SlideShare uma empresa Scribd logo

Asp.net mvc security

•Transferir como PPTX, PDF•
•
L
LearningTech
Tecnologia
1 de 16
ASP.NET MVC Security Jason
XSS  Cross-site  Scripting (XSS) XSS 是一種技術，惡意的使用者能夠利用它操作 系統，導致特殊的 JavaScript 出現在這些易受 攻擊的網站—所有拜訪的瀏覽器隨後將執行這些 JavaScript 。
狀況一
狀況二 Save Action Save.cshtml
狀況三 Save Action Save.cshtml
 假設不加上  ValidateInput(false) 還有其他方式，可以讓某個屬性允許 html ?
XSRF  Cross  Site Request Forgery(XSRF/CSRF) 是一種攻擊類型，攻擊的網站顯示一表單給使用 者，提交後便發出請求給有漏洞的 Web 應用程 式。
Attack
預防 XSRF  ValidateAntiForgeryTokenAttribute  Represents an attribute that is used to prevent forgery of a request.
Save Action Index.cshtml
Attack
Custom Exception Error Page Save Action WebConfig
Attack
Q&A

Recomendados

Telligem 1_xss
Telligem 1_xssTelligem 1_xss
Telligem 1_xsspaitoubing
 
Web前端 安全须知 拔赤
Web前端 安全须知 拔赤Web前端 安全须知 拔赤
Web前端 安全须知 拔赤jay li
 
浏览器的跨域安全问题
浏览器的跨域安全问题浏览器的跨域安全问题
浏览器的跨域安全问题guest4ca427
 
BUILDING WEB APPS WITH ASP.NET MVC AND NOSQL
BUILDING WEB APPS WITH ASP.NET MVC AND NOSQLBUILDING WEB APPS WITH ASP.NET MVC AND NOSQL
BUILDING WEB APPS WITH ASP.NET MVC AND NOSQLMichael Kennedy
 
Web API authentication and authorization
Web API authentication and authorization Web API authentication and authorization
Web API authentication and authorization Chalermpon Areepong
 
Authentication, Authorization, and Identity – More than meets the eye…
Authentication, Authorization, and Identity – More than meets the eye…Authentication, Authorization, and Identity – More than meets the eye…
Authentication, Authorization, and Identity – More than meets the eye…Scott Hoag
 
Iasi code camp 12 october 2013 corneliu rimboiu - bridging java and .net
Iasi code camp 12 october 2013 corneliu rimboiu - bridging java and .netIasi code camp 12 october 2013 corneliu rimboiu - bridging java and .net
Iasi code camp 12 october 2013 corneliu rimboiu - bridging java and .netCodecamp Romania
 
ZZ BC#8 Hello ASP.NET MVC 4 (dks)
ZZ BC#8 Hello ASP.NET MVC 4 (dks)ZZ BC#8 Hello ASP.NET MVC 4 (dks)
ZZ BC#8 Hello ASP.NET MVC 4 (dks)Chalermpon Areepong
 

Recomendados

Telligem 1_xss
Telligem 1_xssTelligem 1_xss
Telligem 1_xsspaitoubing
 
Web前端 安全须知 拔赤
Web前端 安全须知 拔赤Web前端 安全须知 拔赤
Web前端 安全须知 拔赤jay li
 
浏览器的跨域安全问题
浏览器的跨域安全问题浏览器的跨域安全问题
浏览器的跨域安全问题guest4ca427
 
BUILDING WEB APPS WITH ASP.NET MVC AND NOSQL
BUILDING WEB APPS WITH ASP.NET MVC AND NOSQLBUILDING WEB APPS WITH ASP.NET MVC AND NOSQL
BUILDING WEB APPS WITH ASP.NET MVC AND NOSQLMichael Kennedy
 
Web API authentication and authorization
Web API authentication and authorization Web API authentication and authorization
Web API authentication and authorization Chalermpon Areepong
 
Authentication, Authorization, and Identity – More than meets the eye…
Authentication, Authorization, and Identity – More than meets the eye…Authentication, Authorization, and Identity – More than meets the eye…
Authentication, Authorization, and Identity – More than meets the eye…Scott Hoag
 
Iasi code camp 12 october 2013 corneliu rimboiu - bridging java and .net
Iasi code camp 12 october 2013 corneliu rimboiu - bridging java and .netIasi code camp 12 october 2013 corneliu rimboiu - bridging java and .net
Iasi code camp 12 october 2013 corneliu rimboiu - bridging java and .netCodecamp Romania
 
ZZ BC#8 Hello ASP.NET MVC 4 (dks)
ZZ BC#8 Hello ASP.NET MVC 4 (dks)ZZ BC#8 Hello ASP.NET MVC 4 (dks)
ZZ BC#8 Hello ASP.NET MVC 4 (dks)Chalermpon Areepong
 
