authentication

408 notes in this subject, read out of this brain and free to use. This is page 2 of 7.

Storage encryption for drone data at rest

Ensure data is secure at rest on drones, even if someone gains physical access while the drone is powered off. Recommended tools include LUKS for block-level encryption, gocryptfs for filesystem in userspace, and age for file encryption.

802.11w MFP for Wi-Fi deauthentication attack prevention

Use 802.11w Management Frame Protection (MFP) to prevent Wi-Fi deauthentication attacks. This is a default protocol in up-to-date Wi-Fi systems and prevents crafted packets that emulate a server from causing deauthentication.

MAVLink 2.0 message signing requirement

Implement message signing in MAVLink 2.0 protocol to prevent spoofing and replay attacks. Secure heartbeat messages to avoid command injection vulnerabilities. Heartbeat messages are single bytes sent at a certain frequency to all other nodes to inform of device existence.

Forgot Password: URL tokens - add Referrer Policy header

The reset password page should add the Referrer-Policy HTTP header with the value 'noreferrer' to avoid referrer leakage that could expose the reset token.

Forgot Password: URL tokens - use HTTPS

Reset URLs containing tokens must use HTTPS, not HTTP.

Forgot Password: URL tokens - avoid Host header injection

When creating reset URLs with tokens, do not rely on the Host header to avoid Host Header Injection attacks. The URL should either be hard-coded or validated against a list of trusted domains.

Forgot Password: token requirements - secure storage

Reset tokens must be stored securely, following the same practices as password storage, such as hashing.

Forgot Password: input validation and SQL injection prevention

Employ normal security measures such as SQL Injection Prevention methods and Input Validation when processing the username or email in the forgot password request.

Forgot Password: token requirements - cryptographic generation

Reset tokens must be generated using a cryptographically secure random number generator, not a standard random function.

Forgot Password: token requirements - single use and expiration

Reset tokens must be single use only and expire after an appropriate period.

Forgot Password: token requirements - sufficient length for brute-force protection

Generated tokens must be sufficiently long to protect against brute-force attacks.

Forgot Password: offline methods - provide identifier at registration

Offline methods allow users to reset their password without requesting a special identifier from the backend. These identifiers should be provided either on registration or when the user wishes to configure it, and should be stored offline in a secure fashion such as in password managers.

Forgot Password: JWT alternative to random tokens

JSON Web Tokens (JWTs) can be used in place of random tokens for reset identifiers, although this can introduce additional vulnerabilities as discussed in the JSON Web Token Cheat Sheet.

Forgot Password: URL tokens recommended implementation method

URL tokens are recommended for the simplest and fastest implementation of password reset, passed in the query string of the URL and typically sent via email.

Forgot Password: use side-channel to communicate reset method

Use a side-channel such as email or SMS to communicate the method to reset the password, rather than providing it directly in the initial response.

Forgot Password: security questions - not sole mechanism

Security questions should not be used as the sole mechanism for resetting passwords because their answers are frequently easily guessable or obtainable by attackers. They can provide an additional layer of security when combined with other methods.

Forgot Password: URL tokens - protect against brute-forcing tokens

Implement appropriate protections to prevent users from brute-forcing tokens in the URL, such as rate limiting.

Forgot Password: session invalidation after reset

Ask the user if they want to invalidate all of their existing sessions, or invalidate the sessions automatically after a password reset.

Forgot Password: do not automatically log user in after reset

After the user sets their new password, they should login through the usual mechanism. Do not automatically log the user in, as this introduces additional complexity to authentication and session handling code and increases the likelihood of introducing vulnerabilities.

Forgot Password: password reset - apply consistent password policy

Ensure that a secure password policy is in place during the reset process and is consistent with the rest of the application.

Forgot Password: password reset confirmation - require twice entry

The user should confirm the password they set by writing it twice to ensure they did not make a typo.

Forgot Password: PINs - create limited session

Create a limited session from the PIN that only permits the user to reset their password, not to perform other account actions.

Forgot Password: PINs - formatting for usability

Breaking the PIN up with spaces makes it easier for the user to read and enter.

Forgot Password: PINs - recommended length

PINs sent via SMS or other side-channels should be between 6 and 12 digits long.

