Chapter 7: Security Misconfiguration
An oversight in disabling security controls in any application layer, most especially in code, could leave an ASP.NET Core web application susceptible to much more varied attacks. Overlooking disabling debugging in production, inadvertently logging traces, missing necessary attributes in cookies, and HTTP security headers are just a few of the root causes of security misconfiguration. Hardening your web application for security starts with code and can also be the weak link of an app if not done correctly.
In this chapter, we're going to cover the following recipes:
- Disabling debugging features in non-development environments
- Fixing disabled security features
- Disabling unnecessary features
- Fixing information exposure through an error message
- Fixing information exposure through insecure cookies
By the end of this chapter, you will have learned how to prevent security misconfiguration by turning debugging off...