Performance in .net best practices
Performance in .net best practicesPerformance in .net best practices
Performance in .net best practicesCodecamp Romania
 
Scalable Resilient Web Services In .Net
Scalable Resilient Web Services In .NetScalable Resilient Web Services In .Net
Scalable Resilient Web Services In .NetBala Subra
 
DDD Melbourne 2014 security in ASP.Net Web API 2
DDD Melbourne 2014 security in ASP.Net Web API 2DDD Melbourne 2014 security in ASP.Net Web API 2
DDD Melbourne 2014 security in ASP.Net Web API 2Pratik Khasnabis
 
Smooth Sort
Smooth SortSmooth Sort
Smooth Sorthabib_786
 
Design & Deploy a data-driven Web API in 2 hours
Design & Deploy a data-driven Web API in 2 hoursDesign & Deploy a data-driven Web API in 2 hours
Design & Deploy a data-driven Web API in 2 hoursRestlet
 
Secure RESTful Web Services for ASP.NET Web API
Secure RESTful Web Services for ASP.NET Web APISecure RESTful Web Services for ASP.NET Web API
Secure RESTful Web Services for ASP.NET Web APIRob Daigneau
 
End to End Security with MVC and Web API
End to End Security with MVC and Web APIEnd to End Security with MVC and Web API
End to End Security with MVC and Web APIMichele Leroux Bustamante
 
Building Scalable .NET Web Applications
Building Scalable .NET Web ApplicationsBuilding Scalable .NET Web Applications
Building Scalable .NET Web ApplicationsBuu Nguyen
 
Tips and Tricks For Faster Asp.NET and MVC Applications
Tips and Tricks For Faster Asp.NET and MVC ApplicationsTips and Tricks For Faster Asp.NET and MVC Applications
Tips and Tricks For Faster Asp.NET and MVC ApplicationsSarvesh Kushwaha
 
ASP.NET Core 1.0 Overview: Post-RC2
ASP.NET Core 1.0 Overview: Post-RC2ASP.NET Core 1.0 Overview: Post-RC2
ASP.NET Core 1.0 Overview: Post-RC2Shahed Chowdhuri
 
Overview of the .Net Collection Framework and Immutable Collections
Overview of the .Net Collection Framework and Immutable CollectionsOverview of the .Net Collection Framework and Immutable Collections
Overview of the .Net Collection Framework and Immutable CollectionsYoshifumi Kawai
 
5. web api 2 aspdotnet-mvc5-slides
5. web api 2 aspdotnet-mvc5-slides5. web api 2 aspdotnet-mvc5-slides
5. web api 2 aspdotnet-mvc5-slidesMasterCode.vn
 
ASP.NET Core MVC + Web API with Overview (Post RC2)
ASP.NET Core MVC + Web API with Overview (Post RC2)ASP.NET Core MVC + Web API with Overview (Post RC2)
ASP.NET Core MVC + Web API with Overview (Post RC2)Shahed Chowdhuri
 
Scaling asp.net websites to millions of users
Scaling asp.net websites to millions of usersScaling asp.net websites to millions of users
Scaling asp.net websites to millions of usersoazabir
 
10 performance and scalability secrets of ASP.NET websites
10 performance and scalability secrets of ASP.NET websites10 performance and scalability secrets of ASP.NET websites
10 performance and scalability secrets of ASP.NET websitesoazabir
 
ASP.NET Mvc 4 web api
ASP.NET Mvc 4 web apiASP.NET Mvc 4 web api
ASP.NET Mvc 4 web apiTiago Knoch
 
Learning ASP.NET 5 and MVC 6
Learning ASP.NET 5 and MVC 6Learning ASP.NET 5 and MVC 6
Learning ASP.NET 5 and MVC 6Ido Flatow
 
ASP.NET MVC Performance
ASP.NET MVC PerformanceASP.NET MVC Performance
ASP.NET MVC Performancerudib
 
Rest API Security
Rest API SecurityRest API Security
Rest API SecurityStormpath
 
Web API or WCF - An Architectural Comparison
Web API or WCF - An Architectural ComparisonWeb API or WCF - An Architectural Comparison
Web API or WCF - An Architectural ComparisonAdnan Masood
 
vim
vimvim
vimLearningTech
 
PostCss
PostCssPostCss
PostCssLearningTech
 

Mais conteúdo relacionado

Destaque

Performance in .net best practices
Performance in .net best practicesPerformance in .net best practices
Performance in .net best practicesCodecamp Romania
 
Scalable Resilient Web Services In .Net
Scalable Resilient Web Services In .NetScalable Resilient Web Services In .Net
Scalable Resilient Web Services In .NetBala Subra
 
DDD Melbourne 2014 security in ASP.Net Web API 2
DDD Melbourne 2014 security in ASP.Net Web API 2DDD Melbourne 2014 security in ASP.Net Web API 2
DDD Melbourne 2014 security in ASP.Net Web API 2Pratik Khasnabis
 
