Roadmap › Clean Code, Testing & Best Practices › Module: Team Practices
Lessons in this course (12)
12. Secure coding basics (OWASP Top 10 for .NET devs)
Intermediate★ Must knowLesson 12 of 12
| Risk | .NET practice |
|---|---|
| Injection (SQL, command) | Parameterised queries / EF Core / Dapper parameters; never concatenate input |
| Broken access control | [Authorize] + policies; check ownership (order.UserId == currentUser) — prevent IDOR |
| Cryptographic failures | HTTPS everywhere, HSTS; hash passwords with ASP.NET Core Identity (PBKDF2); never roll your own crypto |
| Security misconfiguration | No detailed errors in production; remove default accounts; least privilege |
| Vulnerable components | Keep NuGet packages updated; Dependabot; dotnet list package --vulnerable |
| XSS | Razor encodes by default; avoid Html.Raw with user input; CSP header |
| CSRF | Antiforgery tokens for cookie-auth forms ([ValidateAntiForgeryToken]) |
| Secrets | User Secrets locally; Azure Key Vault / env vars in prod; never commit appsettings.Production.json secrets |
| Logging failures | Log security events; never log secrets |
| SSRF | Validate/allow-list outbound URLs |