Tag: security
All the articles with the tag "security".
Three ways to say [Authorize], one way to check it: fixing ASP.NET Core's security-metadata guard
ASP.NET Core routing refuses to run an endpoint whose authorization metadata nothing will enforce. That guard only recognized one of the three kinds of authorization metadata. Notes on PR #67742: where the gap was, a short-circuited endpoint that served 200 without authentication on .NET 10, and the fix.
POST in, DELETE out: antiforgery and HttpMethodOverride in ASP.NET Core
UseAntiforgery() validates tokens only for POST, PUT and PATCH. Put form-field HttpMethodOverride in front of it and a cross-site POST becomes a DELETE that is never checked. Notes on PR #66772 and docs PR #37224: why the method list is what it is, a working repro on .NET 10, and what we documented.
"If you didn't request this, you can ignore it": the default Identity emails go to strangers too
Anyone can type any address into a register or forgot-password form, so ASP.NET Core Identity's default emails regularly reach people who never asked for them. Notes on PR #66747: where that text actually ships, a wording problem caught in review, and a test that turned out to be parsing the email.
ES256 doesn't mean P-256 (unless you check): fixing passkey key validation in ASP.NET Core
A passkey public key carries an algorithm and a curve, and WebAuthn says they have to agree. ASP.NET Core Identity didn't check that. Notes on PR #68834: where the gap comes from, what a mismatched key actually does in .NET, and the fix.