Design & Deploy a data-driven Web API in 2 hours
Design & Deploy a data-driven Web API in 2 hoursDesign & Deploy a data-driven Web API in 2 hours
Design & Deploy a data-driven Web API in 2 hoursRestlet
 
Secure RESTful Web Services for ASP.NET Web API
Secure RESTful Web Services for ASP.NET Web APISecure RESTful Web Services for ASP.NET Web API
Secure RESTful Web Services for ASP.NET Web APIRob Daigneau
 
Building Scalable .NET Web Applications
Building Scalable .NET Web ApplicationsBuilding Scalable .NET Web Applications
Building Scalable .NET Web ApplicationsBuu Nguyen
 
Tips and Tricks For Faster Asp.NET and MVC Applications
Tips and Tricks For Faster Asp.NET and MVC ApplicationsTips and Tricks For Faster Asp.NET and MVC Applications
Tips and Tricks For Faster Asp.NET and MVC ApplicationsSarvesh Kushwaha
 
ASP.NET Core 1.0 Overview: Post-RC2
ASP.NET Core 1.0 Overview: Post-RC2ASP.NET Core 1.0 Overview: Post-RC2
ASP.NET Core 1.0 Overview: Post-RC2Shahed Chowdhuri
 
Overview of the .Net Collection Framework and Immutable Collections
Overview of the .Net Collection Framework and Immutable CollectionsOverview of the .Net Collection Framework and Immutable Collections
Overview of the .Net Collection Framework and Immutable CollectionsYoshifumi Kawai
 
5. web api 2 aspdotnet-mvc5-slides
5. web api 2 aspdotnet-mvc5-slides5. web api 2 aspdotnet-mvc5-slides
5. web api 2 aspdotnet-mvc5-slidesMasterCode.vn
 
ASP.NET Core MVC + Web API with Overview (Post RC2)
ASP.NET Core MVC + Web API with Overview (Post RC2)ASP.NET Core MVC + Web API with Overview (Post RC2)
ASP.NET Core MVC + Web API with Overview (Post RC2)Shahed Chowdhuri
 
Scaling asp.net websites to millions of users
Scaling asp.net websites to millions of usersScaling asp.net websites to millions of users
Scaling asp.net websites to millions of usersoazabir
 
10 performance and scalability secrets of ASP.NET websites
10 performance and scalability secrets of ASP.NET websites10 performance and scalability secrets of ASP.NET websites
10 performance and scalability secrets of ASP.NET websitesoazabir
 
ASP.NET Mvc 4 web api
ASP.NET Mvc 4 web apiASP.NET Mvc 4 web api
ASP.NET Mvc 4 web apiTiago Knoch
 
Learning ASP.NET 5 and MVC 6
Learning ASP.NET 5 and MVC 6Learning ASP.NET 5 and MVC 6
Learning ASP.NET 5 and MVC 6Ido Flatow
 
ASP.NET MVC Performance
ASP.NET MVC PerformanceASP.NET MVC Performance
ASP.NET MVC Performancerudib
 
Rest API Security
Rest API SecurityRest API Security
Rest API SecurityStormpath
 
Web API or WCF - An Architectural Comparison
Web API or WCF - An Architectural ComparisonWeb API or WCF - An Architectural Comparison
Web API or WCF - An Architectural ComparisonAdnan Masood
 

Destaque (20)

Performance in .net best practices
Performance in .net best practicesPerformance in .net best practices
Performance in .net best practices
 
Scalable Resilient Web Services In .Net
Scalable Resilient Web Services In .NetScalable Resilient Web Services In .Net
Scalable Resilient Web Services In .Net
 
DDD Melbourne 2014 security in ASP.Net Web API 2
DDD Melbourne 2014 security in ASP.Net Web API 2DDD Melbourne 2014 security in ASP.Net Web API 2
DDD Melbourne 2014 security in ASP.Net Web API 2
 
Smooth Sort
Smooth SortSmooth Sort
Smooth Sort
 
Design & Deploy a data-driven Web API in 2 hours
Design & Deploy a data-driven Web API in 2 hoursDesign & Deploy a data-driven Web API in 2 hours
Design & Deploy a data-driven Web API in 2 hours
 
Secure RESTful Web Services for ASP.NET Web API
Secure RESTful Web Services for ASP.NET Web APISecure RESTful Web Services for ASP.NET Web API
Secure RESTful Web Services for ASP.NET Web API
 
End to End Security with MVC and Web API
End to End Security with MVC and Web APIEnd to End Security with MVC and Web API
End to End Security with MVC and Web API
 
Building Scalable .NET Web Applications
Building Scalable .NET Web ApplicationsBuilding Scalable .NET Web Applications
Building Scalable .NET Web Applications
 
