SlideShare a Scribd company logo
ASP.NET MVC
Security
Jason
XSS
 Cross-site


Scripting (XSS)

XSS 是一種技術,惡意的使用者能夠利用它操作
系統,導致特殊的 JavaScript 出現在這些易受
攻擊的網站—所有拜訪的瀏覽器隨後將執行這些
JavaScript 。
Asp.net mvc security
Asp.net mvc security
狀況一
狀況二
Save Action

Save.cshtml
狀況三
Save Action

Save.cshtml
 假設不加上


ValidateInput(false)

還有其他方式,可以讓某個屬性允許 html ?
XSRF
 Cross


Site Request Forgery(XSRF/CSRF)

是一種攻擊類型,攻擊的網站顯示一表單給使用
者,提交後便發出請求給有漏洞的 Web 應用程
式。
Attack
預防 XSRF
 ValidateAntiForgeryTokenAttribute


Represents an attribute that is used to
prevent forgery of a request.
Save Action

Index.cshtml
Attack
Custom Exception Error Page
Save Action

WebConfig
Attack
Q&A

More Related Content

PPT
Telligem 1_xss
PDF
Web前端 安全须知 拔赤
PPT
浏览器的跨域安全问题
PDF
BUILDING WEB APPS WITH ASP.NET MVC AND NOSQL
PPTX
Web API authentication and authorization
PPTX
Authentication, Authorization, and Identity – More than meets the eye…
PPTX
Iasi code camp 12 october 2013 corneliu rimboiu - bridging java and .net
PPTX
ZZ BC#8 Hello ASP.NET MVC 4 (dks)
Telligem 1_xss
Web前端 安全须知 拔赤
浏览器的跨域安全问题
BUILDING WEB APPS WITH ASP.NET MVC AND NOSQL
Web API authentication and authorization
Authentication, Authorization, and Identity – More than meets the eye…
Iasi code camp 12 october 2013 corneliu rimboiu - bridging java and .net
ZZ BC#8 Hello ASP.NET MVC 4 (dks)

Viewers also liked (20)

PPTX
Performance in .net best practices
PPTX
Scalable Resilient Web Services In .Net
PPTX
DDD Melbourne 2014 security in ASP.Net Web API 2
PPT
Smooth Sort
PDF
Design & Deploy a data-driven Web API in 2 hours
PDF
Secure RESTful Web Services for ASP.NET Web API
PPTX
End to End Security with MVC and Web API
PPTX
Building Scalable .NET Web Applications
PDF
Tips and Tricks For Faster Asp.NET and MVC Applications
PPTX
ASP.NET Core 1.0 Overview: Post-RC2
PPTX
Overview of the .Net Collection Framework and Immutable Collections
PDF
5. web api 2 aspdotnet-mvc5-slides
PPTX
ASP.NET Core MVC + Web API with Overview (Post RC2)
PPTX
Scaling asp.net websites to millions of users
PPTX
10 performance and scalability secrets of ASP.NET websites
PPTX
ASP.NET Mvc 4 web api
PPTX
Learning ASP.NET 5 and MVC 6
PPTX
ASP.NET MVC Performance
PPTX
Rest API Security
PPTX
Web API or WCF - An Architectural Comparison
Performance in .net best practices
Scalable Resilient Web Services In .Net
DDD Melbourne 2014 security in ASP.Net Web API 2
Smooth Sort
Design & Deploy a data-driven Web API in 2 hours
Secure RESTful Web Services for ASP.NET Web API
End to End Security with MVC and Web API
Building Scalable .NET Web Applications
Tips and Tricks For Faster Asp.NET and MVC Applications
ASP.NET Core 1.0 Overview: Post-RC2
Overview of the .Net Collection Framework and Immutable Collections
5. web api 2 aspdotnet-mvc5-slides
ASP.NET Core MVC + Web API with Overview (Post RC2)
Scaling asp.net websites to millions of users
10 performance and scalability secrets of ASP.NET websites
ASP.NET Mvc 4 web api
Learning ASP.NET 5 and MVC 6
ASP.NET MVC Performance
Rest API Security
Web API or WCF - An Architectural Comparison
Ad

More from LearningTech (20)

PPTX
PPTX
PostCss
PPTX
ReactJs
PPTX
Docker
PPTX
Semantic ui
PPTX
node.js errors
PPTX
Process control nodejs
PPTX
Expression tree
PPTX
SQL 效能調校
PPTX
flexbox report
PPTX
Vic weekly learning_20160504
PPTX
Reflection & activator
PPTX
Peggy markdown
PPTX
Node child process
PPTX
20160415ken.lee
PPTX
Peggy elasticsearch應用
PPTX
Expression tree
PPTX
Vic weekly learning_20160325
PPTX
D3js learning tips
PPTX
git command
PostCss
ReactJs
Docker
Semantic ui
node.js errors
Process control nodejs
Expression tree
SQL 效能調校
flexbox report
Vic weekly learning_20160504
Reflection & activator
Peggy markdown
Node child process
20160415ken.lee
Peggy elasticsearch應用
Expression tree
Vic weekly learning_20160325
D3js learning tips
git command
Ad

Asp.net mvc security