Make a ASP.NET MVC application really secure

Question

I am creating an ASP.NET MVC 3 web application which is used for looking up very private data at home. The data is stored in a database on the server, on which the IIS-Server is running. Since I have finished most parts of the actual programming, I want to make the application as secure as possible. I am already using https, but I guess this won't be enough. What I'm looking for is something like... sending the data requested encrypted over the wire and decrypt it at the client locally, or something like that.

Anyone, ideas?

Web application security is a massive field. No single thing, or simple combination of things, are going to "make you secure". Do a lot of research and ensure that principles and processes are carefully followed. One good place to start, regarding your own source code is the OWASP top ten owasp.org/index.php/Category:OWASP_Top_Ten_Project — Cheekysoft
– Cheekysoft, Commented Dec 28, 2011 at 14:29

Yag · Accepted Answer · 2011-12-28 16:39:16Z

6

The best resource I've found about web security with ASP.NET is the below, written by Troy Hunt:

OWASP TOP 10 for .NET developers

Absolutely priceless!

He even made an ebook out of it that you can download as a pdf:

ebook

answered Dec 28, 2011 at 16:39

Yag

5462 gold badges7 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Darin Dimitrov · Accepted Answer · 2011-12-28 13:04:26Z

3

What I'm looking for is something like... sending the data requested encrypted over the wire and decrypt it at the client locally, or something like that.

That's exactly what SSL is designed to do.

answered Dec 28, 2011 at 13:04

Darin Dimitrov

1.0m276 gold badges3.3k silver badges3k bronze badges

6 Comments

Kevin Suppan Over a year ago

Well, I was told that SSL isn't secured ENOUGH... Is there any other way to make it even more secure? I am busted if there's leaked any data =)

Darin Dimitrov Over a year ago

@HaraldJoerg, WOW, dunno by who you were told this but if this is the case we might all consider stop doing online banking as all banks use it. And, you know, banks deal with money so they have interest in having secure websites.

Mike Nakis Over a year ago

What he was told probably referred to adding some login screen and making sure his site is not vulnerable to sql injection attacks and the like.

Darin Dimitrov Over a year ago

@MikeNakis, well, we cannot know what he was told. We cannot read other people's minds. At least I can't.

Giedrius Over a year ago

Well, may he was reffering to this: theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl

|

Community · Accepted Answer · 2017-05-23 12:11:59Z

2

You might want to read about XSS (cross site scripting) and SQL Injection. SSL is secure enough to transport your data so that it won't be able to be read if intercepted, but it doesn't mean that your site can't be hacked.

What makes an input vulnerable to XSS?

What is SQL injection?

edited May 23, 2017 at 12:11

CommunityBot

11 silver badge

answered Dec 28, 2011 at 13:13

MattW

13.2k5 gold badges42 silver badges65 bronze badges

Comments

K. Bob · Accepted Answer · 2011-12-28 14:11:04Z

-1

If SSL on it's own isn't 'good' enough, how about looking at Client Certificates as well ?

answered Dec 28, 2011 at 14:11

K. Bob

2,6881 gold badge20 silver badges16 bronze badges

Collectives™ on Stack Overflow

Make a ASP.NET MVC application really secure

4 Answers 4

Comments

6 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

6 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related