Automatic anti-forgery token generation in ASP.NET Core 2.0+

Starting with ASP.NET Core 2.0, anti-forgery tokens are automatically generated and verified. Tag helpers automatically send tokens with forms. If not using tag helpers, use @Html.AntiForgeryToken() in the form.

Anti-forgery token validation with ValidateAntiForgeryToken

Apply [ValidateAntiForgeryToken] attribute to POST/PUT action methods to validate CSRF tokens. In ASP.NET Framework, include @Html.AntiForgeryToken() in the form.

HTTP to HTTPS redirect in ASP.NET Core Startup

In Startup.cs Configure() method, call app.UseHttpsRedirection() to redirect HTTP requests to HTTPS.

HTTP to HTTPS redirect in Global.asax

In Global.asax.cs Application_BeginRequest, redirect any HTTP request to HTTPS: if (!Request.IsLocal && !Context.Request.IsSecureConnection) { var redirect = Context.Request.Url.ToString().ToLower().Replace("http:", "https:"); Response.Redirect(redirect); }

Debug and trace disabled in production

Ensure debug and trace are off in production using web.config transforms: <compilation xdt:Transform="RemoveAttributes(debug)" /> and <trace enabled="false" xdt:Transform="Replace"/>.

LDAP injection prevention - character escaping

In LDAP Distinguished Names, certain characters must be escaped with backslash. The space character must only be escaped if it is leading or trailing in a component name (e.g., Common Name), not when embedded. Refer to LDAP Injection Prevention Cheat Sheet for the complete character escaping table.

Base64 encoding for command-line arguments

Consider encoding user input using Base64 before passing as command-line parameters, which safely encodes any special characters and should be decoded by the receiving application.

ProcessStartInfo.ArgumentList security disclaimer

ProcessStartInfo.ArgumentList in .NET Core 2.2+ and .NET 5+ performs character escaping but includes a disclaimer that it is not safe with untrusted input. Alternative approaches like Base64 encoding are recommended.

Database least privilege principle

Connect to the database using an account with the minimum set of permissions required to do its job, not the database administrator account.

SQL injection prevention using parameterized queries in Entity Framework

Use parameterized queries in Entity Framework: var sql = @"Update [User] SET FirstName = @FirstName WHERE Id = @Id"; context.Database.ExecuteSqlCommand(sql, new SqlParameter("@FirstName", firstname), new SqlParameter("@Id", id));

AES-GCM key size for symmetric encryption

Use a 32-byte (256-bit) key for AES-GCM symmetric encryption.

Windows Data Protection API for local storage encryption

Use the Windows Data Protection API (DPAPI) for secure local storage of sensitive data.

Content Security Policy configuration in Startup.cs

Configure CSP in Startup.cs: app.UseCsp(opts => opts.BlockAllMixedContent().StyleSources(s => s.Self()).StyleSources(s => s.UnsafeInline()).FontSources(s => s.Self()).FormActions(s => s.Self()).FrameAncestors(s => s.Self()).ImageSources(s => s.Self()).ScriptSources(s => s.Self())).

Security headers configuration in Startup.cs for ASP.NET Core

Configure security headers in Startup.cs: app.UseHsts(hsts => hsts.MaxAge(365).IncludeSubdomains()), app.UseXContentTypeOptions(), app.UseReferrerPolicy(opts => opts.NoReferrer()), app.UseXXssProtection(options => options.FilterDisabled()), app.UseXfo(options => options.Deny()).

Unique email requirement in ASP.NET Core Identity

Set User.RequireUniqueEmail = true to enforce unique email addresses across the application.

Security headers configuration in web.config

Configure security headers in web.config system.webServer: X-Content-Type-Options = "nosniff", X-Frame-Options = "DENY", X-Permitted-Cross-Domain-Policies = "master-only", X-XSS-Protection = "0", remove X-Powered-By header, and set httpRuntime enableVersionHeader="false" and requestFiltering removeServerHeader="true".

TLS 1.2+ for entire site

Use TLS 1.2 or later for the entire site. Do not allow SSL as it is now obsolete. Free certificates are available from LetsEncrypt.org with automated renewals.

