This is the security checklist I go through on the stacks I’ve used most as a developer: ASP.NET Core and .NET, REST APIs, React and npm, and SQL and NoSQL databases. Each section is short enough to skim before a release or a code review. Where the right setting isn’t obvious, there’s a small code …
Security
Sharing Clients in Duende IdentityServer: Security Risks
Years ago I built authorization on the open-source IdentityServer4 (I wrote about that here). Its successor, Duende IdentityServer, is a commercial product, and its pricing depends on how many clients you configure. For a company that ships its software for customers to install on their own servers, instead of running it as SaaS, there’s also …
How to use ConfigBuilders for User Secrets Management in Asp.Net MVC 5
When it comes to storing our app secrets, Asp.Net Core has a built-in mechanism to do that out of the box. But this is not the case for Asp.Net MVC 5. For MVC 5, we need to install custom configBuilders packages in order to be able to have the same functionality. There are many other …
Application Secret Management: How to Implement a Good Secret Management Strategy
Sometimes bad things just happen, or perhaps they happen because of our neglect. Bad things like committing an application secret into our repository. The problem with doing that is that if that happens, deleting the secret and committing will not suffice. We need to purge that commit completely from our repository and its history. But …