Chapter 3: Broken Authentication
Perhaps the most crucial security requirement of all – authentication – is necessary to verify and confirm identity in an ASP.NET web application. Failing to implement strong authentication allows hackers to expose this flaw and exploit it to gain forbidden access.
Weak password policies, missing brute-force attack prevention mechanisms, weakly hashed passwords, and long active sessions are a few root causes of these authentication defects. Proper credential management and session configuration are key in preventing these vulnerabilities in code. This chapter will teach us how to fix these issues.
In this chapter, we're going to cover the following recipes:
- Fixing incorrect restrictions of excessive authentication attempts
- Fixing insufficiently protected credentials
- Fixing user enumeration
- Fixing weak password requirements
- Fixing insufficient session expiration
By the end of this chapter, you will...
