<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Casaba Security &#187; ASP.NET</title>
	<atom:link href="http://www.casabasecurity.com/blog/tag/asp-net/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.casabasecurity.com/blog</link>
	<description>Building and breaking software and robots</description>
	<lastBuildDate>Tue, 31 Aug 2010 18:27:09 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>Preventing Security Development Errors: Lessons Learned at Windows Live by Using ASP.NET MVC</title>
		<link>http://www.casabasecurity.com/blog/2009/11/preventing-security-development-errors-lessons-learned-at-windows-live-by-using-asp-net-mvc/</link>
		<comments>http://www.casabasecurity.com/blog/2009/11/preventing-security-development-errors-lessons-learned-at-windows-live-by-using-asp-net-mvc/#comments</comments>
		<pubDate>Mon, 23 Nov 2009 21:42:45 +0000</pubDate>
		<dc:creator>Chris Weber</dc:creator>
				<category><![CDATA[Code Review]]></category>
		<category><![CDATA[Development]]></category>
		<category><![CDATA[ASP.NET]]></category>
		<category><![CDATA[MVC]]></category>

		<guid isPermaLink="false"></guid>
		<description><![CDATA[Casaba had the opportunity to contribute to a new Microsoft paper regarding ASP.NET MVC security. It&#039;s online through the SDL pages, and here&#39;s the paper&#39;s direct link. A short summary of the paper follows. The SDL preaches &#039;secure by default&#039;. When Windows Live moved to ASP.Net MVC, they used that opportunity to build mitigations into [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2009/11/preventing-security-development-errors-lessons-learned-at-windows-live-by-using-asp-net-mvc/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>useUnsafeHeaderParsing = what?</title>
		<link>http://www.casabasecurity.com/blog/2008/06/useunsafeheaderparsing-what/</link>
		<comments>http://www.casabasecurity.com/blog/2008/06/useunsafeheaderparsing-what/#comments</comments>
		<pubDate>Thu, 05 Jun 2008 22:02:31 +0000</pubDate>
		<dc:creator>Chris Weber</dc:creator>
				<category><![CDATA[Code Review]]></category>
		<category><![CDATA[Security Testing]]></category>
		<category><![CDATA[ASP.NET]]></category>
		<category><![CDATA[HTTP]]></category>

		<guid isPermaLink="false"></guid>
		<description><![CDATA[As software security people we usually like input restrictions to be tight. With .Net&#39;s HttpWebRequestElement.UseUnsafeHeaderParsing Property you can loosen up the way HTTP requests get parsed. Setting this property ignores validation errors that occur during HTTP parsing. The documentation from MSDN makes it pretty clear. When this property is set to &#039;true&#039; then many HTTP [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2008/06/useunsafeheaderparsing-what/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Using ASP.Net session handling with secure sites (set the secure flag)</title>
		<link>http://www.casabasecurity.com/blog/2008/02/using-asp-net-session-handling-with-secure-sites-set-the-secure-flag/</link>
		<comments>http://www.casabasecurity.com/blog/2008/02/using-asp-net-session-handling-with-secure-sites-set-the-secure-flag/#comments</comments>
		<pubDate>Mon, 04 Feb 2008 07:04:42 +0000</pubDate>
		<dc:creator>Samuel Bucholtz</dc:creator>
				<category><![CDATA[Development]]></category>
		<category><![CDATA[Security Testing]]></category>
		<category><![CDATA[ASP.NET]]></category>
		<category><![CDATA[cookies]]></category>

		<guid isPermaLink="false"></guid>
		<description><![CDATA[One of the common problems we see with many web applications is reliance on ASP.Net sessionID without understanding the security ramifications. ASP.Net provides web developers with a powerful means of tracking user state and identity with very little coding. Rather than creating your own custom authentication cookie, handling the trickiness of forms auth or mapping [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2008/02/using-asp-net-session-handling-with-secure-sites-set-the-secure-flag/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>ViewStateUserKey to prevent XSRF (CSRF or cross-site request forgery) in ASP.NET</title>
		<link>http://www.casabasecurity.com/blog/2006/09/viewstateuserkey-to-prevent-xsrf-csrf-or-cross-site-request-forgery-in-asp-net/</link>
		<comments>http://www.casabasecurity.com/blog/2006/09/viewstateuserkey-to-prevent-xsrf-csrf-or-cross-site-request-forgery-in-asp-net/#comments</comments>
		<pubDate>Sat, 30 Sep 2006 07:00:00 +0000</pubDate>
		<dc:creator>Chris Weber</dc:creator>
				<category><![CDATA[Development]]></category>
		<category><![CDATA[Security Testing]]></category>
		<category><![CDATA[ASP.NET]]></category>
		<category><![CDATA[CSRF]]></category>

		<guid isPermaLink="false"></guid>
		<description><![CDATA[ViewStateUserKey has been around for many years and is an easy solution to prevent the infamous XSRF or cross-site request forgery class of attack. It’s documented: http://msdn2.microsoft.com/en-us/library/system.web.ui.page.viewstateuserkey.aspx ViewStateUserKey mitigates XSRF by including a unique identifier in the user’s request. This protection mechanism has been available for many years when Microsoft identified the one-click attack, now [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2006/09/viewstateuserkey-to-prevent-xsrf-csrf-or-cross-site-request-forgery-in-asp-net/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
