AI
Broken Access Control: The Framework’s Strongest Category
Abel spent half the talk on category number one. ASP.NET Core provides role-based authorization, policy-based authorization with custom handlers, and resource-based authorization that loads the order before checking ownership. The fallback policy with RequireAssertion(false) locks down the entire system by default. Open redirects are blocked out of the box — the built-in LocalRedirect only accepts local URLs. Cross-site request forgery protection is enabled by default for Razor Pages and available via ValidateAntiForgeryToken for MVC.
Security Misconfiguration: Secure by Default
ASP.NET Core enables HTTP Strict Transport Security for HTTPS-only sites. The framework serves nothing from the application directory by default — only the wwwroot subdirectory. Every middleware component must be explicitly added to the pipeline. Abel noted that content security policy headers lack built-in support, recommending NWebsec as an add-on library.
Supply Chain and Cryptographic Failures
Visual Studio now warns about packages with known vulnerabilities on build. Abel cited Martin Baleyev’s demonstration: homoglyph characters in package names bypassed NuGet detection, and malicious source generators published without issue. For cryptography, ASP.NET Core’s Data Protection API handles key creation, storage, rotation, and initialization vectors. Abel warned that 30% of Duende Identity Server support issues came from misconfigured data protection — developers should set the key storage location explicitly.
Injection and Authentication: Largely Solved
SQL injection is mitigated by LINQ’s type-safe queries. Cross-site scripting is blocked by Razor’s default HTML encoding — developers must explicitly opt out with Html.Raw. For authentication, Abel recommended using ASP.NET Core Identity or external providers via OpenID Connect. He showed a naive login method with seven errors including SQL injection, plaintext cookies, and a missing else that always sets the cookie regardless of password validity.
Logging and Exceptional Conditions: The Gaps
OpenTelemetry integration is excellent for monitoring, but Abel stressed it is not an audit logging tool — it samples data and retains it for weeks, not years. Audit logging must be built separately. For exception handling, the developer exception page is disabled in production by default. Abel warned about flow control failures: charging a credit card before creating a license key creates a profit scenario if the key generation fails.
Notable Quotes
“The identifier alone should never be the protection.” Anders Abel · ▶ Watch (4:00)
“Require assertion is my favorite requirement because it allows me to write an expression returning true or false.” Anders Abel · ▶ Watch (9:33)
“I would set public relations problem.” Anders Abel · ▶ Watch (52:46)
“OpenTelemetry was never designed for that.” Anders Abel · ▶ Watch (49:17)
Key Takeaways
- ASP.NET Core’s fallback policy with
RequireAssertion(false)locks down every unannotated endpoint. - Data Protection API handles key rotation and IV generation, but storage location must be configured explicitly.
- Audit logging is not covered by OpenTelemetry and must be implemented separately.
- Supply chain attacks via homoglyph package names and malicious source generators remain undetected by NuGet.
About the Speaker(s)
Anders Abel is a senior .NET developer in Stockholm. He has been programming since he was 9 and still thinks it’s tremendously fun. When asked what he does for a living he often responds “building login buttons”. Anders has extensive experience on Single Sign On and API security. His Saml2 library is trusted by millions of users world wide and he has deep expertise on OAuth and OpenID Connect from his work on Duende IdentityServer.