Login page should be served using HTTPS\SSL. Note this is the serving of the login page not just the post back once user details are entered. Otherwise it is possible for someone to tamper with the page contents and you may find your users posting their details to a different site and stolen. Many people […]
One handy deployment tip is to set IIS retail mode to true in the Machine.config: <system.web> <deployment retail=”true”/> </system.web> This will disable tracing output & debug mode and also force custom errors to On. Note if you are trying to debug a problem on webserver using CustomErrors set to remoteonly and it is not working this […]
Letting users upload files into a website is an area that requires careful management. Obviously there is a decision to be made around whether to store the file in a database or on the file system. Also the file should be virus scanned. Note that in business systems users can often upload files like pdf that […]
When deploying a website you should try to deploy the minimum amount of files required to run the site. If extra files are deployed, or deployed to the wrong place, these may leak information. Examples include WSDL files that are not required DLLS deployed outside the bin directory. On some versions of IIS (out of […]
ASP.NET MVC Security 