Content-Security-Policy in ASP.NET MVC

Few good links for securing your asp.net mvc site

1. After applying SecurityHeaders validate
2. Content-security-policy-for-asp-net-mvc
3. Improving security in ASP.NET MVC using custom headers
4. Content-Security-Policy in ASP.NET MVC
5. Adding HTTP Headers to Improve Security

Securing request pipeline of an ASP.NET MVC 5 Application

Good link describing how asp.net mvc request/response pipeline works.

If you are planning to make a custom security layer then this links may interest you.

• Asp.net Mvc 5 Life cycle: http://www.asp.net/mvc/overview/getting-started/lifecycle-of-an-aspnet-mvc-5-application
• Whtat is OWIN: http://www.asp.net/mvc/overview/getting-started/lifecycle-of-an-aspnet-mvc-5-application
• OWIN and Project Katana: http://www.asp.net/aspnet/overview/owin-and-katana
• Understanding OWIN in more details: http://chris.59north.com/post/Understanding-OWIN-(Katana)-Authentication-Middleware

Securing Asp.net Application

Incase if you haven't viewed this video which is talking on basic and very important aspect of securing your asp.net application, then I will strongly recommend everyone to view this video.

Asp.net Security - Validating Uploaded Image File Format

I found two really good links talking about how to upload image file and validate file format in more secure way rather than just checking file extension.

• http://www.dotnetexpertguide.com/2011/05/validate-uploaded-image-content-in.html
• http://www.aaronstannard.com/post/2011/06/24/How-to-Securely-Verify-and-Validate-Image-Uploads-in-ASPNET-and-ASPNET-MVC.aspx

You should also check image file content before you try checking for header of image file.

I found both the articles have missed this code.  Here is that missing code for validating file extension.

private Boolean CheckFileType()
        {
            string[] acceptedTypes = new string[]
            {
                "image/bmp",
                "image/jpeg",                
                "image/gif",
                "image/png"
            };

            if (!acceptedTypes.Contains(fuPhoto1.PostedFile.ContentType))
            {
                return false;
            }
            else
            {
                return true;
            }
        }


Note: This article is basically bookmark for my future reference.