Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

Secure Coding in C# and .NET

Name: Secure Coding in C# and .NET
Rating: 4.6 (173 reviews)

Build secure .NET apps with OWASP, authentication, authorization, data protection, secrets, DevSecOps, and AI tools

Bestseller

Role Play

Created byTrevoir Williams

Last updated 6/2026

English

English [Auto],

What you'll learn

Apply secure coding principles to C# and .NET applications
Identify and fix common OWASP Top 10 vulnerabilities in ASP.NET Core apps
Secure APIs using authentication, authorization, JWT, roles, claims, and policies
Prevent SQL injection, XSS, command injection, insecure deserialization, and excessive data exposure
Protect secrets, connection strings, API keys, and tokens in local and cloud environments
Use encryption, hashing, TLS, and secure logging to protect sensitive data
Review and improve AI-generated code from GitHub Copilot using secure coding practices
Add dependency scanning, static analysis, and secure CI/CD checks to .NET workflows
Apply DevSecOps practices using GitHub Actions, Azure DevOps, Docker, and secure configuration
Build a practical security mindset for designing, coding, testing, and deploying .NET applications

Course content

13 sections • 108 lectures • 8h 8m total length

Introduction3:50

Section Overview0:48
The Cost of Insecure Code2:22
Using CIA Triad for Guidance1:59
Leverage the CIA triad—confidentiality, integrity, and availability—to guide secure code in C# and .NET, ensuring authorized access, unaltered data, and dependable data availability.
The Importance of Secure Coding3:37
Following the OWASP Standards2:08
OWASP Top 10 for .NET Developers8:03
Balancing Security and Deployment Deadlines in Pre-release Discussion
Exploring Common Coding Mistakes3:27
Explore common security mistakes in secure code, from hard-coded secrets and insecure configuration on GitHub to unvalidated input, unhandled exceptions, poor logging, and careless copy-paste with encryption APIs.
Secure Coding Principles3:05
Section Review1:05
Explore common vulnerabilities and how insecure code leads to breaches, and learn to think like an attacker while coding like a defender in .NET.

Section Overview1:08
Learn the stages of secure development and where security fits into design, implementation, and deployment.
Understanding the SSDLC5:14
Threat Modeling in Practice3:53
Introduction to STRIDE methodology and how to identify threats early.
Demo: Performing Threat Modeling on an API9:10
Threat Modeling Demo Code
Preparing Secure Design Checklist11:24
Secure Design Review for an API Architecture
Section Review0:55

Section Overview1:22
Authentication and Common Mistakes5:34
Authentication Patterns in .NET3:37
Explore .NET authentication patterns across web apps, APIs, and SPAs—cookie-based auth with anti-forgery tokens and jwt via OAuth 2.1, plus Open ID Connect and Entra ID for single sign-on.
Section Source Code
Adding ASP.NET Identity to a Web API7:52
Implement secure user registration, login, and logout.
Adding ASP.NET Identity to a Web App2:06
Reviewing Identity User Tables5:39
Implement A Secure Auth Flow - API1:53
Implement A Secure Auth Flow - Web App8:43
Implement a secure web app login with identity pages, anti-forgery protection, and post-based submission. Enforce local redirects and rely on the sign-in manager and cookies to prevent phishing.
Hashing and Salting Passwords8:28
Designing Secure Authentication in ASP.NET Core
Implementing MFA in ASP.NET Identity6:44
Enable MFA via email or authenticator app in an existing .NET app.
Reviewing Authentication Tokens8:23
Implement refresh tokens, token expiry, and revocation policies.
Implementing Secure Authentication Tokens9:58
Implementing Email Confirmation8:07
Implementing User Lockout3:40
Explore implementing user lockout in identity by configuring max failed attempts and lockout duration, enforcing lockout on login attempts, and handling redirect to a lockout page.
Section Review1:32

Section Overview1:02
Principles of Access Control1:55
Role-Based and Claims-Based Authorization Explained1:56
Section Source Code
Implementing Authorization7:09
Apply authorization to APIs and web pages by using the authorize attribute on controllers or actions, optionally allow anonymous for select endpoints, and understand 401 responses and login redirects.
Implementing Roles-Based Authorization9:33
Implementing Claims-Based Authorization- API10:42
Implementing Claims-Based Authorization - Web9:02
Horizontal vs Vertical Access Control7:25
Preventing Broken Access Control and IDOR Vulnerabilities4:53
Diagnosing and Preventing Authorization Flaws in Access Control
Section Review1:20

