NET Centric Computing · Unit 8 · 5 hrs
Securing in ASP.NET Core Application
Exam-focused notes for Securing in ASP.NET Core Application (NET Centric Computing, CSC378): what the TU syllabus asks and how it has actually been tested, with 8 solved past questions from this unit.
What this unit covers
- Authentication: ASP.NET Core Identity
- Adding authentication to apps and identity service configurations
- Authorization: Roles, Claims and Policies
- Securing Controllers and Action Methods
- Common Vulnerabilities: Cross-site Scripting attacks, SQL Injection attacks, Cross-site Request Forgery (CSRF), Open Redirect Attacks
Authorization
Distinguish between roles and policies. Explain about Kestrel web server in ASP.NET core. [5]
--- Basis Roles Policies --------- Definition Roles are a way to group users based on their job or function (e.g., Admin, User, Manager) Policies are a set of requirements that must be satisfied for authorization to succeed Approach Role-based authorization...
Full solved answer →Define claim and policy in terms of authorization. How and when do you create hidden fields? [5]
--- A claim is a name-value pair that represents a piece of information about a user. It describes who the user is, not what they can do. Claims are issued by a trusted authority and are stored in the user's identity. Examples of claims: - Name: "John", Rol...
Full solved answer →How do you assign roles, claims and policies? Explain with an example. [5]
Authorization in ASP.NET Core is handled through three main mechanisms: Roles, Claims, and Policies. --- A role is a label assigned to a user that defines what group they belong to (e.g., Admin, User, Manager). Role-based authorization checks whether a user...
Full solved answer →Common Vulnerabilities
Explain the chances of SQL injection attack with a scenario. [5]
SQL Injection (SQLI) is a common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed. It usually occurs when a user provides an SQL statement as input instead of the expect...
Full solved answer →Explain the uses of cookies. What types of vulnerabilities can occur in web application? Show the case of Cross-site Scripting attack.[10]
--- A cookie is a small piece of data stored on the client's browser by the web server. Cookies are used to maintain state information between the client and server across multiple HTTP requests (since HTTP is stateless). Use Description ------------------ ...
Full solved answer →What types of problems lead to SQL injection attack? Discuss any two types of ASP.Net host models. [5]
--- SQL Injection (SQLi) is a common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed. This information may include sensitive data, user lists, or private customer detai...
Full solved answer →Define open redirect attacks. Discuss about docker and containerization. [5]
--- An open redirect attack is a web security vulnerability where an attacker manipulates a web application to redirect users to an arbitrary, potentially malicious external URL without proper validation. - Web applications often use URL parameters to redir...
Full solved answer →How can you prevent SQL injection attack? Explain with an example. [5]
SQL Injection is a security vulnerability where an attacker inserts or "injects" malicious SQL code into an input field, which is then executed by the database. This can allow attackers to bypass authentication, access unauthorized data, or even destroy the...
Full solved answer →Make Unit 8 stick
Practice CSC378 with flashcards & quizzes