Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to write several passages of text in an offer to the client about the security layer in ASP.NET MVC web solution.

I am aware of security that comes along with MVC 3 and an improvements in MVC 4. But all of them are non conceptual, except for AntiForgeryToken (AntiXSS) and built-in SQL Injection immunity (with a little of encoding needed by hand).

What would be the main point of ASP.NET security I can "show off" in an offer to the client?

share|improve this question
depends on your client - are they interested in technical information or not? – Zack Macomber Jun 7 '12 at 16:15
Well, anything true and therefore convincing will do. – Maxim V. Pavlov Jun 7 '12 at 17:12
A built-in secure Membership Role Provider would be a major feature i would offer. What else can you think of exactly? – Ramhound Jun 8 '12 at 16:38
up vote 1 down vote accepted

I think that if you want to impress, start with a well-respected security report, for example WhiteHat Website Security Statistics Report Winter 2011

Then go through e.g. the top 10 security vulnerabilities, and describe how the .NET framework deals with these issues. I haven't read the report, but I know that the top 10 include SQL injection and XSite scripting.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.