ASP.NET

Public Sub CreateAccount(ByVal username As String, ByVal password As String)
       Dim hashedPassword = Crypto.HashPassword(password)
       CreateAccountInDatabase(username, hashedPassword)
   End Sub

   Private Sub CreateAccountInDatabase(username As String, hashedPassword As Object)
       Throw New NotImplementedException()
   End Sub

   Private Sub CreateAccount(ByVal username As String, ByVal password As String, ByVal email As String)
       Dim hashedPassword = Crypto.HashPassword(password)
       Using connection As New OleDbConnection("connectionString")

           Dim Sql As String = "INSERT INTO university (username,strEmail,hashed) VALUES (@username,@strEmail,@hashed)"

           Dim cmd As New OleDbCommand(Sql)
           cmd.Connection = connection

           cmd.Parameters.AddWithValue("@username", username)
           cmd.Parameters.AddWithValue("@strEmail", email)
           cmd.Parameters.AddWithValue("@hashed", hashedPassword)
           connection.Open()
           cmd.ExecuteNonQuery()

       End Using
   End Sub

   Private Sub BtnReg_Click(sender As Object, e As EventArgs) Handles BtnReg.Click
       'Do some forms validation here
       CreateAccount(username.Text, password.Text, strEmail.Text)

        End Sub

[AdminCheck]
public IActionResult SomeEditor() 

[AttributeUsageAttribute(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = false)]
public class AdminCheckAttribute : ActionFilterAttribute, IActionFilter
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        var controller = filterContext.Controller as Controller;
        var httpContext = controller.HttpContext;

        Model_Admin_Login pResult = SecurityCookies.CookieRead_Admin_Login(httpContext);
        if (pResult.AccountName != null)
        {<br />
            Model_Admin_Login model = new Model_Admin_Login();
            bool result = EF_Website_Users.AdminCheck_AccountName(pResult.AccountName, ref model);
            if (true == result)
            {
                // Program the HttpContext.Current
                // This will persist for the current cycle only
                String[] newRoles = { "Administrator" };
                GenericIdentity newIdentity = new GenericIdentity(pResult.AccountName);
                GenericPrincipal newPrincipal = new GenericPrincipal(newIdentity, newRoles);
                httpContext.User = newPrincipal;
                System.Threading.Thread.CurrentPrincipal = httpContext.User;

                // Store the Global ViewData to Show the Admin Menu or Not<br />
                controller.ViewData["Admin_Menu"] = true;
                controller.ViewData["Admin_UserID"] = model.ID;
                controller.ViewData["Admin_UserName"] = pResult.AccountName.ToLower();
                controller.ViewData["Admin_ImageUrl"] = model.Avatar.Url;
                controller.ViewData["Admin_ImageAlt"] = model.Avatar.Alt;
                controller.ViewData["Admin_Base64"] = model.Avatar.Data != null ? Convert.ToBase64String(model.Avatar.Data, 0, model.Avatar.Data.Length) : null;

            }
            else
            {
                controller.ViewData["Admin_Menu"] = false;
            }<br />
        }
        else
        {
            controller.ViewData["Admin_Menu"] = false;<br />
        }

        base.OnActionExecuting(filterContext);
    }        

}

1. The attacker has convinced a rogue CA to issue an invalid cert for your site.
   This would likely be detected pretty quickly, and would result in browsers dropping that CA from their "trusted CAs" list.
   HPKP[^] can help to prevent this; but if the user's first access to your site is via a compromised network, the HPKP information could also be removed or compromised.
    
2. The attacker has compromised the user's computer, and installed their own root cert in the trusted store, allowing them to issue invalid certs for any site.
   HPKP might help in this case; but if the user's computer has been compromised, the cached pins could also have been deleted or modified.
    
3. The attacker has compromised the user's computer, and installed malware to modify pages after the browser has downloaded them.
   As a site owner, there is nothing you can do to prevent this sort of attack. Even if you add CSP[^] to control which scripts can run, the malware can just remove that header.

var result = CreatedAtRoute("GetSingleMessage", new { id = message.InternalId }, message);
return result;