Best practices for building secure .NET web applications

In the current digital era, using ASP.NET Core to create secure .NET web applications is essential to safeguarding user data and upholding customer confidence. It’s similar to constructing a strong castle to ward off cyberattacks and guarantee the seamless operation of your company. You should be proactive in strengthening the security of your.NET web applications because there are a lot of possible threats out there. Let’s look at some essential procedures to guide you through this dynamic environment and protect your apps: 

Implement input validation and sanitization techniques to prevent cross-site scripting (XSS) attacks:

 

Protecting your ASP.NET Core web application from cross-site scripting (XSS) attacks involves implementing input validation and output encoding. Let’s dive into some best practices and coding examples:

1. Input Validation:

• Validate User Input:
  • • Ensure that any data received from users adheres to expected criteria. Use attributes like [Required] , [StringLength], or custom validation logic.
    • Example:

public class MyModel
{
    [Required]
    public string UserName { get; set; }
}

• HTML Encode Input:
  • Encoding all user-provided content is a must before displaying it on a webpage. Encoding guarantees that any code or special characters input by users are translated into a secure format that cannot be read as executable code. This aids in the prevention of security flaws like Cross-Site Scripting (XSS), in which browsers of users who are unaware may execute malicious code that has been inserted into the webpage.
  • Example (in Razor view):

<p>User Name: @Html.DisplayFor(model => model.UserName)</p>

2. Output Encoding:

• • HTML Encode Output:
    • Before data getting displayed in HTML views, encode it. This means that all information shown on a webpage needs to be encoded before it can be viewed. Through this encoding, the data is converted into a secure format that stops any potentially dangerous characters or code from being identified by the browser as executable code. By taking this safety measure, you decrease the possibility of security risks such as Cross-Site Scripting (XSS), in which hackers might attack the website with harmful code in order to undermine its security.
    • Example (in Razor view):

<p>User Name: @Html.Raw(Html.Encode(Model.UserName))</p>

 

• JavaScript Encode Output:
  • You should encrypt any user-provided data before incorporating it into JavaScript code. By encoding user input, special characters and possibly harmful code are prevented from being executed as JavaScript code and instead transformed into a safe format. You may protect your website’s application from security threats like Cross-Site Scripting (XSS), which occurs when malicious scripts are injected into it by attackers, by encoding user input before integrating it in JavaScript.
  • Example (in Razor view):

<script>
    var userName = "@Html.Raw(Json.Encode(Model.UserName))";
    // Use 'userName' safely in JavaScript
</script>

• URL Encode Output:
  • You should always encrypt URLs created with user-provided data. Encoding makes ensuring that any potentially dangerous content or special characters in user input are transformed into a secure format that may be safely used in a URL. By encrypting data, security flaws like URL manipulation and injection attempts are prevented. Before creating URLs, you may guarantee that user input is safe, valid, and free of any security threats by encrypting it.
  • Example:

var encodedUserName = System.Web.HttpUtility.UrlEncode(Model.UserName);
var url = $"https://example.com/profile?user={encodedUserName}"

3. Content Security Policy (CSP):

• • Implementing a Content Security Policy (CSP) involves setting up a header in your web application to control which scripts are allowed to run on your page. This helps prevent malicious scripts from executing, enhancing the security of your website.
  • Example (in Startup.cs):

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // ...
    app.Use(async (context, next) =>
    {
        context.Response.Headers.Add("Content-Security-Policy", "default-src 'self'");
        await next();
    });

}

 

Use parameterized queries and stored procedures to prevent SQL injection attacks

 

Protecting your ASP.NET Core application from SQL injection attacks involves using parameterized queries and stored procedures. Let’s explore both methods that will help you build secure .NET web applications with code examples:

1. Parameterized Queries:

• • Parameterized queries keep the query logic separate from user input values.
  • Using SqlParameter ensures safe handling of user input, preventing SQL injection attacks.
  • Example (C#):

public string GetEmployeeInfo(int employeeId)

