Asp.Net Core Web API Security Checklist. TOP 3 Vulnerabilities And How To Fix Them

Security in Asp.Net Core web APIs is very important. We all know this, but sometimes we lose focus on security aspects that really matter. That's why in this video I present you and Asp.Net Core Web API Security checklist, with practical examples. Specifically we will look into the 3 OWASP mentioned vulnerabilities, including broken object level authorization, broken function level authorization and SQL injection.
#aspnetcore #dotnet #csharp #security #programming

Join this channel to get source code access and other perks:

Also follow me here (especially if you are a self taught developer):

Content
1. Intro: 00:00
2. Introducing OWASP: 00:29
3. Broken object level authorization: 01:07
4. What the problem is: 01:27
5. How to fix it: 02:59
6. Broken function level authorization: 06:40
7. How to fix it: 09:08
8. Other mitigations: 10:15
9. SQL injection: 11:00
10. How to fix it: 13:19
11. Conclusions: 14:38

My setup:

[Tolmachovtv]

Thank you for such short and clear explanation, especially for practical examples

[asiridissanayaka]

Very much practical and well explained.

[uzayrsyed]

Love the fact you actually demonstrated these security concepts with code. Thank you! Also for the Broken Object Level Authorization example could we alternatively embed the shopId into the jwt token or cookie as a claim on login then the subsequent requests to the "revenue" endpoint can use this shopId to fetch revenue?

[dotnetdevni]

I have been thinking about this more and more should I be encrypting the payload I always have ssl and all but most of the times im passing jason data.

[hifirulezzz]

Security is important, but who is sending id in the header? It is dumb. Token should be created and encrypted during login. Only token contains information for authentication and authorization