0

I am working on my first asp MVC project that will ultimately end up on a publicly accessible web server (I have worked on some internal apps in MVC). What techniques, practices should I be thinking about (specific to MVC or otherwise) to improve security.

Off the top of my head obviously there is the AcceptVerb attribute for actions and Validation what else?

Michael Gattuso
  • 13,020
  • 2
  • 25
  • 29

3 Answers3

1

Anti Forgery Token :)

brianng
  • 5,790
  • 1
  • 32
  • 23
  • Ah yes, had a fun time with this with JQuery ajax posts. See my other post http://stackoverflow.com/questions/1786500/using-validateantiforgerytoken-with-ajax-actionlink – Michael Gattuso Dec 03 '09 at 15:24
1

A couple of points:

  • Encode every user input
  • Use anti forgery tokens
  • Use POST verbs for every request that modifies state
Darin Dimitrov
  • 1,023,142
  • 271
  • 3,287
  • 2,928
1

The Windows Live team has written a white-paper describing lessons learned using ASP.NET MVC on certain Windows Live properties. They do a lot of security analysis and present their security tips here:

http://www.microsoft.com/downloads/details.aspx?FamilyID=7606f801-70c5-49ca-a18c-91d4ed725833&displaylang=en

Haacked
  • 58,045
  • 14
  • 90
  • 114