Building Secure ASP.NET Core MVC Applications

### Overview In this talk, Niels Tanis examines the security landscape of ASP.NET Core MVC compared to legacy ASP.NET MVC. Because ASP.NET Core MVC is a modular, multi-platform total rewrite, it introduces new conventions, dependency injection by default, and safer baseline configurations. Tanis focuses on how data is processed, returned, and protected, specifically evaluating common web vulnerabilities such as Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and mass assignment/over-posting.

### Key Topics - **Controller Discovery and Routing Conventions**: In ASP.NET Core MVC, controllers are identified by convention (any class ending with the name `Controller`), requiring no explicit base class inheritance. This behavior means any loaded assembly could unintentionally expose controllers unless restricted via the `ApplicationPartManager`. - **Data Ingestion and State Management**: Tanis underscores that HTTP GET requests must never modify internal application state. For write operations, actions must be restricted to HTTP POST and protected against CSRF. - **Over-Posting and Mass Assignment**: Directly binding external input to ORM entity models can result in over-posting attacks (e.g., overwriting sensitive properties like `TotalPrice`). Defenses include whitelisting with the `[Bind]` attribute, using predicates in `TryUpdateModelAsync`, or preferably, using dedicated ViewModel request/response classes. - **Cross-Site Scripting (XSS) Defenses**: The framework defaults to safer content types (`text/plain` rather than `text/html`) when returning strings. Razor views automatically HTML-encode values unless developers explicitly bypass protection with `Html.Raw` or `HtmlString`. - **SameSite Cookie Integration**: Tanis details how SameSite cookies (`Lax` and `Strict`) mitigate CSRF and cross-origin resource leakage side-channels, and highlights how ASP.NET Core 2.0 introduced `CookiePolicyMiddleware` to automate SameSite policies. - **Roslyn Code Analysis**: Static analysis rules built on the Roslyn compiler platform can parse controller syntax trees to ensure security patterns are followed.

### Technical Details - **Anti-Forgery Protections**: Methods can be decorated with `[ValidateAntiForgeryToken]`, or developers can globally configure an `AutoValidateAntiforgeryTokenAttribute` filter within `ConfigureServices` in the `Startup` class. ASP.NET Core tag helpers automatically append anti-forgery tokens to generated forms. - **Encoding Services**: The built-in dependency injection container exposes contextual encoders derived from the AntiXSS library (`HtmlEncoder`, `JavaScriptEncoder`, `UrlEncoder`), allowing programmatic output encoding without manual instantiation. - **Cookie Authentication Options**: Tanis demonstrates replacing the default cookie manager in `CookieAuthenticationOptions` with a custom implementation to append `SameSite=Lax`. In ASP.NET Core 2.0, the framework sets `SameSite=Lax` for session cookies and `SameSite=Strict` for anti-forgery cookies by default. - **Roslyn AST Validation**: Tanis details custom Roslyn-based checks iterating through controller methods to verify: (1) if an action has `[HttpPost]`, it also possesses `[ValidateAntiForgeryToken]`; and (2) action method bodies explicitly evaluate `ModelState.IsValid` before persisting data.

### Takeaways While ASP.NET Core MVC provides significantly improved secure-by-default behaviors compared to classic MVC, developers must remain vigilant. Critical fundamentals like explicit HTTP verb binding, input validation with data annotations, ViewModels to prevent mass assignment, and context-aware output encoding remain necessary. Automated AST analysis via Roslyn offers an accessible mechanism to enforce these baseline requirements across application codebases.