Roadmap › ASP.NET Core MVC (and Razor Pages) › Module: Filters, State and Security
Lessons in this course (15)
13. Security: antiforgery, XSS, HTTPS, CORS
Intermediate★ Must knowLesson 13 of 15
- CSRF: cookie-authenticated forms must include an antiforgery token. The form tag helper adds it; validate with
[ValidateAntiForgeryToken]or globally withAutoValidateAntiforgeryTokenAttribute. - XSS: Razor HTML-encodes
@output; neverHtml.Rawuser input; add a Content-Security-Policy header. - HTTPS + HSTS:
UseHttpsRedirection(),UseHsts()in production. - Open redirect: use
LocalRedirect()/Url.IsLocalUrl(returnUrl)for return URLs. - Cookies:
HttpOnly,Secure,SameSite=Lax/Strict. - Error pages: developer exception page only in Development.