https://github.com/jujiro/wep-app-sec

A compact ASP.Net application to learn about securing web applications and apis.
https://github.com/jujiro/wep-app-sec

api-secure apis asp-net aspnet aspnet-mvc dotnet learning-by-doing oauth2

Last synced: 3 months ago
JSON representation

A compact ASP.Net application to learn about securing web applications and apis.

• Host: GitHub
• URL: https://github.com/jujiro/wep-app-sec
• Owner: jujiro
• License: mit
• Created: 2019-05-14T00:36:52.000Z (about 7 years ago)
• Default Branch: master
• Last Pushed: 2019-05-22T15:28:55.000Z (about 7 years ago)
• Last Synced: 2025-06-20T19:58:04.215Z (about 1 year ago)
• Topics: api-secure, apis, asp-net, aspnet, aspnet-mvc, dotnet, learning-by-doing, oauth2
• Language: C#
• Size: 21.5 KB
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          
# wep-app-sec

A compact ASP.Net application to learn about securing web applications and apis.

## Introduction

Being a developer for over three decades I have been dealing with with the new keywords, terminology, along with the new and exciting technology, all the time.  Being an old-timer, and a strong proponent of KISS (Keep It Simple and Stupid,) I sometimes feel lost.  In those situations, I try to simplify stuff for others like me, who perhaps can benefit with my work.  This project is along the same lines.

If you are new to this subject, I suggest you to watch a very simple slideshow I prepared on this topic.

[https://www.ipcolony.com/#blog-web-security]

## What you will learn ##

Using this project you will learn pretty much how OAUTH works, though the project itself does not use it.

The following items are covered in the project.

* Forcing https for your site

* Password validation against stored hash

* Returning a token after authentication

* Using token for for subsequent conversation

* Maintaining the tokens on the server side using a simple thread safe list

* Securing Api methods

* Adding added authorization to Api methods so that only selected users can use it