Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rapidly Build SaaS apps on ASP.NET/ServiceStack based on zero-trust security

aspsecuritykit.net

Post reply on HN
Print view View original

11–20 of 24 posts

Re: Rapidly Build SaaS apps on ASP.NET/ServiceStack based on zero-trust security

#11

Post by gregmac »

fm200 wrote: post #6

I have to say it, but asp.net and microsoft in general fits very well into my idea of zero-trust per se. Jokes aside, i dont know that much how is it today, but years ago i had to run some asp.net apps in production, it was a nightmare...

There's good and bad apps, like most platforms, and it is comparable to PHP from that perspective. Having worked extensively in both, I'd say the general problem with PHP is it's really easy for a beginner to get started, and just easy to grow a small, simple app into a large, functional-but-awful monstrosity.

ASP.NET is really just a foundation layer for a whole bunch of different web frameworks including WebAPI, MVC, RazorPages, Blazor, WCF and WebForms. I'd blame WebForms in particular for a lot of the bad apps: it basically tries to make the web act like stateful Windows Forms apps (literally with controls that have "server-side events" and maintain state across several HTTP requests). As a result, lots of Windows Forms developers could build apps without actually understanding a lot of the complexity of the web and especially its security implications.

Re: Rapidly Build SaaS apps on ASP.NET/ServiceStack based on zero-trust security

#13

Post by martinald »

Just some feedback, I found the audio in the video explainer hard to follow. It sounded sort of weirdly text to speech and/or there were grammar mistakes in the original transcript. I'd get a professional to rerecord it.

Looks interesting though.

Re: Rapidly Build SaaS apps on ASP.NET/ServiceStack based on zero-trust security

#14

Post by thrower123 »

gregmac wrote: post #11
fm200 wrote: post #6

I have to say it, but asp.net and microsoft in general fits very well into my idea of zero-trust per se. Jokes aside, i dont know that much how is it today, but years ago i had to run some asp.net apps in production, it was a nightmare...

There's good and bad apps, like most platforms, and it is comparable to PHP from that perspective. Having worked extensively in both, I'd say the general problem with PHP is it's really easy for a beginner to get started, and just easy to grow a small, simple app into a large, functional-but-awful monstrosity. ASP.NET is really just a foundation layer for a whole bunch of different web frameworks including WebAPI, MV…

I wonder how many WebForms sites have been built new in the past decade?

Probably more than I'd think...

Re: Rapidly Build SaaS apps on ASP.NET/ServiceStack based on zero-trust security

#15

Post by abgr-y »

lukevp wrote: post #10
TriNetra wrote: post #5

Earlier quoted context omitted.

Glad you asked! I'd incurrage to go through this [0] guide, or watch [1] video. But briefly: ASP.NET Core policy authorization works on full trust mode when it comes to the data sent by the callers. This means unless you write code to authorize access to resources, users will have access to everything. And to authorize a single resource mentioned in an API operation, you have to write lot of code including a requirem…

Agreed that open by default is bad once you start building APIs, but it’s pretty easy to register a default policy to require authorization and override it with AllowAnonymous or other policies as required.

Agreed but i guess the point with aspsecuritykit is that it requires authorization by default and one need not do any additional setup for that

Re: Rapidly Build SaaS apps on ASP.NET/ServiceStack based on zero-trust security

#16

Post by abgr-y »

1cvmask wrote: post #12

How can one add a mfa solution like saas pass to this? Or do you add it?

https://aspsecuritykit.net/features/#mfa, ASPSecurityKit mentions it can integrate with different token providers and Saas Pass has custom integration via API as well

Re: Rapidly Build SaaS apps on ASP.NET/ServiceStack based on zero-trust security

#17

Post by abgr-y »

thrower123 wrote: post #14
gregmac wrote: post #11

Earlier quoted context omitted.

There's good and bad apps, like most platforms, and it is comparable to PHP from that perspective. Having worked extensively in both, I'd say the general problem with PHP is it's really easy for a beginner to get started, and just easy to grow a small, simple app into a large, functional-but-awful monstrosity. ASP.NET is really just a foundation layer for a whole bunch of different web frameworks including WebAPI, MV…

I wonder how many WebForms sites have been built new in the past decade? Probably more than I'd think...

exactly ASP.Net is a much more mature framework right now and web forms seems to be the least preferred option to build apps

Re: Rapidly Build SaaS apps on ASP.NET/ServiceStack based on zero-trust security

#19

Post by TriNetra »

martinald wrote: post #13

Just some feedback, I found the audio in the video explainer hard to follow. It sounded sort of weirdly text to speech and/or there were grammar mistakes in the original transcript. I'd get a professional to rerecord it. Looks interesting though.

Yes, it's based on Microsoft Neural speech [0]. We made it in quick turn-around, with frequent changes, so thought of doing it first with Neural speech. Can definitely switch to a real human speech now as the content is relatively stable (though we're working for a client on an attribute-based authorization policies, extending ADA with that, so more changes will come to the first video!)

0: https://docs.microsoft.com/en-us/azure/cognitive-services/sp...

Re: Rapidly Build SaaS apps on ASP.NET/ServiceStack based on zero-trust security

#20

Post by TriNetra »

lukevp wrote: post #10
TriNetra wrote: post #5

Earlier quoted context omitted.

Glad you asked! I'd incurrage to go through this [0] guide, or watch [1] video. But briefly: ASP.NET Core policy authorization works on full trust mode when it comes to the data sent by the callers. This means unless you write code to authorize access to resources, users will have access to everything. And to authorize a single resource mentioned in an API operation, you have to write lot of code including a requirem…

Agreed that open by default is bad once you start building APIs, but it’s pretty easy to register a default policy to require authorization and override it with AllowAnonymous or other policies as required.

The focus here is on resource authorization, and for that there's no default in policy authorization. You've to write code in action body, capturing each id input from the request object, and authorizing it via the default authService explicitly. You can imagine that it's easy to miss out on some property – say by a new developer down the line while adding a new property to the request model. And if that happens, a whole for the intruder becomes available to pass any id, and leak data of your users.

Additionally, the problems of your auth code mixing with action body, and hard-coded checks of roles/privileges and extensive testing for changes are always there.

While with ASPSecurityKit's ADA, it's always unobtrusive and kinda automated authorization once you've setup the convention in the beginning of the project (which is fairly simple, one line of code usually as shown in the video). If you forget something, the default is with ADA to deny access (zero-trust), and not pass-through.

HOpe it made sense - happy to give more examples. You can also go through the guide https://aspsecuritykit.net/guides/aspnet-policy-authorizatio...

Post reply on HN