{
    string connectionString = "YourConnectionStringHere";
    string sql = "SELECT Id, FirstName, LastName FROM Employees WHERE Id = @EmployeeId";
    using (SqlConnection connection = new SqlConnection(connectionString))
    using (SqlCommand command = new SqlCommand(sql, connection))
    {
        command.Parameters.AddWithValue("@EmployeeId", employeeId);
        connection.Open();
        return command.ExecuteScalar()?.ToString();
    }
}

 

2. Stored Procedures:

• • Stored procedures are pre-compiled database elements that package SQL logic.
  • They enhance security by reducing the risk of SQL injection and improve performance by reducing network traffic and optimizing query execution.
  • Example (C#):

public void UpdateEmployeeLocation(int employeeId, int locationId)
{
    string connectionString = "YourConnectionStringHere";
    string sql = "uspUpdateEmployeeLocation"; // Stored procedure name
    using (SqlConnection connection = new SqlConnection(connectionString))
    using (SqlCommand command = new SqlCommand(sql, connection))
    {
        command.CommandType = CommandType.StoredProcedure;

        command.Parameters.AddWithValue("@EmployeeId", employeeId);

        command.Parameters.AddWithValue("@LocationId", locationId);

        connection.Open();

        command.ExecuteNonQuery();

    }
}

3. Calling Stored Procedures with Entity Framework Core:

• • Entity Framework Core (EF Core) also supports stored procedures.
  • Example (C#):

public string GetEmployeeInfoUsingEFCore(int employeeId)
{
    using (var context = new YourDbContext())
    {
        var result = context.Employees
            .FromSqlRaw("EXEC uspEmployeeInfo @EmployeeId", new SqlParameter("@EmployeeId", employeeId))
            .FirstOrDefault();

        return result?.FirstName + " " + result?.LastName;
    }
}

Remember to replace “YourConnectionStringHere” with your actual database connection string. By using parameterized queries and stored procedures, you’ll significantly reduce the risk of SQL injection vulnerabilities in your .NET application.

Avoid using deprecated or vulnerable components and libraries

 

Ensuring that your ASP.NET Core application uses secure and up-to-date components is crucial. Let’s explore best practices and provide code examples to avoid deprecated or vulnerable libraries:

1. Maintain an Inventory of Dependencies:

• • Keep track of all third-party components (libraries, frameworks, plugins) used in your application.
  • Regularly review and update this inventory.

2. Regularly Update Components:

• • • Outdated Libraries and Frameworks:
      • Avoid using old versions of libraries or frameworks with known security issues.
      • Update to the latest stable versions.
      • Example (NuGet package update):

dotnet add package YourPackage --version Latest

3. Security Notifications:

• • Subscribe to security mailing lists or notifications for the components you use.
  • Be aware of vulnerabilities and updates.
  • Example (GitHub security alerts): !GitHub Security Alerts

4. Dependency Scanning:

• • • Use automated tools to scan your application’s dependencies for known vulnerabilities.
    • Example (GuardRails):

guardrails scan dotnet

5. Dependency Whitelisting:

• • Only include necessary dependencies.
  • Remove unused or unnecessary components.
  • Example (remove unused package):

dotnet remove package UnusedPackage

6. Security Reviews:

• • Regularly review your codebase, including third-party components.
  • Look for deprecated APIs or insecure practices.
  • Example (manual code review):

// Check for deprecated API usage

if (IsDeprecatedApiUsed())
{
    // Handle appropriately
}

 

7. Use Guard Clauses:

• • Guard against deprecated or vulnerable components.

Example:
public void ProcessData(string input)

{
    if (IsDeprecatedComponentUsed())
    {
        LogWarning("Deprecated component detected!");
        return;
    }
    // Continue processing data
}

Proactive maintenance and vigilance are essential. By following these practices, you’ll reduce the risk of security vulnerabilities and maintain a robust ASP.NET Core application.

Consider Multifactor Authentication (MFA) and implement strong password policies

 

MFA adds an extra layer of security by requiring users to provide additional forms of identification during sign-in. This could include entering a code from a cellphone, using a FIDO2 key, or providing a fingerprint scan. By requiring a second form of authentication, we enhance security, making it harder for attackers to compromise accounts.

