Security
34 posts tagged with this.
-
Security Headers for ASP.NET Core 10 on IIS
Missing response headers still open clickjacking and MIME sniff paths on hosted ASP.NET sites. Wire HSTS, CSP, and cookie flags once in middleware or web.config.
-
Safe File Uploads for ASP.NET Core on IIS
Stop treating uploads as trusted input. Validate type and size in ASP.NET Core, constrain IIS limits, and keep files outside the web root on Windows hosts.
-
Patch Discipline for .NET on IIS and SQL Server
Unpatched runtimes beat fancy headers as a breach path. Build a repeatable patch cadence for the Hosting Bundle, IIS, and SQL Server on Windows hosts.
-
Harden Schannel TLS for IIS on Server 2025
Legacy TLS protocols and weak ciphers still linger on IIS hosts. Tighten Schannel on Windows Server 2025 so ASP.NET sites negotiate modern, browser-safe connections.
-
Least Privilege for ASP.NET on IIS and SQL Server
Shrink IIS app pool rights and SQL logins so a compromised ASP.NET site cannot roam the box. Concrete ACL, identity, and T-SQL patterns for production hosts.
-
IIS Request Filtering That Stops Bad Traffic Early
Block hostile URLs, verbs, and extensions at IIS before ASP.NET runs. Practical requestFiltering settings for Windows hosts and .NET apps.
-
Harden ASP.NET on IIS: Headers, Cookies, Secrets
Most hosted ASP.NET breaches start with missing headers, weak cookies, and secrets in Web.config. Harden IIS and .NET 10 apps with concrete config you can ship today.
-
ASP.NET Core Header Handling Advisory: Mitigate Now
A recent Microsoft security advisory highlights a flaw in ASP.NET Core header processing that can enable authentication bypass on production IIS deployments. Update configurations and apply patches immediately to protect sites running the current .NET release.
-
Rate Limiting Enhancements in ASP.NET Core 10
ASP.NET Core 10 refines the built-in rate limiting middleware with improved sliding-window algorithms and per-endpoint metrics. Developers gain tighter control over concurrency without external dependencies while preserving low-latency request handling.
-
Mitigating Recent ASP.NET Core Request Handling Risks
A recent Microsoft security advisory highlights flaws in ASP.NET Core request parsing that can lead to denial of service or information disclosure on production sites. Update immediately and apply the configuration changes described below to protect Windows Server deployments.
-
Mitigating Recent ASP.NET Core Request Smuggling Risks
A flaw in Kestrel's HTTP/2 frame handling enables request smuggling on misconfigured production sites. Update to current .NET releases and enforce strict header validation to close the exposure.
-
PowerShell for IIS Configuration on Windows Server
PowerShell provides reliable, repeatable control over IIS settings on Windows Server. Administrators can enforce security baselines, audit pools, and manage sites without manual UI steps that introduce drift.
-
Mitigating Recent ASP.NET Core Request Handling Risks
A recent Microsoft advisory addresses flaws in how ASP.NET Core processes certain HTTP requests under load-balanced or reverse-proxy setups. Production sites must apply configuration changes and runtime updates to prevent potential smuggling or injection vectors.
-
Mitigating Recent .NET Deserialization Risks in Production
A recent advisory warns of unsafe object deserialization paths in ASP.NET Core workloads. Production sites on Windows Server and IIS must apply targeted configuration and code changes to reduce exposure.
-
PowerShell IIS Hardening on Windows Server 2025
Windows Server 2025 ships with updated IIS defaults that reduce attack surface for .NET sites. This guide shows the exact PowerShell commands administrators use to apply and verify those settings in production.