Professional ASP.NET MVC 3

Chapter 7

Securing Your Application

— By Jon Galloway

What's In This Chapter?

• Requiring Login with Authorize Attributes
• Requiring role membership using the Authorize Attribute
• Using security vectors in Web Application
• Coding defensively

Securing your web applications can seem like a chore. It's something you have to do, but not a whole lot of fun. Nobody looks at your application and says, “Wow! Check out how well they secured my personally identifiable information! This programmer rules!” Security is generally something you have to do because you don't want to be caught in an embarrassing security breach.

No, security doesn't sound like a whole lot of fun. Most of the time when you read a chapter on security it's either underwritten or very, very overbearing. The good news for you is that we the authors read these books, too—a lot of them—and we're quite aware that we're lucky to have you as a reader, and we're not about to abuse that trust. In short, we really want this chapter to be informative because it's very important!

ASP.NET Web Forms developers: We're not in Kansas anymore!

This chapter is one you absolutely must read, because ASP.NET MVC doesn't have as many automatic protections as ASP.NET Web Forms does to secure your page against malicious users. To be perfectly clear: ASP.NET Web Forms tries hard to protect you from a lot of things. For example:

• Server Components HTML-encode displayed values and attributes to help prevent XSS attacks.
• View State is encrypted ...