Input validation
One of the most effective ways to defend your application against injection attacks is writing proper input validation. This defensive programming technique verifies if the input conforms to an expected data format, such as data type, length, or range (to name a few). The input can be from an untrusted source, and without validation, a bad actor can feed malicious data to the ASP.NET Core web application, potentially exploiting a vulnerability. This process could affect the application and could lead it to perform unintended actions.
There are two ways to validate input:
- Blacklisting
- Whitelisting
With the blacklisting validation strategy, known bad input is defined in a list. The data is then verified against this list to decide if the input should be accepted or rejected. However, this approach is flawed as you can only define so much bad input, and it would not be a comprehensive list. An attacker can simply bypass this validation by constructing...
