Which ASP.NET commands can lead to insecure code?

Question

Personally, I try and write secure ASP.NET code. However, I have become quite paranoid about the code I write, as I used to work for a Registrar (high fraud targets). Are there any ASP.NET functions I should look at with extreme scrutiny (other than SQL access - I know enough not to do dynamic SQL).

Answer 1

This is an excellent MSDN article: Security Practices: ASP.NET 2.0 Security Practices at a Glance.

Excerpt:

How to prevent cross site scripting

Validate input and encode output. Constrain input by validating it for type, length, format, and range. Use the HttpUtility.HtmlEncode method to encode output if it contains input from the user, such as input from form fields, query strings, and cookies or from other sources, such as databases. Never just echo input back to the user without validating and/or encoding the data. The following example shows how to encode a form field.

Response.Write(HttpUtility.HtmlEncode(Request.Form["name"]));

If you return URL strings that contain input to the client, use the HttpUtility.UrlEncode method to encode these URL strings, as shown here.

Response.Write(HttpUtility.UrlEncode(urlString));

If you have pages that need to accept a range of HTML elements, such as through some kind of rich text input field, you must disable ASP.NET request validation for the page.

Turn On Custom Errors To Keep Errors Private

<customErrors mode="On" defaultRedirect="YourErrorPage.htm" />

Answer 2

Never trust user input. Never assume client-side validation will prevent bad input data. Always ensure that ValidateRequest="true" and EnableEventValidation="true" in your web.config :

See Request Validation and ASP.NET Security Tutorials.