Advanced ASP.NET Core 3 Security (PDF)

Incorporate security best practices into ASP.NET Core. This book covers security-related features available within the framework, explains where these feature may fall short, and delves into security topics rarely covered elsewhere. Get ready to dive deep into ASP.NET Core 3.1 source code, clarifying how particular features work and addressing how to fix problems.

What You Will Learn

• Discern which attacks are easy to prevent, and which are more challenging, in the framework
• Dig into ASP.NET Core 3.1 sourcecode to understand how the security services work
• Establish a baseline for understanding how to design more secure software
• Properly apply cryptography in software development
• Take a deep dive into web security concepts
• Validate input in a way that allows legitimate traffic but blocks malicious traffic
• Understand parameterized queries and why they are so important to ASP.NET Core
• Fix issues in a well-implemented solution
• Know how the new logging system in ASP.NET Core falls short of security needs
• Incorporate security into your software development process

This book is for software developers who have experience creating websites in ASP.NET and want to know how to make their websites secure from hackers and security professionals who work with a development team that uses ASP.NET Core. A basic understanding of web technologies such as HTML, JavaScript, and CSS is assumed, as is knowledge of how to create a website, and how to read and write C#. You do not need knowledge of security concepts, even those that are often covered in ASP.NET Core documentation.

Scott Norberg is a web security specialist currently based in the Seattle, Washington area. He has almost 15 years of experience successfully delivering software products in a wide range of roles. As a security consultant, he has experience with many testing tools and techniques, including Dynamic (DAST) and Static (SAST) testing, as well as manual testing and reviewing source code. Along with the many websites he has designed and built with various versions of ASP.NET, he has performed security assessments for many more. While his language of choice is C#, he has also built websites, components, and other tools in F#, VB.NET, Python, R, Java, and Pascal. He holds several certifications, including Microsoft Certified Technology Specialist (MCTS), certifications for ASP.NET and SQL Server, and a Certified Information Systems Security Professional (CISSP) certification. He also has an MBA from Indiana University.