Test Driven Application Security
summary
Demonstrates a test-driven approach that turns OWASP Top 10 failure modes into automated checks: system tests (liveness/readiness, TLS 1.3, security headers, invalid-token -> 401) and unit tests (permission service, controller, domain/service). Demos run in ASP.NET Core 6 with C# and code on GitHub; implementation adds a centralized permissions model, domain primitives for input validation, response DTOs to stop excessive data exposure, and routing policies producing a deny-by-default posture. Tests move red failures to green and prevent tenancy, injection, and authorization regressions.
AI-written summary · about
chapters (17)
- 0:00Test driven app security intro
- 1:49Why pen tests keep finding the same vulnerabilities
- 3:59TDD for app security
- 5:42Secure API requirements
- 8:55Six steps to secure APIs
- 12:54System tests for API security
- 16:31Live demo: system tests
- 22:32Unit tests for data security
- 25:02Testing API permissions
- 29:36Domain tests for boundaries
- 34:17Fixing input validation
- 37:56Fine-grained authorization
- 43:40Routing authorization policies
- 45:46Security testing summary
- 46:27Simplicity reduces vulnerabilities
- 49:18Resources and GitHub
- 50:07Testing in production
related talks
43mTest Driven Application Security
44mShift-Left-Security with the Security Test Pyramid
27mHow to Start Security Testing Without Fear
50mDefence in depth as Code
26mSecurity Test Driven Development
23mWeb Application Security - owasp top 10 vulnerabilities
58mASP.NET Core meets OWASP Top 10 2025
55mAPI Security Assurance via E2E Testing