ASP.NET Security Best Practices [closed]

Answer 1

You could be interested in this article Security Best Practices: ASP.NET Applications. HTH

Answer 2

Check out the new Security Runtime Engine (beta came out on November 14):

http://blogs.msdn.com/cisg/archive/2008/10/24/a-sneak-peak-at-the-security-runtime-engine.aspx

http://blogs.msdn.com/cisg/archive/2008/11/13/an-update-on-some-upcoming-free-tools.aspx

This should replace the current Anti-XSS library.

Anthony :-) www.codersbarn.com

Answer 3

I found Microsoft's Developer Highway Code to be a useful security checklist.

Answer 4

While displaying content from database on the page, you may use HttpServerUtility.HtmlEncode to encode output to avoid Cross site scripting (XSS) attacks.

Answer 5

1. Never store sensitive information like passwords in cookies.
2. Don't display system error messages, stack traces etc. in case of exception.

Answer 6

Microsoft has a lot to say about this subject:

• ASP.NET Web Application Security.
• Improving Web Application Security (an entire book dedicated to the subject)