14

I am planning to start a new web site on ASP.NET MVC 2 (3).

Does anybody have a full (if possible) check list of actions or approaches I should go through to avoid most security issues?

one
  • 1,781
  • 3
  • 18
  • 45
garik
  • 1,222
  • 15
  • 24

3 Answers3

6

Based on this blog post, I'm using POSTs for all my JSON data. This underscores a few items in the Codevanced checklist pasted here.

makerofthings7
  • 50,090
  • 54
  • 250
  • 536
  • 1
    That blog post is a great illustration of JSON prototype hijacking. Thank you for the link. – D.W. Sep 05 '11 at 19:07
5

Barry Dorans, author of Beginning ASP.NET Security, provides some good material on the subject. I read his book and he covers a lot of ASP.NET MVC specific material.

If you are looking for a check list of application security controls, be sure to also check out the OWASP ASVS project.

atdre
  • 18,885
  • 6
  • 58
  • 107
  • Well, there's a chapter on it, but most of the book is core concepts which cover both webforms and MVC. Thanks for the recommendation :) – blowdart Nov 19 '10 at 22:47
5

Here's a video series on how to hack proof your asp.net sites, it is two videos of about 50min where he also includes an introduction to the topic, he also includes examples, I havn't seen all of it yet, but I think it will cover some of your questions, or atleast give you som inspiration.

http://vimeo.com/28284123

psalomonsen
  • 1,054
  • 7
  • 7
  • 1
    Hi @psalomonsen, welcome to [security.se]! Can you please edit your answer to include a summary, instead of just linking? See the [FAQ], and [answer]. – AviD Sep 05 '11 at 13:17