In ASP.NET Core the authorization mechanism is well exposed for MVC, but not for middleware. This post shows how it can be fully utilized while configuring middleware pipeline.

How to store sensitive configuration data safely and easily in .NET Core runtime environment.

One of the most important things during a penetration test is to gain access to administrator account. If the application (for example webserver) is well configured, it is most often run with limited user rights, only able to run a specific application. When we can get low privileges access to the server using some vulnerability, the next step is to get higher permissions to read important files, continue network exploration etc. To do this, we must use the privilege escalation technique.

Password managers are very popular these days. There are some that store your passwords locally (e.g., KeePass), but vast majority store your passwords online. Two, most popular ones are 1password and LastPass. All online password managers claim they are secure. But do you know that for sure?

Security headers are a subset of http response headers that, when sent by the server, allow the web application to tell the web browser to enable or configure certain security-related behaviours. The article presents a list of the most important Security Headers, shows their impact on web application security and provides resources that can be useful in the implementation of best practices in your own application.

Pora na już drugą cześć cyklu o projektowaniu bezpiecznych aplikacji ASP.NET Core. Dzisiaj opowiem o ataku XSS, czym jest i co zrobić żeby nasza witryna była na niego odporna. Czym jest XSS? Najkrócej mówiąc jest atakiem na webaplikacje, polegającym na wstrzyknięciu do przeglądarki złośliwego kodu, najczęściej javascript.

Google's Certificate Transparency project is an open framework for monitoring and auditing SSL certificates. Starting April 2018 Chrome will require compliance with Certificate Transparency. Expect-CT Extension for HTTP will introduce a way to test the Certificate Transparency policy and this article shows how it can be used once it arrives.

First bunch of features are done and it’s time to look at very important matter – security. As long as we create apps only for ourselves we don’t care about it. Sometimes we release one of those applications somewhere on the Internet and we still don’t care about security. Why? We forgot o...

Nowadays, the HTTP APIs act as gateways for petabytes of data and some chunk of it might actually require enhanced access rules. For example, you could create a link that allows the user to download the file only once, and within such link you would find a token. I was in a need of creating such solution for my open source project Warden – a specialized, one-time link that can be used fetch the configuration object from the API. It turned out to be fairly straightforward to implement the most basic versi...

Opis architektury rozwiązania AppSensor.NET