Latest Trends In .Net Programming

.NET is a highly popular programming language from Microsoft that continues to rock the IT industry since its inception almost twelve years ago. Simply stated, it is a development framework comprising of multiple modules that helps in creating Web Applications, Windows Applications as well as Mobile Applications. The demand for .NET programmers saw a definite surge in the last decade - thanks to the evolution of the smart phones.

Listed below are some of the recent and prevalent aspects of .Net

ASP .NET - Web API

Microsoft considers Web AP I as the future of ASP .NET. The world of web is heading towards a simpler, lightweight, REST based services. Web API makes it possible with the ASP.NET MVC without the heavy lifting that WCF requires. jQuery could be utilized for displaying results in front end of the page as shown in the example in Microsoft site.

DotNetNuke

As the software industry is now focusing more towards web services and client side development, Microsoft had launched a hybrid model called ‘DotNetNuke’ which enables the developers to program using modern web techniques while it also provides compatibility to the existing modules. The DotNetNuke was later renamed as DNN EVOQ CONTENT, which is a powerful, robust content management system.

POS for .NET

Point of service is one area where .NET was lacking behind until recently when Microsoft declared such thing for .NET 1.14. It is a class library that gives the POS developers an option to incorporate Microsoft .NET technologies in their products. With the implementation of POS, it has become way too simple for developing applications by providing an application programming interface (API) which is built on top of .NET Framework class libraries.

Portable class library for .NET

The dot Net team had introduced an all new Portable class Library (PCL) which helps the developers to build .NET apps across a wide range of platforms with a provision to share the code and libraries across. Prior to this, there was a license restriction which allowed the usage of PCL reference assemblies only on the windows based systems. But after this, a new standalone release of PCL reference assembliescomes up with a license to use it in any operating system. This gives the developers a lot more freedom and flexibility to innovate great things with the .NET in the future.

SignalR – It is Real-time Everything

SignalR is the innovative library that helps in adding real-time web features to ASP.NET applications. This feature finds extensive uses in gaming applicationswherein there need to be frequent server updates. Since more applications move to a single-page model, real-time-web comes as a boon.

Conclusion

.NET is showing tremendous improvements in the last few years. It might be clichéd to say, change is the only constant thing in the world. But it sounds appropriate with .NET as there are a lot of new advancements that comes up each and every day. Dot NET is one of the most sought after key skills all over the world.  In a survey conducted recently, senior .NET developers earn in an average $97,290 per year, making this programming language a bankable career.

Top 7 Tips for Developing a Secure ASP.NET Web Application

As the usage of the internet and the number of web applications over the internet have gone exponentially high there are bad people who continuously work around the clock to hack them. It may be for personal gain or just as an amateur act. Despite the intention of the bad guy the damage caused to the organization hosting the site or its users should be taken into account. As a professional web application developer it is a must to be aware of the best practices to follow in order to make the application more secure. In this article I will be listing and explaining my top 7 tips for developing a secure asp.net application.

Don’t Let Your Users be Victims of Click Jacking

Have you ever thought about someone framing your website onto theirs, making your users to be the victims of click jacking? Yes, the attackers can load your website onto their site in an iframe. They can then skillfully place their transparent controls over your website and fetch the PII information, user credentials, make them perform an unwanted task like exposing their financial information, etc.

In order to prevent that you will have to use a frame busting technique. The following script will not allow your website to be iframed. This can be placed in your master pages.

    <script type="text/javascript" language="javascript">
        //Check if the top location is same as the current location
        if (top.location.hostname != self.location.hostname) {
            //If not then set the top to you current
            top.location.href = self.location.href;
        }
    </script>
 

In addition to the above script don’t forget to add the following header, which informs the browser to DENY framing of this website. This is supported in all major browsers except IE versions less than 8.

The header should be added in the global.asax application start event.

protected void Application_Start(object sender, EventArgs e)
{
            HttpContext.Current.Response.AddHeader("x-frame-options", "DENY");
}
 

White List the Request URL

Though we have many techniques to perform the security preventions inside the application it is most important to prevent the bad data from being entered into your website at the first place. Most attacks happen through the query string values passed through the URL. It is a best security practice to define a common place like an HttpModule to white list the URL, i.e. sanitize the entire URL with a set of white listed characters and drop all the bad ones. It means you will not encourage any other characters apart from a white listed set defined in your application.

It is important for you to know that black listing is not a foolproof mechanism and it can be broken by the hackers easily.

Practice of Encoding the Data

While processing and sending, the data in the response that is fetched from outside the trust boundary should always be encoded. The type of encoding may differ based on the usage of the non-trusted data. For example perform an HtmlEncode for the data that is sent to the client page.

Label1.Text = Server.HtmlEncode(Request.QueryString["BadValue"]);

Encoding the data will make the XSS scripts inactive and prevent them from being executed. Microsoft has provided the AntiXss library, which provides more sophisticated encoding methods including the JavascriptEncode.

Using Cookies

As a web developer you should take utmost care while using cookies, which may open a back door for the hackers to get into your applications. Following are the best practices while using a cookie to store information.

1. Is your website is hosted under SSL? Then be sure to mark your cookies as secure. This will make them available only in the SSL transmissions.

 HttpCookie cookie = new HttpCookie("MySecureCookie");
 cookie.Value = "This is a PII information";
 cookie.Secure = true;

2. If your website is not SSL enabled then always encrypt the values using a strong encryption mechanism like AES 256 and then store them in the cookies.

Secure the Service Calls (WCF / Web Service)

Are you exposing WCF services through basicHttpBinding? Then think again because the messages transmitted over will be plain text and any intruder will be able to trap the requests and even simulate them easily. Use wsHttpBinding, which will transport the messages in an encrypted format, which makes the life of the intruder hard.

Though you make lots of protections for your WCF or web services it is a best practice to host the services under an SSL layer.

Never Deploy the Application with debug=”true”

It is strongly recommended not to deploy your applications in the production environment with compilation debug=”true” in your web.config. This will result in a big nightmare for performance and security of the application.

This may leak too much information for the attackers, for example the stack trace in the event of an unhandled exception and the debug trace information. Such exposure of the internals will be good bucks for the attackers.

    <system.web>
        <compilation debug="false" targetFramework="4.0" />
    </system.web>

Thinking About Turning Off ViewStateMAC?

Turning off ViewStateMAC will create a security loophole in your asp.net application if you are using Viewstate on your web pages. The intruders will easily be able to intercept, read the 64 bit encoded values and modify them to do some bad things to your website. Having it turned on ensures that the viewstate values are not only encoded but also a cryptographic hash is performed using a secret key.

<pages enableViewStateMac="true"></pages>

I hope this article is useful for the developers who thrive at making their asp.net application an absolutely impossible place for the hackers to deal with.

Happy reading!