Section Overview1:17
Bridge security and legal compliance in modern .NET applications by implementing encryption with .NET cryptography libraries, secure logging and auditing, and data retention and deletion policies across industries and regions.
Data Security Basics3:23
Secure data in transit with TLS and in rest with encryption, while controls, logging, and safe storage in .NET apps defend against breaches and PII leaks.
Introduction to Cryptography in .NET5:51
Explore cryptography fundamentals in .NET, including SHA-256 hashing, AES and RSA encryption, the data protection API, key management, and best practices for secure authentication and data protection.
Section Source Code
Detecting Data Security Holes in Code7:08
Audit a sample EF Core project to identify PII. Tag properties with a sensitive attribute and data classification, and plan encryption and PCI DSS controls for card data.
Implementing AES Encryption in C#8:46
Key Generation Commands0:04
Implementing Encryption For Data At Rest11:51
Masking Sensitive Values1:43
Create a sensitive data masking helper in C# to mask national IDs and other values, returning only the last four digits, and integrate it when displaying customer details.
Data Protection API vs. Custom AES2:46
Making Secure Data Protection Decisions for an Application
Encrypting Sensitive Fields with Data Protection APIs6:51
Secure Logging and Auditing Principles4:34
Implementing Secure Logging with ILogger9:30
Implementing Secure and Safe Audit Logging11:30
Implement secure audit logging by hashing sensitive data in a dedicated auditing detail module, then serialize as JSON and persist tamper-proof records via an iAuditLogger.
Building Audit Trails and Tamper-Proof Logs10:22
Build tamper-proof audit logs by chaining each record’s hash to the previous, compute hashes, and verify integrity to detect tampering.
Implementing Compliance and Data Retention Policies - Part 17:41
Implementing Compliance and Data Retention Policies - Part 26:54
Section Review2:15

Section Overview1:33
All Input Is Evil – Understanding Validation Risks2:27
The Importance of Validation5:27
Section Source Code
Understanding XSS Attacks6:47
Preventing XSS Attacks6:46
Understanding SQL Injection4:47
Understand how SQL injection works and why it's a design failure. Learn to defend by always parameterizing queries, using Entity Framework Core, and encoding outputs to prevent data breaches.
Conducting a Code Review for Input Validation and Injection Defense
Exploring Code Vulnerable to SQL Injection7:31
Expose how unparameterized raw SQL in the intakes search endpoint enables SQL injection via query strings, illustrate attack patterns, and outline parameterization and mitigations to prevent data loss.
Preventing SQL Injection Attacks7:25
Hardening API Input Validation - Data Annotations6:12
Hardening API Input Validation - Custom Semantic Validation7:42
Section Review1:01

Section Overview1:12
Develop security-first ci/cd pipelines for .NET apps with GitHub Actions, secure repository configurations, and software composition analysis to detect vulnerabilities and deploy hardened container images.
Secure Deployment Fundamentals (CI/CD Threat Modeling)5:19
Embed security into ci/cd deployments by treating pipelines as security boundaries while applying threat modeling to prevent compromised pull requests, dependencies, and runners.
Section Source Code
Setup a GitHub Repo for Secure CI/CD13:10
Set up a GitHub repository for secure CI/CD by configuring a new repo, setting the default branch to main, and enforcing pull requests with protection rules.
Software Composition Analysis (SCA) Explained3:20
Software composition analysis automatically scans your app for third-party components, detects CVEs and license issues, and flags transitive dependencies in CI/CD to enforce secure, up-to-date packages.
Adding SCA Security Gates with GitHub Actions8:16
Set up a software composition analysis gate with GitHub Actions to block direct main pushes, review dependencies, and enforce secure NuGet packages in pull requests.
Managing Security Risks in a Release Decision Meeting
Configuring Depandabot4:49
Configure dependabot in the .github workflows to run weekly, create PRs with security updates, enforce minimal read permissions, perform dependency reviews, and add license governance for OWASP alignment.
Understanding Secure Container Development3:43
Build and Deploy a Hardened Container with GitHub6:23
Section Review1:35

Requirements

Basic C# experience and the ability to run simple .NET applications
Familiarity with Visual Studio or Visual Studio Code
Basic understanding of APIs, HTTP requests, and databases
No prior cybersecurity experience required

Description

Secure Coding in C# and .NET: Build Safer Applications with OWASP, ASP.NET Core Security, DevSecOps, and AI-Assisted Development

Modern developers cannot afford to treat security as an afterthought. Whether you are building ASP.NET Core APIs, web applications, microservices, or cloud-hosted .NET systems, you need to understand how vulnerabilities happen, how attackers exploit weak code, and how to prevent common security mistakes before they reach production.

In this hands-on course, you will learn how to write secure C# and .NET code using practical techniques based on real application security risks, OWASP guidance, and modern developer workflows. You will work through secure coding practices for authentication, authorization, input validation, data protection, secret management, dependency security, logging, CI/CD pipelines, and AI-assisted development with GitHub Copilot.

This course is designed for C# and .NET developers who want to go beyond making applications work. You will learn how to make them safer, more resilient, and better prepared for real-world security expectations.

What makes this course different?

Most application security courses are broad and language-agnostic. This course focuses on the Microsoft .NET ecosystem. You will see how secure coding concepts apply directly to C#, ASP.NET Core, Entity Framework Core, Identity, JWT, OAuth, OpenID Connect, Azure Key Vault, GitHub Actions, Azure DevOps, Docker, and GitHub Copilot.

