Understanding best practices to secure client and server applications

There are several best practices recommended for securing your web application. .NET Core and Azure services make it easy to ensure their adoption. The following are key ones you may consider:

• Enforce HTTPS for web applications. Use UseHttpsRedirection middleware to redirect requests from HTTP to HTTPS.
• Use modern authentication frameworks based on OAuth 2.0 and OIDC to secure your web or API app.
• If you are using the Microsoft identity platform, use open source libraries such as MSAL.js and MSAL.NET to acquire or renew tokens.
• Configure strong password requirements and lock your account in the case of continuous failed login attempts—for example, five consecutive failed attempts. This can prevent a brute-force attack.
• Enable MFA for privileged accounts such as back office admin or back office staff accounts, and so on.
• Configure session timeouts; invalidate session on logout; clear...