Secure Coding in C# and .NET

Identify common vulnerabilities and the costs of insecure code in real-world systems. Apply secure coding practices to mitigate risks in C# and .NET by recognizing the OWASP top 10 threats.

Explore the true cost of insecure code, including data loss, downtime, regulatory fines, and damaged trust, especially for enterprise apps handling sensitive data, PII, and API keys.

Leverage the CIA triad—confidentiality, integrity, and availability—to guide secure code in C# and .NET, ensuring authorized access, unaltered data, and dependable data availability.

Write secure code by thinking like an attacker to prevent exploitations. Integrate security across the software development life cycle with threat modeling, testing, code reviews, and .NET APIs.

Explore OWASP, the open web application security project, and its key initiatives - top 10, ASVS, proactive controls, cheat sheets, and ZAP - that guide secure coding, audits, and frameworks.

Explore how .NET developers map to the OWASP top 10, covering broken access control, cryptographic failures, injection, insecure design, security misconfiguration, and vulnerabilities with secure coding guidance and regulatory context.

Explore common security mistakes in secure code, from hard-coded secrets and insecure configuration on GitHub to unvalidated input, unhandled exceptions, poor logging, and careless copy-paste with encryption APIs.

Apply least privilege and defense in depth across application layers, fail securely, validate input, use parameterized queries, and rely on ASP.NET Core packages, encrypting data at rest and in transit.

Explore common vulnerabilities and how insecure code leads to breaches, and learn to think like an attacker while coding like a defender in .NET.

Set up a cross-platform development environment with Visual Studio Code, C-Sharp DevKit, and Rider; run sanity checks with dotnet-info and git-version to ensure parity across editors.

Understand how the secure software development lifecycle extends the SDLC to integrate security at every phase, with threat modeling, shift left, least privilege, and fail-safe defaults.

Frame a threat modeling exercise on a sample api, draw a threat model diagram, identify assets, entry points, and dependencies, apply stride, rate risks, and translate threats into mitigations.

Identify assets, dependencies, and entry points, then apply stride and the cia triad to guide secure design and mitigations.

Review the secure SDLC and threat modeling techniques, plus a hands-on threat modeling exercise, emphasizing continuous evaluation, documentation, and securing an ASP.NET Core application.

Explore secure authentication in ASP.NET Core to protect user identities, differentiate authentication from authorization, and implement ASP.NET Identity, password hashing, multi-factor authentication, and token protection in API and web apps.

Differentiate authentication and authorization to clarify access control. The lecture highlights common authentication mistakes, such as avoiding hard-coded credentials, enforcing https, and securing cookies or tokens.

Explore .NET authentication patterns across web apps, APIs, and SPAs—cookie-based auth with anti-forgery tokens and jwt via OAuth 2.1, plus Open ID Connect and Entra ID for single sign-on.

Learn how to add ASP.NET Identity to a web app, using cookie-based authentication with default UI, and contrast it with API token authentication, all under identity at the helm.

Discover how EF Core identity creates SQLite tables for ASP.NET users, roles, and the user roles join table, with fields such as username, email, and password hash.

Learn to harden the api authentication flow by validating login and register requests with required data annotations, using generic invalid credentials messages and 400 errors to prevent user existence disclosure.

Implement a secure web app login with identity pages, anti-forgery protection, and post-based submission. Enforce local redirects and rely on the sign-in manager and cookies to prevent phishing.

Hash and salt passwords to thwart brute force and rainbow table attacks. See how ASP.NET Core's password hasher uses HMAC-SHA256 and per-user salts to secure login and stored hashes.

Configure secure authentication tokens by using expires hours, iat and amr, validate issuer, audience, and lifetime, and store the signing key in user secrets while testing with jwt.io.

Enforce email confirmation (and optional phone verification) before login to prevent spoof accounts, configure smtp and iEmailSender in program.cs, and send a verification token via papercut smtp.