Tips and Tricks For Faster Asp.NET and MVC Applications
Tips and Tricks For Faster Asp.NET and MVC ApplicationsTips and Tricks For Faster Asp.NET and MVC Applications
Tips and Tricks For Faster Asp.NET and MVC Applications
 
ASP.NET Core 1.0 Overview: Post-RC2
ASP.NET Core 1.0 Overview: Post-RC2ASP.NET Core 1.0 Overview: Post-RC2
ASP.NET Core 1.0 Overview: Post-RC2
 
Overview of the .Net Collection Framework and Immutable Collections
Overview of the .Net Collection Framework and Immutable CollectionsOverview of the .Net Collection Framework and Immutable Collections
Overview of the .Net Collection Framework and Immutable Collections
 
5. web api 2 aspdotnet-mvc5-slides
5. web api 2 aspdotnet-mvc5-slides5. web api 2 aspdotnet-mvc5-slides
5. web api 2 aspdotnet-mvc5-slides
 
ASP.NET Core MVC + Web API with Overview (Post RC2)
ASP.NET Core MVC + Web API with Overview (Post RC2)ASP.NET Core MVC + Web API with Overview (Post RC2)
ASP.NET Core MVC + Web API with Overview (Post RC2)
 
Scaling asp.net websites to millions of users
Scaling asp.net websites to millions of usersScaling asp.net websites to millions of users
Scaling asp.net websites to millions of users
 
10 performance and scalability secrets of ASP.NET websites
10 performance and scalability secrets of ASP.NET websites10 performance and scalability secrets of ASP.NET websites
10 performance and scalability secrets of ASP.NET websites
 
ASP.NET Mvc 4 web api
ASP.NET Mvc 4 web apiASP.NET Mvc 4 web api
ASP.NET Mvc 4 web api
 
Learning ASP.NET 5 and MVC 6
Learning ASP.NET 5 and MVC 6Learning ASP.NET 5 and MVC 6
Learning ASP.NET 5 and MVC 6
 
ASP.NET MVC Performance
ASP.NET MVC PerformanceASP.NET MVC Performance
ASP.NET MVC Performance
 
Rest API Security
Rest API SecurityRest API Security
Rest API Security
 
Web API or WCF - An Architectural Comparison
Web API or WCF - An Architectural ComparisonWeb API or WCF - An Architectural Comparison
Web API or WCF - An Architectural Comparison
 

Mais de LearningTech

Process control nodejs
Process control nodejsProcess control nodejs
Process control nodejsLearningTech
 
Vic weekly learning_20160504
Vic weekly learning_20160504Vic weekly learning_20160504
Vic weekly learning_20160504LearningTech
 
Reflection & activator
Reflection & activatorReflection & activator
Reflection & activatorLearningTech
 
Node child process
Node child processNode child process
Node child processLearningTech
 
Peggy elasticsearch應用
Peggy elasticsearch應用Peggy elasticsearch應用
Peggy elasticsearch應用LearningTech
 
Vic weekly learning_20160325
Vic weekly learning_20160325Vic weekly learning_20160325
Vic weekly learning_20160325LearningTech
 
D3js learning tips
D3js learning tipsD3js learning tips
D3js learning tipsLearningTech
 

Mais de LearningTech (20)

vim
vimvim
vim
 
PostCss
PostCssPostCss
PostCss
 
ReactJs
ReactJsReactJs
ReactJs
 
Docker
DockerDocker
Docker
 
Semantic ui
Semantic uiSemantic ui
Semantic ui
 
node.js errors
node.js errorsnode.js errors
node.js errors
 
Process control nodejs
Process control nodejsProcess control nodejs
Process control nodejs
 
Expression tree
Expression treeExpression tree
Expression tree
 
SQL 效能調校
SQL 效能調校SQL 效能調校
SQL 效能調校
 
flexbox report
flexbox reportflexbox report
flexbox report
 
Vic weekly learning_20160504
Vic weekly learning_20160504Vic weekly learning_20160504
Vic weekly learning_20160504
 
Reflection & activator
Reflection & activatorReflection & activator
Reflection & activator
 
Peggy markdown
Peggy markdownPeggy markdown
Peggy markdown
 
Node child process
Node child processNode child process
Node child process
 
20160415ken.lee
20160415ken.lee20160415ken.lee
20160415ken.lee
 
Peggy elasticsearch應用
Peggy elasticsearch應用Peggy elasticsearch應用
Peggy elasticsearch應用
 
Expression tree
Expression treeExpression tree
Expression tree
 
Vic weekly learning_20160325
Vic weekly learning_20160325Vic weekly learning_20160325
Vic weekly learning_20160325
 
D3js learning tips
D3js learning tipsD3js learning tips
D3js learning tips
 
git command
git commandgit command
git command
 

Asp.net mvc security