You will also learn how AI-generated code can introduce security risks and how to use tools like GitHub Copilot more responsibly during development and review.

What you will learn

You will learn how to:

Apply secure coding principles in C# and .NET applications
Understand OWASP Top 10 risks from a .NET developer’s perspective
Secure ASP.NET Core APIs and web applications
Implement safer authentication and authorization flows
Protect applications from broken access control and privilege escalation
Validate and sanitize user input to reduce injection and XSS risks
Protect sensitive data using encryption, hashing, TLS, and secure storage
Manage secrets safely in local development, GitHub, Azure, and CI/CD workflows
Avoid common security mistakes in configuration and deployment
Use dependency scanning and static analysis to detect vulnerabilities
Review and harden AI-generated code from GitHub Copilot
Build security into the software development lifecycle

Secure authentication and authorization

Authentication and authorization are two of the most common sources of serious application security failures. In this course, you will examine how to protect login flows, tokens, claims, roles, policies, and access rules in ASP.NET Core applications.

You will explore .NET Identity, JWT, OAuth, OpenID Connect, MFA concepts, role-based authorization, claims-based authorization, and practical ways to reduce broken access control vulnerabilities.

Input validation, injection prevention, and safer APIs

You will learn how insecure input handling can lead to SQL injection, command injection, cross-site scripting, insecure deserialization, excessive data exposure, and unsafe business logic. You will use .NET validation tools, custom validators, allowlists, model validation, secure patterns, and practical coding techniques to reduce these risks.

Secret management and data protection

You will learn how to prevent the leakage of credentials, keys, tokens, and connection strings. You will examine safer approaches using local user secrets, environment variables, GitHub secrets, Azure Key Vault, secure configuration practices, and least-privilege access.

You will also learn how to protect sensitive data at rest and in transit using .NET cryptography APIs, hashing, encryption, TLS, and secure logging practices that avoid exposing personally identifiable information.

Secure build and deployment workflows.

Security does not stop when the code compiles. You will learn how to strengthen your build and deployment process using GitHub Actions, Azure DevOps, Docker, dependency vulnerability checks, static code analysis, and secure CI/CD practices.

You will also examine common supply chain security risks and how to reduce exposure in modern .NET development workflows.

Secure AI-assisted development with GitHub Copilot

AI tools can help developers move faster, but faster code is not automatically safer code. This course shows you how to use GitHub Copilot and AI-assisted workflows with a security mindset.

You will learn how to review AI-generated code, identify risky suggestions, ask better security-focused prompts, and use Copilot to help find, explain, and fix vulnerabilities in C# and .NET applications.

Tools and technologies covered

C# and .NET
ASP.NET Core
ASP.NET Core Identity
Entity Framework Core
JWT, OAuth, OpenID Connect, MFA concepts
OWASP Top 10
Azure Key Vault
GitHub Copilot
GitHub Actions
Azure DevOps
Docker
Security Code Scan
OWASP Dependency Check
Secure configuration and secret management

Who this course is for

This course is for:

C# developers who want to write more secure applications
ASP.NET Core developers building APIs, MVC, Razor Pages, or Blazor applications
Backend developers responsible for authentication, authorization, and sensitive data
Software engineers preparing for secure coding expectations in professional teams
DevOps and cloud engineers supporting secure .NET deployments
Students and career changers who want secure coding knowledge as part of their developer portfolio
Architects and team leads who want practical security awareness across the .NET SDLC

Prerequisites

You should have basic experience writing C# code and running .NET applications. You do not need to be a cybersecurity expert. This course is designed to help developers build practical application security skills using familiar .NET tools and workflows.

By the end of the course

By the end of this course, you will understand how common vulnerabilities appear in C# and .NET applications, how to fix them, and how to build safer development habits into your everyday coding workflow. You will be better prepared to develop secure APIs, protect sensitive data, manage secrets, review AI-generated code, and contribute to more secure software delivery.

Who this course is for:

C# and .NET developers who want to write secure code, not just working code
ASP.NET Core developers building APIs, MVC, Razor Pages, Blazor, or cloud-hosted web apps
Backend developers responsible for authentication, authorization, validation, secrets, and sensitive data
Software engineers and architects who need practical OWASP and secure-by-design development skills
DevOps and cloud engineers supporting secure .NET deployments, CI/CD pipelines, and configuration
Students and career changers who want to add secure coding knowledge to their .NET portfolio

Secure Coding in C# and .NET

What you'll learn

Explore related topics

Course content

Introduction1 lecture • 4min

Understanding Common Vulnerabilities10 lectures • 27min

Environment Check5 lectures • 3min

The Secure Software Development Lifecycle (SSDLC)8 lectures • 32min

Secure Authentication in ASP.NET Core17 lectures • 1hr 24min

Authorization and Access Control12 lectures • 55min

Data Security and Compliance in .NET19 lectures • 1hr 42min

Input Validation & Injection Defense13 lectures • 58min

Secure File Uploads and Validation9 lectures • 36min

Secure Automated Deployments11 lectures • 48min

Requirements

Description

Who this course is for: