Secure Coding in C# and .NET

Leverage the CIA triad—confidentiality, integrity, and availability—to guide secure code in C# and .NET, ensuring authorized access, unaltered data, and dependable data availability.

Write secure code by thinking like an attacker to prevent exploitations. Integrate security across the software development life cycle with threat modeling, testing, code reviews, and .NET APIs.

Explore how .NET developers map to the OWASP top 10, covering broken access control, cryptographic failures, injection, insecure design, security misconfiguration, and vulnerabilities with secure coding guidance and regulatory context.

Explore common security mistakes in secure code, from hard-coded secrets and insecure configuration on GitHub to unvalidated input, unhandled exceptions, poor logging, and careless copy-paste with encryption APIs.

Apply least privilege and defense in depth across application layers, fail securely, validate input, use parameterized queries, and rely on ASP.NET Core packages, encrypting data at rest and in transit.

Explore common vulnerabilities and how insecure code leads to breaches, and learn to think like an attacker while coding like a defender in .NET.

Identify assets, dependencies, and entry points, then apply stride and the cia triad to guide secure design and mitigations.

Differentiate authentication and authorization to clarify access control. The lecture highlights common authentication mistakes, such as avoiding hard-coded credentials, enforcing https, and securing cookies or tokens.

Explore .NET authentication patterns across web apps, APIs, and SPAs—cookie-based auth with anti-forgery tokens and jwt via OAuth 2.1, plus Open ID Connect and Entra ID for single sign-on.

Discover how EF Core identity creates SQLite tables for ASP.NET users, roles, and the user roles join table, with fields such as username, email, and password hash.

Learn to harden the api authentication flow by validating login and register requests with required data annotations, using generic invalid credentials messages and 400 errors to prevent user existence disclosure.

Implement a secure web app login with identity pages, anti-forgery protection, and post-based submission. Enforce local redirects and rely on the sign-in manager and cookies to prevent phishing.

Enforce email confirmation (and optional phone verification) before login to prevent spoof accounts, configure smtp and iEmailSender in program.cs, and send a verification token via papercut smtp.

Explore implementing user lockout in identity by configuring max failed attempts and lockout duration, enforcing lockout on login attempts, and handling redirect to a lockout page.

Explore the key principles of access control and authorization, compare role-based and claims-based models, and configure custom policies to enforce fine-grained, role-level security and prevent broken access control.

Explain principles of access control and common vulnerabilities like broken access control and insecure direct object references, and compare RBAC and ABAC models that enforce minimum rights and protect resources.

Apply authorization to APIs and web pages by using the authorize attribute on controllers or actions, optionally allow anonymous for select endpoints, and understand 401 responses and login redirects.

Explore claims-based authorization by using http context user and jwt claims, add custom claims, and enforce policies like require it department via authorize to protect api endpoints.

Implement claims-based authorization in a web app by storing department claims in a database, extending cookie authentication with a custom claims factory, and enforcing policies on the privacy page.

Implement a task owner authorization policy in a .NET app by creating a custom task owner requirement and handler, enabling one-line access checks and consistent access control.

Learn to implement authorization in a .NET core app using least privilege, role-based and claims-based access control, and custom policies to audit and mitigate broken access control.

Bridge security and legal compliance in modern .NET applications by implementing encryption with .NET cryptography libraries, secure logging and auditing, and data retention and deletion policies across industries and regions.

Secure data in transit with TLS and in rest with encryption, while controls, logging, and safe storage in .NET apps defend against breaches and PII leaks.

Explore cryptography fundamentals in .NET, including SHA-256 hashing, AES and RSA encryption, the data protection API, key management, and best practices for secure authentication and data protection.

Audit a sample EF Core project to identify PII. Tag properties with a sensitive attribute and data classification, and plan encryption and PCI DSS controls for card data.

Implement encryption for data at rest by automatically encrypting sensitive fields on save and decrypting them on retrieval using EF Core interceptors and a crypto service.

Create a sensitive data masking helper in C# to mask national IDs and other values, returning only the last four digits, and integrate it when displaying customer details.

Compare custom AES with the data protection API to address key management, rotation, and initialization vector reuse; secure by default in ASP.NET Core for cookies, tokens, and secrets.

Implement structured logging in ASP.NET Core using iLogger and Serialog, centralize logs for audit trails, enforce data retention and encryption, and protect against exposing sensitive information.

Implement secure audit logging by hashing sensitive data in a dedicated auditing detail module, then serialize as JSON and persist tamper-proof records via an iAuditLogger.

Build tamper-proof audit logs by chaining each record’s hash to the previous, compute hashes, and verify integrity to detect tampering.

Implement data retention policies in a c# .net background service, including anonymizing inactive customers after three years, archiving old orders, deleting old payments, and cleaning audit logs.

validate all input by default and sanitize data to prevent SQL, NoSQL, and XSS injections through syntactic and semantic validation, encoding, and attributes.

Treat all external input as evil and validate it to prevent injection and XSS vulnerabilities. Enforce the meaning behind data to block abuse across forms, files, and APIs.

Understand validation as syntactic, semantic, and contextual correctness, not just required fields or regex, with server-side checks, .NET data annotations, and custom validators to prevent vulnerabilities.

Protect web apps from cross site scripting by encoding untrusted input, sanitizing stored content, and applying content security policies to prevent attacker script execution.

Protect your api by validating and encoding text inputs to prevent cross-site scripting; encode the body and author fields, and enforce string length limits before rendering in previews.

Understand how SQL injection works and why it's a design failure. Learn to defend by always parameterizing queries, using Entity Framework Core, and encoding outputs to prevent data breaches.

Expose how unparameterized raw SQL in the intakes search endpoint enables SQL injection via query strings, illustrate attack patterns, and outline parameterization and mitigations to prevent data loss.

Learn to prevent sql injection by using safe raw sql with from sql raw and parameterized from sql interpolated, while building queries with iQueryable, where, and order by.

Develop and apply custom validation attributes for past and future date checks, plus safe phone regex with a timeout, wired into a DTO to return detailed 400 errors.

Treat all input as untrusted, apply syntactic and semantic validation, encode input and output, avoid concatenation for SQL, and use parameterized queries; EF Core protects you when you follow rules.

Triage and prevent path traversal in file uploads by replacing the stored file name with a guid and validating that the full path starts with the upload root.

Limit upload file size by adding a max file size attribute to the IFormFile in the request DTO, enforcing a 10 megabyte cap with flexible, endpoint-specific validation.

Learn a comprehensive file-type validation approach in secure C# and .NET, using signature-based checks, allowed and denied extensions, and header verification to prevent malicious uploads.

Implement a quarantine-based anti-virus workflow that scans uploaded files with ClamAV via Docker before moving clean files to the target directory, while infected files stay quarantined and abort the upload.

Treat every uploaded file as untrusted, guard against path traversal by using random file names, validate size, type, and extension, and implement virus scanning with quarantine.

Develop security-first ci/cd pipelines for .NET apps with GitHub Actions, secure repository configurations, and software composition analysis to detect vulnerabilities and deploy hardened container images.

Embed security into ci/cd deployments by treating pipelines as security boundaries while applying threat modeling to prevent compromised pull requests, dependencies, and runners.

Set up a GitHub repository for secure CI/CD by configuring a new repo, setting the default branch to main, and enforcing pull requests with protection rules.

Software composition analysis automatically scans your app for third-party components, detects CVEs and license issues, and flags transitive dependencies in CI/CD to enforce secure, up-to-date packages.

Set up a software composition analysis gate with GitHub Actions to block direct main pushes, review dependencies, and enforce secure NuGet packages in pull requests.

Configure dependabot in the .github workflows to run weekly, create PRs with security updates, enforce minimal read permissions, perform dependency reviews, and add license governance for OWASP alignment.

Secure container deployment by building with trusted base images, pinning versions, and using minimal images. Verify image provenance, scan images before push, and deploy only through security gates.

review the cicd security boundary, enforce repository security for main branch access, and apply security composition analysis to scan packages, dependencies, and containers for vulnerabilities.