Click here to Skip to main content
15,887,083 members
Home / Discussions / ASP.NET
   

ASP.NET

 
Question.Net Core Dependency Injection, How to architect it, do I need it? Email Queues. Pin
jkirkerx15-Aug-18 8:11
professionaljkirkerx15-Aug-18 8:11 
AnswerRe: .Net Core Dependency Injection, How to architect it, do I need it? Email Queues. Pin
F Margueirat23-Aug-18 8:18
F Margueirat23-Aug-18 8:18 
QuestionHow to manage a combined role + organization security in MVC? Pin
F Margueirat15-Aug-18 4:34
F Margueirat15-Aug-18 4:34 
AnswerRe: How to manage a combined role + organization security in MVC? Pin
jkirkerx15-Aug-18 8:35
professionaljkirkerx15-Aug-18 8:35 
GeneralRe: How to manage a combined role + organization security in MVC? Pin
F Margueirat20-Aug-18 7:00
F Margueirat20-Aug-18 7:00 
GeneralRe: How to manage a combined role + organization security in MVC? Pin
jkirkerx20-Aug-18 7:23
professionaljkirkerx20-Aug-18 7:23 
QuestionBrowser Security Pin
saurabh.15in14-Aug-18 3:39
saurabh.15in14-Aug-18 3:39 
AnswerRe: Browser Security Pin
Richard Deeming14-Aug-18 4:15
mveRichard Deeming14-Aug-18 4:15 
If your site is always running over HTTPS, then requests and responses cannot be read or modified by a MitM. The only exceptions would be:
  1. The attacker has convinced a rogue CA to issue an invalid cert for your site.
    This would likely be detected pretty quickly, and would result in browsers dropping that CA from their "trusted CAs" list.
    HPKP[^] can help to prevent this; but if the user's first access to your site is via a compromised network, the HPKP information could also be removed or compromised.
     
  2. The attacker has compromised the user's computer, and installed their own root cert in the trusted store, allowing them to issue invalid certs for any site.
    HPKP might help in this case; but if the user's computer has been compromised, the cached pins could also have been deleted or modified.
     
  3. The attacker has compromised the user's computer, and installed malware to modify pages after the browser has downloaded them.
    As a site owner, there is nothing you can do to prevent this sort of attack. Even if you add CSP[^] to control which scripts can run, the malware can just remove that header.

A more likely scenario is if your site is initially served over HTTP, in which case, a MitM attacker can prevent the redirection to HTTPS, and is free to do whatever they want with your site's content.

HSTS[^] can help to prevent this, but your user would need to access your site via a clean network first.

You can request to have your site included on the "preload" list[^], which would ensure it's only ever accessed over HTTPS, even for new users. But if you ever wanted to switch back, it could take many months for your site to be removed.



"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

GeneralRe: Browser Security Pin
saurabh.15in15-Aug-18 21:28
saurabh.15in15-Aug-18 21:28 
QuestionI am getting the following error in my Production Server: Error Message: The communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state. Pin
indian14313-Aug-18 7:59
indian14313-Aug-18 7:59 
AnswerRe: I am getting the following error in my Production Server: Error Message: The communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state. Pin
Richard Deeming13-Aug-18 8:10
mveRichard Deeming13-Aug-18 8:10 
QuestionAsp.Net Core 2.1 with Angular 6 inside, Angular 6 service adding record using .net controller, what to return?, and use of MongoDB with auto increment Pin
jkirkerx13-Aug-18 7:58
professionaljkirkerx13-Aug-18 7:58 
Answer[Solved the CreatedAtRoute] Pin
jkirkerx13-Aug-18 8:43
professionaljkirkerx13-Aug-18 8:43 
QuestionUsing Elmah for my ASP.Net MVC application Pin
indian14312-Aug-18 22:08
indian14312-Aug-18 22:08 
QuestionI am creating graph chart line chart bar chart in asp.net web form. Pin
Member 1389651512-Aug-18 20:04
Member 1389651512-Aug-18 20:04 
AnswerRe: I am creating graph chart line chart bar chart in asp.net web form. Pin
Richard MacCutchan12-Aug-18 21:01
mveRichard MacCutchan12-Aug-18 21:01 
QuestionThe remote name could not be resolved Pin
Member 102909889-Aug-18 1:10
Member 102909889-Aug-18 1:10 
AnswerRe: The remote name could not be resolved Pin
Richard Deeming9-Aug-18 1:42
mveRichard Deeming9-Aug-18 1:42 
AnswerRe: The remote name could not be resolved Pin
Nathan Minier9-Aug-18 2:23
professionalNathan Minier9-Aug-18 2:23 
QuestionSetting onblur, onkeyup and onkeydown for @Html.Kendo().TextBoxFor using HtmlAttributes Pin
indian1438-Aug-18 14:34
indian1438-Aug-18 14:34 
AnswerRe: Setting onblur, onkeyup and onkeydown for @Html.Kendo().TextBoxFor using HtmlAttributes Pin
jkirkerx13-Aug-18 8:10
professionaljkirkerx13-Aug-18 8:10 
GeneralRe: Setting onblur, onkeyup and onkeydown for @Html.Kendo().TextBoxFor using HtmlAttributes Pin
jkirkerx18-Aug-18 8:28
professionaljkirkerx18-Aug-18 8:28 
QuestionGetting HiddenField value in GetValidators method of CustomModelValidatorProvider Pin
indian1437-Aug-18 11:28
indian1437-Aug-18 11:28 
AnswerRe: Getting HiddenField value in GetValidators method of CustomModelValidatorProvider Pin
Eric W Scott8-Aug-18 3:59
professionalEric W Scott8-Aug-18 3:59 
GeneralRe: Getting HiddenField value in GetValidators method of CustomModelValidatorProvider Pin
indian1438-Aug-18 6:30
indian1438-Aug-18 6:30 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.