Browse by Tags

• AJAX
• Auditing and Logging
• Authentication
• CAS
• Code Inspection
• Deployment Phase
• Implementation
• Inception Phase
• Information Gathering
• Input Validation
• Performance
• Planning Phase
• Practices
• Reflection
• Sensitive Data
• Test Phase
• Tools
• WCF

WCF Security - Input/Data Validation Using Schemas

WCF offers very flexible approach of Input and Data Validation based on XML Schemas. The approach is flexible since the validation rules are expressed in form of XML schema and can be changed at any time without recompiling the solution. I followed the Read More...

Posted 25 May 08 03:52 by alikl | 1 Comments   
Filed under WCF, Input Validation, Security, Development Phase, Implementation

WCF Security - Input/Data Validation Sample Visual Studio Project

Input and Data Validation is one of the core security principles . WCF is no exception . To get most out of WCF in secure way one must implement proper Input and Data Validation. I was following instructions on How To – Perform Input Validation Read More...

Posted 25 May 08 12:17 by alikl | 1 Comments   
Filed under WCF, Input Validation, Security, Development Phase, Implementation

patterns & practices WCF Security Guidance Project - live on Codeplex

patterns & practices has recently released WCF Security Guidance Project . JD , the program manager behind the effort, has been blogging about it too.It is evolving project but the initial content is fantastic already. It has Application Scenarios Read More...

Posted 02 April 08 08:53 by alikl | 1 Comments   
Filed under WCF, Security, Development Phase, Implementation, Practices

Basic HttpModule Sample (Plus Bonus Case Study - How HttpModule Saved Mission Critical Project's Life)

This post to describe basic steps to write HttpModule and how it rescued mission critical application from not hitting the dead line. HttpModule is the mechanism that facilitates implementing cross cutting logic for incoming ASP.NET requests. ASP.NET Read More...

Posted 26 December 07 10:09 by alikl | 1 Comments   
Filed under Security, Reflection, Development Phase, Implementation, Performance

ASP.NET 3.5 Extensions: Basic Steps To Create Dynamic Data Web Application - Focus On Security and Performance

This post walks through the steps I've taken to create simple Dynamic Data Web Application. I just loved the development model for DTO [Data Transfer Object] and Input Validation options. Summary of steps Step 1 - Download and install ASP.NET Extensions. Read More...

Posted 18 December 07 10:08 by alikl | 1 Comments   
Filed under Security, Development Phase, Implementation, Performance, Planning Phase, AJAX

ASP.NET 2.0 Internet Security Reference Implementation - Have It Handy

JD Meier writes in his blog : The ASP.NET 2.0 Internet Security Reference Implementation is a sample application complete with code and guidance. Our purpose was to show patterns & practices security guidance in the context of an application scenario. Read More...

Posted 21 November 07 10:04 by alikl | 4 Comments   
Filed under Security, Development Phase, Implementation, Deployment Phase, Practices, Inception Phase

XSSDetect Public Beta now Available!

XSSDetect public beta is now available for download on MSDN. Overview XSSDetect is a static code analysis tool that helps identify Cross-Site Scripting security flaws found within Web applications. It is able to scan compiled managed assemblies (C#, Visual Read More...

Posted 24 October 07 09:21 by alikl | 1 Comments   
Filed under Test Phase, Security, Tools, Code Inspection, Development Phase

AJAX Security - Client Side Validation Is For Usability Only, Not For Security

“As to methods there may be a million and then some, but principles are few. The man who grasps principles can successfully select his own methods. The man who tries methods, ignoring principles, is sure to have trouble.” Ralph Waldo Emerson AJAX is another Read More...

Posted 03 October 07 01:29 by alikl | 6 Comments   
Filed under Input Validation, Security, Development Phase, AJAX

Web Services Over SSL - Is It Really That Slow Like They Say?

My answer is "no" . I am working on solution where there is no Windows Active Directory Domain so we cannot utilize our beloved Kerberos and Windows Integrated Authentication saving big on configuration and management while taking advantage of increased Read More...

Posted 01 August 07 03:35 by alikl | 2 Comments   
Filed under Security, Development Phase, Implementation, Deployment Phase, Performance, Authentication, Planning Phase

Typed DataSet - Potential Performance And Security Risk

Are you using Typed DataSet as DTO (data transfer object) ? Are you building distributed systems where the DTO goes back and forth including your Smart Client? If yes then I think you should be aware that the most of your DB schema can be easily revealed Read More...

Posted 06 July 07 09:49 by alikl | 4 Comments   
Filed under Security, Development Phase, Implementation, Performance, Planning Phase

SOA, Strong Authentication, Standard Authorization - Cool Solution

reposted from here I've previously blogged about SOA Security Inside Enterprise walls This time I had couple of pretty interesting requirements from one customer that targeted B2B/Partners scenario. They had a web site that communicates to partner's web Read More...

Posted 30 May 07 01:45 by alikl | 7 Comments   
Filed under Security, Development Phase, Implementation, Authentication

ASP.NET Health Monitoring Means Logging And Auditing

I constantly keep seeing ASP.NET developers using log4net for logging and auditing their Web apps. While I have nothing against log4net - it is great stuff I presume though never used it - it is pretty funny to me to get why people do not use built-in Read More...

Posted 02 May 07 07:35 by alikl | 5 Comments   
Filed under Security, Development Phase, Auditing and Logging, Planning Phase

Adding Shared SNK File In Visual Studio 2005

“Prior to Microsoft Visual C# 2005, you specified the key file using CLR attributes in source code. These attributes are now deprecated . Beginning in Microsoft Visual C# 2005, you should use the Signing Page of the Project Designer or the Assembly Linker Read More...

Posted 16 April 07 03:24 by alikl | 1 Comments   
Filed under Security, Development Phase, CAS, Implementation, Authentication

Identity Flow Through Physical Tiers - Protocol Transition

If these articles: How To: Use Protocol Transition and Constrained Delegation in ASP.NET 2.0 Using Protocol Transition—Tips from the Trenches are your friends then do not waste your time on this post, please. The scenario is the same where user sits behind Read More...

Posted 10 April 07 01:27 by alikl | 3 Comments   
Filed under Security, Development Phase, Implementation, Authentication

Identity Flow Through Physical Tiers - Delegation

If these articles: How To: Implement Kerberos Delegation for Windows 2000 How To: Use Impersonation and Delegation in ASP.NET 2.0 Credentials and Delegation are your friends then do not waste your time on this post, please. I have still the same scenario Read More...

Posted 08 April 07 05:53 by alikl | 3 Comments   
Filed under Security, Development Phase, Implementation, Authentication

Search

This Blog

• Home
• Email