0
votes
0answers
36 views

SQL Permissions differ in SSMS and ASP.NET? [migrated]

I have created a schema and user called "WebAPI" which is used by ASP.NET project to get stock levels. So, I have simple stored procedure: SELECT p.ProductCode, SUM( sl.Qty ) AS 'Qty' FROM ...
0
votes
0answers
47 views

How to mitigate security risks when deploying a database to the web via automated migrations?

I'm looking at using built in database migrations frameworks (such as the migration framework included in EF Code First or migratordotnet) but I have concerns about the implications of allowing a ...
0
votes
3answers
170 views

VB stand alone application or ASP web application

I have experience developing software and web applications and I have decided to do some freelance work on the side. Well, I met with my first client and they are requesting a relatively simple, ...
0
votes
1answer
207 views

Asp.Net MVC Windows authentication - vulnerabilities of http vs https?

I am developing an ASP.Net MVC 3 intranet site that will use Integrated Windows Authentication exclusively. What are the vulnerabilities of the challenge/response authentication traffic being sent in ...
0
votes
1answer
161 views

Security aspects of an ASP.NET that can be pointed out to the client

I need to write several passages of text in an offer to the client about the security layer in ASP.NET MVC web solution. I am aware of security that comes along with MVC 3 and an improvements in MVC ...
1
vote
1answer
450 views

What is the future for ASP.NET Membership Providers? [closed]

While working on a new project with MVC3, a DI framework (Ninject), and unit tests (NUnit) paired with mocks (Moq), I found setting up the Membership Provider felt a bit "awkward". I've run into tasks ...
11
votes
3answers
3k views

Is it a good practice set connection strings in a web config?

Recently I have a discussion with some of my colleagues at my work because they said that it's better have in a .DLL a string connection encrypted. And I said why just don't use the string connection ...
2
votes
3answers
381 views

Security for data produced by ASP.NET web serivce

I'm developing an ASP.NET 2.0 web service that serves XML data from a database. Almost all data traffic is one-way, from server to client, and there is no user-specific data. All clients will ...
0
votes
2answers
338 views

What is the best way to have security auditing done?

I have an authentication system(ASP.Net library) that I want to make sure is secure. What companies/resources can I use to make sure of this? Also, what should I make sure to do before sending it off ...
3
votes
1answer
2k views

How to generate nonce for Ajax web requests

As many of you know WordPress uses "secret key" like thing for every AJAX request. Making each request unique and also 'somewhat' secure (just a step ahead than nothing). How would I implement the ...
4
votes
3answers
4k views

Best practices for connecting from ASP.NET to SQL Server?

There are several different ways to connect to SQL Server from an ASP.NET application. I'm working on rebuilding an ASP.NET / SQL Server environment right now and I'm trying to figure out which ...
3
votes
4answers
349 views

Are there laws to protect us from hackers who disclose vulnerabilities prior to alerting the vendor?

Take the example of the recent ASP.NET (and Java Server Faces) vulnerability disclosure at a Hacker conference in Brazil. It's my understanding that the poet tool was demonstrated before Microsoft ...