Hacking the Code

Chapter 1 Managing Users
Introduction
Understanding the Threats
Establishing User Credentials
Enforcing Strong Passwords
Avoiding Easily Guessed Credentials
Preventing Credential Harvesting
Limiting Idle Accounts
Managing Passwords
Storing Passwords
Password Aging and Histories
Changing Passwords
Resetting Lost or Forgotten Passwords
Resetting Passwords
Sending Information Via E-Mail
Assigning Temporary Passwords
Using Secret Questions
Empowering Users
Educating Users
Involving Users
Coding Standards Fast Track
Establishing User Credentials
Managing Passwords
Resetting Lost or Forgotten Passwords
Empowering Users
Code Audit Fast Track
Establishing User Credentials
Managing Passwords
Resetting Lost or Forgotten Passwords
Empowering Users
Frequently Asked Questions
Chapter 2 Authenticating and Authorizing Users
Introduction
Understanding the Threats
Authenticating Users
Building Login Forms
Using Forms Authentication
Using Windows Authentication
Using Passport Authentication
Blocking Brute-Force Attacks
Authorizing Users
Deciding How to Authorize
Employing File Authorization
Applying URL Authorization
Authorizing Users Through Code
Coding Standards Fast Track
Authenticating Users
Authorizing Users
Code Audit Fast Track
Authenticating Users
Authorizing Users
Frequently Asked Questions
Chapter 3 Managing Sessions
Introduction
Session Tokens
Authentication Tokens
Understanding the Threats
Maintaining State
Designing a Secure Token
Selecting a Token Mechanism
Using State Providers
Using ASP.NET Tokens
Using Cookies
Working with View State
Enhancing ASP.NET State Management
Creating Tokens
Terminating Sessions
Coding Standards Fast Track
Maintaining State
Using ASP.NET Tokens
Enhancing ASP.NET State Management
Code Audit Fast Track
Maintaining State
Using ASP.NET Tokens
Enhancing ASP.NET State Management
Frequently Asked Questions
Chapter 4 Encrypting Private Data
Introduction
Using Cryptography in ASP.NET
Employing Symmetric Cryptography
Using Asymmetric Cryptography
Working with Hashing Algorithms
Working with .NET Encryption Features
Creating Random Numbers
Keeping Memory Clean
Protecting Secrets
Protecting Communications with SSL
Coding Standards Fast Track
Using Cryptography in ASP.NET
Working with .NET Encryption Features
Code Audit Fast Track
Using Cryptography in ASP.NET
Working with .NET Encryption Features
Frequently Asked Questions
Chapter 5 Filtering User Input
Introduction
Handling Malicious Input
Identifying Input Sources
Programming Defensively
Constraining Input
Bounds Checking
Pattern Matching
Data Reflecting
Encoding Data
Encapsulating
Parameterizing
Double Decoding
Syntax Checking
Exception Handling
Honey Drops
Limiting Exposure to Malicious Input
Reducing the Attack Surface
Limiting Attack Scope
Hardening Server Applications
Coding Standards Fast Track
Handling Malicious Input
Constraining Input
Limiting Exposure to Malicious Input
Code Audit Fast Track
Handling Malicious Input
Limiting Exposure to Malicious Input
Frequently Asked Questions
Chapter 6 Accessing Data
Introduction
Securing Databases
Securing the Database Location
Limiting the Attack Surface
Ensuring Least Privilege
Securing the Database
Writing Secure Data Access Code
Connecting to the Data Source
Preventing SQL Injection
Writing Secure SQL Code
Reading and Writing to Data Files
Coding Standards Fast Track
Securing Database Drivers
Securing Databases
Writing Secure Data Access Code
Code Audit Fast Track
Securing Database Drivers
Securing the Database
Writing Secure Data Access Code
Frequently Asked Questions
Chapter 7 Developing Secure ASP.NET Applications
Introduction
Understanding the Threats
Writing Secure HTML
Constructing Safe HTML
Preventing Information Leaks
Handling Exceptions
Using Structured Error Handling
Reporting and Logging Errors
Coding Standards Fast Track
Writing Secure HTML
Handling Exceptions
Code Audit Fast Track
Writing Secure HTML
Handling Exceptions
Frequently Asked Questions
Chapter 8 Securing XML
Introduction
Applying XML Encryption
Encrypting XML Data
Applying XML Digital Signatures
Signing XML Data
Coding Standards Fast Track
Applying XML Encryption
Applying XML Digital Signatures
Coding Audit Fast Track
Applying XML Encryption
Applying XML Digital Signatures
Frequently Asked Questions
Appendix A Understanding .NET Security
Introduction
Permissions
Principal
Authentication
Authorization
Security Policy
Type Safety
Code Access Security
.NET Code Access Security Model
Role-Based Security
Principals
Role-Based Security Checks
Security Policies
Creating a New Permission Set
Modifying the Code Group Structure
Remoting Security
Cryptography
Security Tools
Summary
Security Fast Track
Frequently Asked Questions
Appendix B Glossary of Web Application Security Threats
Index