Explore implementing user lockout in identity by configuring max failed attempts and lockout duration, enforcing lockout on login attempts, and handling redirect to a lockout page.

Review authentication versus authorization and implement asp.net core identity to securely extend identity, hash sensitive data, enable MFA, and validate claims to prevent replay attacks.

Explore the key principles of access control and authorization, compare role-based and claims-based models, and configure custom policies to enforce fine-grained, role-level security and prevent broken access control.

Explain principles of access control and common vulnerabilities like broken access control and insecure direct object references, and compare RBAC and ABAC models that enforce minimum rights and protect resources.

Explore role-based authorization in .NET, using authorize tags to restrict access by authenticated users and roles like admin, manager, and regular user, including overlapping permissions and hierarchical nuances.

Apply authorization to APIs and web pages by using the authorize attribute on controllers or actions, optionally allow anonymous for select endpoints, and understand 401 responses and login redirects.

Learn to implement roles-based authorization in .NET by securing API endpoints and Razor pages with authorize attributes and role claims.

Explore claims-based authorization by using http context user and jwt claims, add custom claims, and enforce policies like require it department via authorize to protect api endpoints.

Implement claims-based authorization in a web app by storing department claims in a database, extending cookie authentication with a custom claims factory, and enforcing policies on the privacy page.

Explain horizontal and vertical access control, enforce least privilege with role-based authorization and policies, validate user ownership in the backend to prevent broken access controls.

Implement a task owner authorization policy in a .NET app by creating a custom task owner requirement and handler, enabling one-line access checks and consistent access control.

Learn to implement authorization in a .NET core app using least privilege, role-based and claims-based access control, and custom policies to audit and mitigate broken access control.

Bridge security and legal compliance in modern .NET applications by implementing encryption with .NET cryptography libraries, secure logging and auditing, and data retention and deletion policies across industries and regions.

Secure data in transit with TLS and in rest with encryption, while controls, logging, and safe storage in .NET apps defend against breaches and PII leaks.

Explore cryptography fundamentals in .NET, including SHA-256 hashing, AES and RSA encryption, the data protection API, key management, and best practices for secure authentication and data protection.

Audit a sample EF Core project to identify PII. Tag properties with a sensitive attribute and data classification, and plan encryption and PCI DSS controls for card data.

Learn to implement AES encryption in C# with AESGCM, using a configuration-based key, handling nonce and tag, and providing encrypt and decrypt services for secure database storage.

Implement encryption for data at rest by automatically encrypting sensitive fields on save and decrypting them on retrieval using EF Core interceptors and a crypto service.

Create a sensitive data masking helper in C# to mask national IDs and other values, returning only the last four digits, and integrate it when displaying customer details.

Compare custom AES with the data protection API to address key management, rotation, and initialization vector reuse; secure by default in ASP.NET Core for cookies, tokens, and secrets.

Install the data protection package, implement a data protection service using IDataProtectionProvider to protect and unprotect sensitive fields, and configure dataProtectionMode with crypto and protection for secure card tokens.

Implement structured logging in ASP.NET Core using iLogger and Serialog, centralize logs for audit trails, enforce data retention and encryption, and protect against exposing sensitive information.

Learn to implement secure logging with iLogger by masking sensitive data, logging only minimal reference information, and extending logging with custom methods to prevent exposure of personally identifiable information.

Implement secure audit logging by hashing sensitive data in a dedicated auditing detail module, then serialize as JSON and persist tamper-proof records via an iAuditLogger.

Build tamper-proof audit logs by chaining each record’s hash to the previous, compute hashes, and verify integrity to detect tampering.

Implement data retention policies in a c# .net background service, including anonymizing inactive customers after three years, archiving old orders, deleting old payments, and cleaning audit logs.

Implement data retention policies by anonymizing inactive customers and archiving old orders. Delete old payment details and clean audit logs via a background service running every 24 hours.

