Make MVC application safe for ajax and other attacks

Question

I have a complete unsafe mvc application. And now I started to think about security. Cause I use a couple of ajax I will close this securityhole with AntiForgeryToken is this a good way to stop Injection attacks?.

Next I thought about authentication and how i could manage my users. Than I decided to use the users of my Domain. But how can I auth from mvc to the user base of my Microsoft Domainserver? And whats about HTTPS. how can I activate that

thanks for your ideas. And I definitely forgot some details so please ask me for them!

Answer 1

AntiForgeryToken will not stop injection attacks. It will prevent cross-site attacks.

Stop injection attacks by never constructing SQL queries from user strings. Always user parameterized queries.

Your authentication scheme depends on your needs. If your users are already in Active Directory, then manage them from you domain server. Otherwise, create a user database.

HTTPS is activated on the web server.