/ms161953(v=sql.105).aspx SQL injection] prevention mechanism. Remember that building your own ''ad hoc'' queries in EF is just as susceptible to SQLi as a plain SQL query. | * Use of the [http://msdn.microsoft.com/en-us/data/ef.aspx Entity Framework] is a very effective [http://msdn.microsoft.com/en-us/library/ms161953(v=sql.105).aspx SQL injection] prevention mechanism. Remember that building your own ''ad hoc'' queries in EF is just as susceptible to SQLi as a plain SQL query. | ||
| − | * When using SQL Server, prefer integrated authentication over SQL authentication. | + | * When using SQL Server, prefer integrated authentication over SQL authentication. |
=== Encryption === | === Encryption === | ||
Revision as of 19:00, 29 March 2015
|
Last revision (mm/dd/yy): 03/29/2015 Introduction [hide]
This page intends to provide quick basic .NET security tips for developers. The .NET FrameworkThe .NET Framework is Microsoft's principal platform for enterprise development. It is the supporting API for ASP.NET, Windows Desktop applications, Windows Communication Foundation services, SharePoint, Visual Studio Tools for Office and other technologies. Updating the FrameworkThe .NET Framework is kept up-to-date by Microsoft with the Windows Update service. Developers do not normally need to run seperate updates to the Framework. Windows update can be accessed at Windows Update or from the Windows Update program on a Windows computer. Individual frameworks can be kept up to date using NuGet. As Visual Studio prompts for updates, build it into your lifecycle. Remember that third party libraries have to be updated separately and not all of them use Nuget. ELMAH for instance, requires a separate update effort. .NET Framework GuidanceThe .NET Framework is the set of APIs that support an advanced type system, data, graphics, network, file handling and most of the rest of what is needed to write enterprise apps in the Microsoft ecosystem. It is a nearly ubiquitous library that is strong named and versioned at the assembly level. Data Access
Encryption
General
ASP.NET Web Forms GuidanceASP.NET Web Forms is the original browser-based application development API for the .NET framework, and is still the most common enterprise platform for web application development.
protected override OnInit(EventArgs e) {
base.OnInit(e);
ViewStateUserKey = Session.SessionID;
}
If you don't use Viewstate, then look to the default master page of the ASP.NET Web Forms default template for a manual anti-CSRF token using a double-submit cookie. private const string AntiXsrfTokenKey = "__AntiXsrfToken";
private const string AntiXsrfUserNameKey = "__AntiXsrfUserName";
private string _antiXsrfTokenValue;
protected void Page_Init(object sender, EventArgs e)
{
// The code below helps to protect against XSRF attacks
var requestCookie = Request.Cookies[AntiXsrfTokenKey];
Guid requestCookieGuidValue;
if (requestCookie != null && Guid.TryParse(requestCookie.Value, out requestCookieGuidValue))
{
// Use the Anti-XSRF token from the cookie
_antiXsrfTokenValue = requestCookie.Value;
Page.ViewStateUserKey = _antiXsrfTokenValue;
}
else
{
// Generate a new Anti-XSRF token and save to the cookie
_antiXsrfTokenValue = Guid.NewGuid().ToString("N");
Page.ViewStateUserKey = _antiXsrfTokenValue;
var responseCookie = new HttpCookie(AntiXsrfTokenKey)
{
HttpOnly = true,
Value = _antiXsrfTokenValue
};
if (FormsAuthentication.RequireSSL && Request.IsSecureConnection)
{
responseCookie.Secure = true;
}
Response.Cookies.Set(responseCookie);
}
Page.PreLoad += master_Page_PreLoad;
}
protected void master_Page_PreLoad(object sender, EventArgs e)
{
if (!IsPostBack)
{
// Set Anti-XSRF token
ViewState[AntiXsrfTokenKey] = Page.ViewStateUserKey;
ViewState[AntiXsrfUserNameKey] = Context.User.Identity.Name ?? String.Empty;
}
else
{
// Validate the Anti-XSRF token
if ((string)ViewState[AntiXsrfTokenKey] != _antiXsrfTokenValue ||
(string)ViewState[AntiXsrfUserNameKey] != (Context.User.Identity.Name ?? String.Empty))
{
throw new InvalidOperationException("Validation of Anti-XSRF token failed.");
}
}
}
<httpRuntime enableVersionHeader="false" />
HttpContext.Current.Response.Headers.Remove("Server");
HTTP validation and encoding
Forms authentication
ASP.NET MVC GuidanceASP.NET MVC (Model-View-Controller) is a contemporary web application framework that uses more standardized HTTP communication than the Web Forms postback model.
MvcHandler.DisableMvcResponseHeader = true;
HttpContext.Current.Response.Headers.Remove("Server");
if (MembershipService.ValidateUser(model.UserName, model.Password))
{
FormsService.SignIn(model.UserName, model.RememberMe);
if (IsLocalUrl(returnUrl))
{
return Redirect(returnUrl);
}
else
{
return RedirectToAction("Index", "Home");
}
}
<% using(Html.Form(“Form", "Update")) { %>
<%= Html.AntiForgeryToken() %>
<% } %>
and on the controller method:
[ValidateAntiForgeryToken]
public ViewResult Update()
{
// gimmee da codez
}
XAML Guidance
Windows Forms Guidance
WCF Guidance
Authors and Primary EditorsBill Sempf - bill.sempf(at)owasp.org Other Cheatsheets |
