Protecting server-side code.
WHAT TO IMPLEMENT
Authentication through an established provider Authorisation on every protected action, against the specific record Validation of every input Parameterised queries, which the data framework provides by default
WHAT TO NEVER DO
Build queries by string concatenation Disable request validation to make something work Store secrets in configuration files in version control
WHAT TO USE FOR SECRETS
A secret store, with managed identity where the platform supports it.
WHY THAT MATTERS MOST
It removes credentials from configuration entirely.
WHAT TO CONFIGURE
Encryption enforced, with the strict transport policy Security headers Cross-site request protection, which the framework provides Cross-origin rules, restrictively
WHAT TO ENCODE
All output, contextually.
WHAT THE FRAMEWORK DOES BY DEFAULT
Encodes in views, unless deliberately disabled.
WHAT TO CHECK
Where that has been disabled, and why.
WHAT TO SCAN
Dependencies, for known vulnerabilities, on every build.
WHAT TO LOG
Authentication failures and authorisation denials.
WHY
Repeated denials indicate probing.