Review data security in coding, highlighting encryption, secure logging, and masking sensitive data to prevent access and exposure, while practicing privacy by design and security by default for compliance.

validate all input by default and sanitize data to prevent SQL, NoSQL, and XSS injections through syntactic and semantic validation, encoding, and attributes.

Treat all external input as evil and validate it to prevent injection and XSS vulnerabilities. Enforce the meaning behind data to block abuse across forms, files, and APIs.

Understand validation as syntactic, semantic, and contextual correctness, not just required fields or regex, with server-side checks, .NET data annotations, and custom validators to prevent vulnerabilities.

Protect web apps from cross site scripting by encoding untrusted input, sanitizing stored content, and applying content security policies to prevent attacker script execution.

Protect your api by validating and encoding text inputs to prevent cross-site scripting; encode the body and author fields, and enforce string length limits before rendering in previews.

Understand how SQL injection works and why it's a design failure. Learn to defend by always parameterizing queries, using Entity Framework Core, and encoding outputs to prevent data breaches.

Expose how unparameterized raw SQL in the intakes search endpoint enables SQL injection via query strings, illustrate attack patterns, and outline parameterization and mitigations to prevent data loss.

Learn to prevent sql injection by using safe raw sql with from sql raw and parameterized from sql interpolated, while building queries with iQueryable, where, and order by.

Harden api input validation by decorating appointment and intake DTOs with data annotations, enforcing required fields, lengths, and allowed values.

Develop and apply custom validation attributes for past and future date checks, plus safe phone regex with a timeout, wired into a DTO to return detailed 400 errors.

Treat all input as untrusted, apply syntactic and semantic validation, encode input and output, avoid concatenation for SQL, and use parameterized queries; EF Core protects you when you follow rules.

Extend secure file uploads with validation, sanitization, and antivirus scanning using ASP.NET Core and the IFORM file data type. Protect every upload entry point from common attacks.

Triage and prevent path traversal in file uploads by replacing the stored file name with a guid and validating that the full path starts with the upload root.

Limit upload file size by adding a max file size attribute to the IFormFile in the request DTO, enforcing a 10 megabyte cap with flexible, endpoint-specific validation.

Learn a comprehensive file-type validation approach in secure C# and .NET, using signature-based checks, allowed and denied extensions, and header verification to prevent malicious uploads.

Implement a quarantine-based anti-virus workflow that scans uploaded files with ClamAV via Docker before moving clean files to the target directory, while infected files stay quarantined and abort the upload.

Treat every uploaded file as untrusted, guard against path traversal by using random file names, validate size, type, and extension, and implement virus scanning with quarantine.

Develop security-first ci/cd pipelines for .NET apps with GitHub Actions, secure repository configurations, and software composition analysis to detect vulnerabilities and deploy hardened container images.

Embed security into ci/cd deployments by treating pipelines as security boundaries while applying threat modeling to prevent compromised pull requests, dependencies, and runners.

Set up a GitHub repository for secure CI/CD by configuring a new repo, setting the default branch to main, and enforcing pull requests with protection rules.

Software composition analysis automatically scans your app for third-party components, detects CVEs and license issues, and flags transitive dependencies in CI/CD to enforce secure, up-to-date packages.

Set up a software composition analysis gate with GitHub Actions to block direct main pushes, review dependencies, and enforce secure NuGet packages in pull requests.

Configure dependabot in the .github workflows to run weekly, create PRs with security updates, enforce minimal read permissions, perform dependency reviews, and add license governance for OWASP alignment.

Secure container deployment by building with trusted base images, pinning versions, and using minimal images. Verify image provenance, scan images before push, and deploy only through security gates.

Compare insecure and production-ready dockerfiles to deploy hardened containers, enforce non-root execution, sdk versioning, and copying only necessary files, then scan with aqua security and publish to GitHub container registry.

review the cicd security boundary, enforce repository security for main branch access, and apply security composition analysis to scan packages, dependencies, and containers for vulnerabilities.