WebLog Posts in Category Security


A dynamic RequireSsl Attribute for ASP.NET MVC
June 18, 2014 @ 1:37am

In ASP.NET MVC the RequireHttps attribute allows for securing controllers and controller methods, but it's limited to either on or off statically. In this post I discuss a custom attribute that can dynamically set SSL usage based on a configuration setting or delegate.

6 comments
IIS SSL Certificate Renewal Pain
May 08, 2014 @ 1:53pm

IIS SSL Certificate renewals always seem to be a pain. Rarely does it just go right and I never seem to remember whether I should renew, or just issue a new cert. The answer is the latter, but this post discusses some of the issues and how to avoid them when renewing or installing new SSL certificates.

9 comments
A WebAPI Basic Authentication Authorization Filter
April 18, 2013 @ 11:35am

Recently I needed to implement user based security in a Web API application that's easily accessible from a variety of clients. The customer asked specifically for Basic Auth support and so needed to implement custom Basic Auth support. In this post I describe a simple AuthorizationFilter based implementation of Basic Authentication for Web API.

23 comments
.NET HTML Sanitation for rich HTML Input
July 19, 2012 @ 2:24am

If you need to sanitize raw HTML for display in Web applications, the job at hand is scary for .NET backends. Unfortunately it seems there aren't a lot of tools available to help in this formidable tasks and the tools that are tend to be inflexible to the point of often being unusable. In this post I show a base implementation of an HTML Sanitizer that can be customized for your own needs.

16 comments
Wishful Thinking: Why can't HTML fix Script Attacks at the Source?
April 14, 2012 @ 5:49pm

I'm dealing with user HTML input in a Web application today and again I curse over the complexities involved in sanitizing this html. So today I started dreaming about a possible alternative...

15 comments
Loading Assemblies off Network Drives
March 22, 2011 @ 4:24pm

Remote loading of assemblies and CAS policy in .NET have always been hassle and although .NET 4.0 improves security, lightning up rules to be on par with Win32 applications, for COM Interop and custom runtime hosting old rules still apply. Luckily there's some help in the form of a new configuration switch that allows overriding remote loading of assemblies.

5 comments
Request Limit Length Limits for IIS’s requestFiltering Module
October 28, 2010 @ 10:57pm

Got bit during an update today by code that ran just fine on my dev machine and failed on OpenID logins on the live machine. Turns out RequestFiltering was not allowing the long OpenID urls to be served, a problem that's easy to hit with the default settings in Windows Server 2008.

1 comment
SSL Certificate Renewal Pain
January 21, 2009 @ 12:49am

I ran into some problems this time around renewing my SSL certificate for west-wind.com and it looks like the problem is related to how IIS 7 handles renewals. After all the years of problems with certificate renewals in IIS I figured that by now Microsoft would have this nailed, but in the end only a completely new certificate request managed to work for me.

23 comments
Non ASPX Extensions and Authentication in the IIS 7 Integrated Pipeline
May 23, 2008 @ 3:54am

Ran into an issue where IIS 7's integrated pipeline exhibits different behavior authenticating non ASPX extensions. Looks like IIS 7 only authenticates mainline files resulting in Context.User==null or Context.User.Identity.IsAuthenticated==false. For example hitting CustomHit.axd doesn't provide user credentials where an ASPX url does.

12 comments
MS Tests failing due to Security Errors
March 17, 2008 @ 12:53pm

Ran into an odd problem today while testing with a third party DLL. My unit tests failed to run complaining that the third party DLL was not trusted. Turns out the problem is related to the security tags applied to the file when it was downloaded and installed directly of a Web download.

2 comments
Watch out for XmlDocument.PreserveWhitespace when dealing with Digital Signatures
March 03, 2008 @ 12:42pm

When creating digital signatures of XML documents its crucial that the Xml document settings on signing match the document settings that are expected for validating signatures. I ran into a problem where our signatures were failing with a vendor's site, due to the PreserveWhitespace property settings on our end and on the vendor's parser being mismatched.

2 comments
Digitally Signing an XML Document and Verifying the Signature
February 23, 2008 @ 3:41am

Signing an XML document and then validating the digital signature of the document doesn't involve a lot of code - once you know how it works, but arriving there is quite the journey. This post describes setting up a certifcate for testing, signing an XML document with the Private key and then validating it with the Public key.

25 comments


West Wind  © Rick Strahl, West Wind Technologies, 2005 - 2014