OJ Develops

Protection against CSRF (use of AntiForgery tokens) is supported in both the ASP.NET MVC and AngularJS frameworks. However, they have different implementations. What this means is that the default implementation of ASP.NET MVC for AntiForgery tokens will not work out-of-the box on an AngularJS front-end. In this post we will look at this in more detail and come up with a solution to the problem.

Cross-site Request Forgery (CSRF or XSRF) is a type of cyber attack wherein an attacker makes an HTTP request on a user's behalf without the user's knowledge or consent. If successful, a significant amount of damage can be done, depending on the nature of the request. This kind of attack can be prevented by using antiforgery tokens. In this post, we will talk about how we can prevent CSRF attacks in our ASP.NET MVC applications.

Whenever we start with a new ASP.NET MVC project, the tendency is to use one of the templates offered by Visual Studio. The template goes a long way in getting us started with our project. However one thing that the template does not do is remove the HTTP headers that are related to ASP.NET and MVC. Today we are going to look at those and how and why to remove them.

When creating a non-Web API ASP.NET MVC project using Individual Accounts, the generated template makes use of Forms Authentication. When logging in using Forms Authentication, a cookie is stored on the client's machine and that cookie is included by the browser in each future request.

If you install SQL Server using the default options, Windows authentication will be enabled and SQL Server authentication will be disabled. This post discusses how to enable SQL Server Authentication after installation and also enable the sa login.

Recently I've been working on a library that would allow direct CRUD operations of any object to the database. The library would detect the types and values of the properties of the classes involved then create Insert, Update, GetAll, and GetById procedures depending on what they find. It was working great and I was happy with the result. However when I showed it to a friend he pointed out that there might be security concern for building such queries. I researched about it a little and I found he was correct: my code was vulnerable to SQL injection attacks.