Christian Wenz - ASP.NET Core Security

I still remember the first time I was exposed to the topic of web application security, although I did not realize the impact at that time. Back around 1997, I was creating web applications (or, rather, websites, back then), but hosting services were really expensive. For one of my projects, the only option I could afford was one where I was allowed to create just one page (!), and I had to use the hosting providers tooling for thatno custom HTML or CSS was possible. I had plenty of free space available on a free hosting service but could not use my own domain there; rather, I used something like http://home.someprovider.com/mysite .

One of the very few features available to me was to set the keywords of the page (back in the day, search engines actually parsed that information). If I was using web application security, hacking, for instance, this would be turned into the following HTML markup:

After some experimenting, I found that I could try the following keyword:

It turned out that the provider was putting this data verbatim into the

So I injected another

It took a while until I understood the implications of what I had foundit was possible to inject arbitrary content on that page. My attack was harmless, but it would also have been possible to add other, more malicious markup. This sparked my interest in web application security, and I havent looked back since. I have audited countless web applications, worked with customers before or after an audit, taught developers to write secure web applications, spoken at conferences on three continents about web application security, and tried my best to make the applications I was responsible for as safe as possible. In 2004, I was awarded a Microsoft MVP (Most Valuable Professional) award for ASP.NET for the first time, and Ive followed security APIs, gotchas, and concerns in that framework very closely over the years.

I had considered writing a book on the experience and knowledge I have gained over the last 25 years, but the timing was never right. In mid-2021, it suddenly was, and I started a monthslong journey to condense everything I know and consider important into the book you are about to read.

In my experience, just knowing countermeasures against certain threats is not good enough. Developers need to understand how attacks workits easier to defend against things you have already seen. Thats why many of the chapters will first show the attack and then explain how to prevent it. Apart from making the content more accessible that way, its also funwe see how things can be broken and call this work!

As the title suggests, ASP.NET Core Security is based on ASP.NET Core, which includes both Razor Pages and ASP.NET Core MVC. The book also covers Microsofts third web application framework, Blazor, where its feasible. All the examples in the book use C# and are based on .NET 6 (and are expected to still be valid for many versions to come).

Many people who were involved in getting this book ready for you to enjoy are mentioned on the copyright page (rightfully so!), and there are many others who helped and contributed along the way.

I am indebted to the roster of reviewers who provided useful comments at various stages of the books development, as did the readers of the Manning Early Access Program (MEAP) edition. To all the reviewers, Al Pezewski, Billy Miguel Vanegas, Daniel Vsquez, Darren Gillis, David Paccoud, Dennis Hayes Djordje, Dorogoy Dmitry Sergevich, Doyle Turner, Emmanouil Chardalas, Guy Langston, Harry Polder, Jedidja Bourgeois, Joe Cuevas, Jose Luis Perez, Marcin Sk, Marek Petak, Markus Wolff, Matthew Harvell, Michael Holmes, Milos Todorovic, Nick McGinness, Nik Rimington, Onofrei George, Paul Brown, Richard Vaughan, Ron Lease, Samuel Bosch, Stanley Anozie, Sumit K. Singh, Tom Gueth, Viorel-Marian Moisei, and Wayne Mather, thank you for your input and for helping to improve this book.

Several trusted colleagues and friends also gave invaluable feedback and made the book so much better. Thank you all for your insights and support!

Special thanks to Doug Rudder, my developmental editor, who not only kept the project on track, but also caught me every time I cut corners, further improving the book.

The title of the book says it all: it covers security for ASP.NET Core applications, so it details various threats and risks for web applications based on Microsofts .NET technology. I believe in the show, dont tell principle, so you will see not only APIs and countermeasures, but also how an attack takes place. Real-world incidents will serve as the basis for many of the chapters.