AES-512 for personally identifiable data encryption

Use AES-512 as a strong encryption algorithm when personally identifiable data needs to be restored to its original format.

Application cookie configuration in ASP.NET Core

Configure application cookies with ConfigureApplicationCookie: Cookie.HttpOnly = true, ExpireTimeSpan = TimeSpan.FromMinutes(60), SlidingExpiration = false. HttpOnly prevents JavaScript access, ExpireTimeSpan sets the session timeout, and SlidingExpiration controls whether the timeout resets on each request.

Password complexity requirements in ASP.NET Core Identity

Configure password policy in IdentityOptions: RequireDigit = true, RequiredLength = 8, RequireNonAlphanumeric = true, RequireUppercase = true, RequireLowercase = true, RequiredUniqueChars = 6. These settings enforce passwords that will survive dictionary attacks.

Salt usage for password hashing

When using a hashing function to hash non-unique inputs such as passwords, use a salt value added to the original value before hashing.

AES-GCM nonce management for encryption

When using AES-GCM encryption, use a nonce of maximum size (12 bytes / 96 bits) and generate a different nonce for every encryption operation, even if the same key is used. This is critical for the security of authenticated encryption.

SHA512 for general-purpose hashing in .NET

System.Security.Cryptography.SHA512 is the strongest general-purpose hashing algorithm in both .NET Framework and .NET Core.

Role-based authorization at method level

Use [Authorize(Roles = "Admin")] attribute at method level to restrict access to specific roles. Example: [Authorize(Roles = "Admin")] [HttpGet] public ActionResult Index(int page = 1).

Email confirmation requirement in ASP.NET Core Identity

Set SignIn.RequireConfirmedEmail = true to require email confirmation before user sign-in.

OS command execution using System.Diagnostics.Process.Start

Use System.Diagnostics.Process.Start to call underlying OS functions safely. Set FileName to the command and Arguments to command-line arguments. Avoid concatenating user input into the command or arguments.

AutoValidateAntiforgeryTokenAttribute global filter

In ASP.NET Core, add AutoValidateAntiforgeryTokenAttribute as a global filter to automatically validate anti-forgery tokens on all requests except GET, HEAD, OPTIONS, and TRACE: services.AddMvc(options => { options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute()); });

Authorization at controller level using Authorize attribute

Apply [Authorize] attribute at the controller level to protect all endpoints in that controller. Example: [Authorize] public class UserController. This ensures all methods require authentication unless explicitly overridden with [AllowAnonymous].

HTTPS enforcement for cookies in production

Enforce cookies sent over HTTPS in production using web.config with httpCookies requireSSL="true" and forms authentication requireSSL="true". This ensures cookies are only sent over secure connections.

Session timeout and sliding expiration configuration

Set ExpireTimeSpan to TimeSpan.FromMinutes(60) and SlidingExpiration to false to enforce absolute session lifetime and limit how long a stolen session can be reused. SlidingExpiration set to false means the session does not extend on each request. If set to true, the session timeout resets after each request, keeping active users logged in longer but at increased risk if compromised.

CookieHttpOnly flag to prevent client-side script access

Set CookieHttpOnly to true in cookie configuration to prevent client-side JavaScript from accessing the cookie. This is configured via the CookieHttpOnly property.

Remove Server header from HTTP responses

Remove the Server header from HTTP responses using HttpContext.Current.Response.Headers.Remove("Server") to prevent server information disclosure.

EnableVersionHeader false to hide .NET version

Set httpRuntime enableVersionHeader="false" in web.config system.web section or via Machine.config to prevent .NET version disclosure in HTTP headers.

Anti-forgery cookie removal on logout

On logout, ensure anti-CSRF cookies are completely removed by finding the __RequestVerificationToken cookie and setting its Expires to DateTime.Now.AddDays(-1).

IgnoreAntiforgeryToken attribute for specific methods

Use [IgnoreAntiforgeryToken] attribute on individual controller methods or Razor page classes to disable anti-forgery validation for specific actions.

ValidateAntiforgeryToken for GET requests in ASP.NET Core

Apply [ValidateAntiforgeryToken] to GET, HEAD, OPTIONS, or TRACE methods if you need to validate CSRF tokens on these HTTP methods.

Give your agent this brain