ASP.NET Core Meets Owasp Top 10
summary
ASP.NET Core defaults to safe patterns: middleware handles auth, static files run first unless reordered, and Identity uses PBKDF2 (HMAC‑SHA256, 10,000 iterations) for passwords. Built‑in cookie authentication relies on the Data Protection with purpose strings and shared key stores for load‑balanced apps; anti‑forgery tokens are emitted by the form tag helper. Policy and resource‑based authorization replace coarse role checks. Warnings: avoid raw SQL (or Dapper without parameterization), never enable JSON type name handling on untrusted input, and monitor NuGet dependencies for CVEs.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:46Injection
- 4:47Broken Authentication
- 17:15Sensitive Data Exposure
- 22:49XML External Entities
- 24:37Broken Access Control
- 26:50Requirement
- 34:38Security Misconfiguration
- 35:40Cross Site Scripting (XSS) Rating
- 39:10Insecure Deserialization
- 41:19Using Components with Known Vulnerabilities
- 43:14Insufficient Logging and Monitoring
- 43:59Bonus. Cross-Site Request Forgery (CSRF)
- 46:34Remember to...
- 51:10ASP.NET Core Security Summary
related talks
58mASP.NET Core meets OWASP Top 10 2025
58mSecurity in ASP.NET Core 2.0
39mA guided tour of ASP.NET core security
52mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
59mASP.NET Core Authentication and Authorization - the Key Concepts
01h 01mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0
40mSecurity in ASP.NET Core 2.1