2
votes
1answer
163 views

Standard ways of revoking user access to a site

I'm in the process of building a .NET MVC website where a requirement is that admin users should be able to lock accounts to not only prevent future log-ins but to also immediately revoke access to ...
0
votes
0answers
54 views

How to mitigate security risks when deploying a database to the web via automated migrations?

I'm looking at using built in database migrations frameworks (such as the migration framework included in EF Code First or migratordotnet) but I have concerns about the implications of allowing a ...
0
votes
3answers
214 views

VB stand alone application or ASP web application

I have experience developing software and web applications and I have decided to do some freelance work on the side. Well, I met with my first client and they are requesting a relatively simple, ...
0
votes
1answer
266 views

Asp.Net MVC Windows authentication - vulnerabilities of http vs https?

I am developing an ASP.Net MVC 3 intranet site that will use Integrated Windows Authentication exclusively. What are the vulnerabilities of the challenge/response authentication traffic being sent in ...
0
votes
1answer
163 views

Security aspects of an ASP.NET that can be pointed out to the client

I need to write several passages of text in an offer to the client about the security layer in ASP.NET MVC web solution. I am aware of security that comes along with MVC 3 and an improvements in MVC ...
11
votes
3answers
4k views

Is it a good practice set connection strings in a web config?

Recently I have a discussion with some of my colleagues at my work because they said that it's better have in a .DLL a string connection encrypted. And I said why just don't use the string connection ...
2
votes
3answers
395 views

Security for data produced by ASP.NET web serivce

I'm developing an ASP.NET 2.0 web service that serves XML data from a database. Almost all data traffic is one-way, from server to client, and there is no user-specific data. All clients will ...
0
votes
2answers
350 views

What is the best way to have security auditing done?

I have an authentication system(ASP.Net library) that I want to make sure is secure. What companies/resources can I use to make sure of this? Also, what should I make sure to do before sending it off ...
3
votes
1answer
2k views

How to generate nonce for Ajax web requests

As many of you know WordPress uses "secret key" like thing for every AJAX request. Making each request unique and also 'somewhat' secure (just a step ahead than nothing). How would I implement the ...
3
votes
4answers
4k views

Best practices for connecting from ASP.NET to SQL Server? [closed]

There are several different ways to connect to SQL Server from an ASP.NET application. I'm working on rebuilding an ASP.NET / SQL Server environment right now and I'm trying to figure out which ...
3
votes
4answers
355 views

Are there laws to protect us from hackers who disclose vulnerabilities prior to alerting the vendor?

Take the example of the recent ASP.NET (and Java Server Faces) vulnerability disclosure at a Hacker conference in Brazil. It's my understanding that the poet tool was demonstrated before Microsoft ...