1. Enable Two-Factor Authentication (2FA)

2FA is a subset of MFA, requiring at least two types of proof for identity authentication. ASP.NET Core Identity supports 2FA by default. To enable or disable 2FA for a specific user, set the IdentityUser<TKey>.TwoFactorEnabled property. The ASP.NET Core Identity Default UI includes pages for configuring 2FA.

Example:

// Enable 2FA for a user
await _userManager.SetTwoFactorEnabledAsync(user, true);

2. MFA Using Time-based One-time Password (TOTP)

MFA using TOTP is also supported by default in ASP.NET Core Identity. It works with any compliant authenticator app, such as Microsoft Authenticator or Google Authenticator. To enable TOTP support, configure authentication using AddIdentity:

services.AddIdentity<ApplicationUser, IdentityRole>()
    .AddEntityFrameworkStores<ApplicationDbContext>()
    .AddDefaultTokenProviders(); // Includes TOTP

 

3. Passwordless MFA with Passkeys/FIDO2

Passkeys/FIDO2 (e.g., hardware security keys) provide strong MFA protection against phishing attacks. Unfortunately, ASP.NET Core doesn’t directly support passkeys/FIDO2. However, Microsoft Entra ID offers support for passkeys/FIDO2 and passwordless flows.

4. Implement Strong Password Policies

Now let’s enforce strong password policies:

• Minimum Length: Maintain an 8-character minimum length requirement.
• Composition Requirements: Avoid overly complex rules. Instead, encourage users to create long, memorable passphrases.
• Unique Passwords: Use a unique password for each site or service.
• MFA Everywhere: Encourage users to enable MFA wherever possible.

5. Password Protection

In addition to enforcing password management tools (like password managers), educate users on secure practices. For example:

• Store passwords in the provided password management tool.
• Treat passwords as confidential and don’t share them.
• Ban common passwords to keep vulnerable ones out of your system.

Remember, any MFA is better than no MFA. Choose the right balance between security and usability for your application.

Implement session management techniques to prevent session hijacking and fixation attacks

Session management is crucial for securing your ASP.NET Core application against session hijacking and fixation attacks. Let’s explore best practices and provide code examples to protect your sessions:

1. Strong Session Management:

• Generate cryptographically secure session IDs to resist guessing or brute-force attacks.
• Set an appropriate session expiration time to limit active session duration.
• Regenerate session IDs upon significant events (e.g., successful authentication or before accessing sensitive information).
• Validate the IP address of incoming requests against the IP address associated with the session.

Example (Generating a cryptographically secure session ID):

// Generate a random session ID

string sessionId = Guid.NewGuid().ToString();
HttpContext.Session.SetString("SessionId", sessionId);

 

2. Cross-Site Scripting (XSS) Prevention:

• XSS vulnerabilities can lead to session hijacking.
• Implement strict input validation to filter out potentially malicious characters and scripts.
• Use output encoding techniques (e.g., HTML entity encoding) when rendering user-generated content.

3. Session Fixation Protection:

• Assign a different session cookie immediately after user authentication.
• Verify that the cookie value is not included in the URL.

Example (Assigning a new session ID after authentication):

// Upon successful login, generate a new session ID

string newSessionId = Guid.NewGuid().ToString();
HttpContext.Session.SetString("SessionId", newSessionId);

 

Remember to adapt these examples to your specific application needs. By following these practices, you’ll significantly reduce the risk of session hijacking and fixation attacks in your ASP.NET Core application.

Hash passwords and use salted hashes to protect user credentials 

 

Let’s explore how to securely hash passwords and use salted hashes to protect user credentials in ASP.NET Core. Let’s see some code examples to demonstrate best practices to build secure .NET web applications:

1.Choose a Secure Hashing Algorithm:

• • Avoid using insecure algorithms like MD5 or SHA1.
  • Opt for stronger algorithms such as:
    • PBKDF2 (Password-Based Key Derivation Function 2)
    • BCrypt
    • Argon2

2. Generate a Salt:

• • • • A salt is a random value added to the password before hashing.
      • It prevents attackers from using precomputed rainbow tables.
      • Store the salt alongside the hashed password.

