WP TutorialLesson 15Free preview

WebPages Security

This lesson is part of ASP · All levels

Summary

Web application security includes secure password storage, protection against CSRF, page access restrictions, and the use of HTTPS. The password should be stored as a hash with salt, rather than plain text, and each POST request needs to validate its CSRF token. In addition, sensitive pages must be locked with authentication and encrypted connections.

Key points

Keep the password as hash (e.g. PBKDF2/SHA) complete with salt.
Validate the anti-CSRF token on any form that changes the data.
Use HTTPS to keep transit data from getting compromised.
Restrict access to folders and pages through web.config configuration or authentication.

Full lesson

Code examples and quizzes

Full lessons, code examples, and quizzes are available to subscribers. 5 questions.