AspNetCore.Docs/aspnetcore/security/index.md

title	author	description	ms.author	manager	ms.date	ms.topic	ms.assetid	ms.technology	ms.prod	uid
Overview of ASP.NET Core Security | Microsoft Docs	rachelappel	Learn about authentication, authorization, and security basics in ASP.NET Core	rachelap	wpickett	11/01/2017	article	a8fb7eb7-e0e5-4394-84f3-1f1dbe012345	aspnet	asp.net-core	security/index

ASP.NET Core Security Overview

ASP.NET Core enables developers to easily configure and manage security for their apps. ASP.NET Core contains features for managing authentication, authorization, data protection, SSL enforcement, app secrets, anti-request forgery protection, and CORS management. These security features allow you to build robust yet secure ASP.NET Core apps.

ASP.NET Core security features

ASP.NET Core provides many tools and libraries to secure your apps including built-in Identity providers but you can use 3rd party identity services such as Facebook, Twitter, or LinkedIn. With ASP.NET Core, you can easily manage app secrets, which are a way to store and use confidential information without having to expose it in the code.

Authentication vs. Authorization

Authentication is a process in which a user provides credentials that are then compared to those stored in an operating system, database, app or resource. If they match, users authenticate successfully, and can then perform actions that they are authorized for, during an authorization process. The authorization refers to the process that determines what a user is allowed to do.

Another way to think of authentication is to consider it as a way to enter a space, such as a server, database, app or resource, while authorization is which actions the user can perform to which objects inside that space (server, database, or app).

Common Vulnerabilities in software

ASP.NET Core and EF contain features that help you secure your apps and prevent security breaches. The following list of links takes you to documentation detailing techniques to avoid the most common security vulnerabilities in web apps:

• Cross site scripting attacks
• SQL Injection attacks
• Cross-Site Request Forgery (CSRF)
• Open redirect attacks

There are more vulnerabilities that you should be aware of. For more information, see the section in this document on ASP.NET Security Documentation.

ASP.NET Security Documentation

• Authentication
  • Introduction to Identity
  • Enabling authentication using Facebook, Google and other external providers
  • Configure Windows Authentication
  • Account Confirmation and Password Recovery
  • Two-factor authentication with SMS
  • Using Cookie Authentication without ASP.NET Core Identity
  • Azure Active Directory
    • Integrating Azure AD Into an ASP.NET Core Web App
    • Calling a ASP.NET Core Web API From a WPF Application Using Azure AD
    • Calling a Web API in an ASP.NET Core Web Application Using Azure AD
    • An ASP.NET Core web app with Azure AD B2C
  • Securing ASP.NET Core apps with IdentityServer4
• Authorization
  • Introduction
  • Create an app with user data protected by authorization
  • Simple Authorization
  • Role based Authorization
  • Claims-Based Authorization
  • Custom Policy-Based Authorization
  • Dependency Injection in requirement handlers
  • Resource-based authorization
  • View-based authorization
  • Limiting identity by scheme
• Data Protection
  • Introduction to Data Protection
  • Getting Started with the Data Protection APIs
  • Consumer APIs
    • Consumer APIs Overview
    • Purpose Strings
    • Purpose hierarchy and multi-tenancy
    • Password Hashing
    • Limiting the lifetime of protected payloads
    • Unprotecting payloads whose keys have been revoked
  • Configuration
    • Configuring Data Protection
    • Default Settings
    • Machine Wide Policy
    • Non DI Aware Scenarios
  • Extensibility APIs
    • Core cryptography extensibility
    • Key management extensibility
    • Miscellaneous APIs
  • Implementation
    • Authenticated encryption details
    • Subkey Derivation and Authenticated Encryption
    • Context headers
    • Key Management
    • Key Storage Providers
    • Key Encryption At Rest
    • Key Immutability and Changing Settings
    • Key Storage Format
    • Ephemeral data protection providers
  • Compatibility
    • Sharing cookies between applications
    • Replacing in ASP.NET
• Create an app with user data protected by authorization
• Safe storage of app secrets during development
• Azure Key Vault configuration provider
• Enforcing SSL
• Anti-Request Forgery
• Preventing Open Redirect Attacks
• Preventing Cross-Site Scripting
• Enabling Cross-Origin Requests (CORS)