3.Hash the Password with Salt:

• • • • • Combine the password and salt.
        • Hash the combined value using the chosen algorithm.
        • Store the resulting hash in your database.

Example (using PBKDF2 in ASP.NET Core):

using System;
using System.Security.Cryptography;

public class PasswordHasher
{
    public static string HashPassword(string password, string salt)
    {
        byte[] saltBytes = Convert.FromBase64String(salt);
        using (var pbkdf2 = new Rfc2898DeriveBytes(password, saltBytes, 10000, HashAlgorithmName.SHA256))
        {

            byte[] hashBytes = pbkdf2.GetBytes(32); // 256 bits

            return Convert.ToBase64String(hashBytes);
        }
    }
    public static string GenerateSalt()
    {
        byte[] saltBytes = new byte[16]; // 128 bits
        using (var rng = RandomNumberGenerator.Create())
        {
            rng.GetBytes(saltBytes);
        }
        return Convert.ToBase64String(saltBytes);
    }
}

// Usage:
string userPassword = "mySecurePassword";
string salt = PasswordHasher.GenerateSalt();
string hashedPassword = PasswordHasher.HashPassword(userPassword, salt);
// Store 'hashedPassword' and 'salt' in your database

 

Apply HTTPS to enforce secure communication

Enforcing HTTPS in your ASP.NET Core application ensures that all communication is encrypted, enhancing security. Let’s explore how to achieve this using code examples:

1. Use HTTPS Redirection Middleware:

• • The UseHttpsRedirection middleware automatically redirects HTTP requests to HTTPS.
  • Add it to your Startup.cs file in the Configure method.

Example:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // Other middleware setup
    if (!env.IsDevelopment())
    {
        app.UseExceptionHandler("/Error");
        app.UseHsts(); // Enable HTTP Strict Transport Security (HSTS)
    }

    app.UseHttpsRedirection(); // Redirect HTTP to HTTPS
    app.UseStaticFiles();
    app.UseRouting();
    app.UseAuthorization();

    // Other middleware and routing setup

}

2. HTTP Strict Transport Security (HSTS):

• • HSTS, or HTTP Strict Transport Security, is a security feature that instructs web browsers to always use HTTPS instead of HTTP when communicating with a website. This helps prevent various types of attacks, such as man-in-the-middle attacks, by ensuring that data is transmitted securely.
  •  By integrating the UseHsts middleware in the Startup.cs file of an ASP.NET Core application, developers can enforce the usage of HSTS headers in server responses. This means that when users visit the website, their browsers will receive instructions to only connect via HTTPS, thereby ensuring a more secure browsing experience.

Example:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)

{

    // Other middleware setup

    if (!env.IsDevelopment())
    {
        app.UseExceptionHandler("/Error");
        app.UseHsts(); // Enable HSTS
    }
    app.UseHttpsRedirection(); // Redirect HTTP to HTTPS
    app.UseStaticFiles();
    app.UseRouting();
    app.UseAuthorization();
    // Other middleware and routing setup

}

 

3. Configure Your Web Server:

• • If your application is deployed behind a reverse proxy (e.g., Nginx, Apache), configure HTTPS at the proxy level.
  • The proxy can handle HTTPS redirection and HSTS headers.

Conclusion

In order to minimise potential risks and safeguard user data, developing secure .NET web applications necessitates a comprehensive strategy that incorporates numerous best practices. XSS and SQL injection attacks are common dangers that developers can defend their systems against by adopting techniques like as parameterized queries and stored procedures for input validation and output encoding. To further strengthen security measures, keep your dependencies up to date and use strong authentication methods like multifactor authentication and strict password policies. Moreover, putting in place efficient session management strategies and salt-hashing passwords provide extra security against credential theft and session hijacking. Last but not least, using secure communication protocols like HTTPS guarantees that information sent back and forth between the server and clients is secure and encrypted. Through following to these recommended standards, developers can produce solid and trustworthy and secure .NET web applications.