Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rapidly Build SaaS apps on ASP.NET/ServiceStack based on zero-trust security

aspsecuritykit.net

Post reply on HN
Print view View original

21–24 of 24 posts

Re: Rapidly Build SaaS apps on ASP.NET/ServiceStack based on zero-trust security

#21

Post by TriNetra »

1cvmask wrote: post #12

How can one add a mfa solution like saas pass to this? Or do you add it?

Yes you can integrate with any provider. the pipeline [0] is the enforcement part – performing MFA checks like "Is MFA enabled on user? is it applicable for this request (can be turned off for programmatic api-based access, for example) etc."

It's the job of the application to prompt caller for 2FA input and verify it using the provider/device of your choice.

But to save you time even with that implementation, ASPSecurityKit has a category of products called source packages, which provide full implementation of several commonly needed functionality, including 2FA workflow [1], installed right into your project as source code, so you can switch to any MFA provider easily by modifying the code that sends MFA token to the device.

0: https://aspsecuritykit.net/docs/article/the-security-pipelin...

1: https://aspsecuritykit.net/docs/article/source-packages/?pac...

Re: Rapidly Build SaaS apps on ASP.NET/ServiceStack based on zero-trust security

#22

Post by TriNetra »

gregmac wrote: post #11
fm200 wrote: post #6

I have to say it, but asp.net and microsoft in general fits very well into my idea of zero-trust per se. Jokes aside, i dont know that much how is it today, but years ago i had to run some asp.net apps in production, it was a nightmare...

There's good and bad apps, like most platforms, and it is comparable to PHP from that perspective. Having worked extensively in both, I'd say the general problem with PHP is it's really easy for a beginner to get started, and just easy to grow a small, simple app into a large, functional-but-awful monstrosity. ASP.NET is really just a foundation layer for a whole bunch of different web frameworks including WebAPI, MV…

Perfectly put. Btw, ASPSecurityKit supports MVC/web API/ASP.NET Core/ServiceStack, but not web forms!

More info here: https://aspsecuritykit.net/docs/article/introduction/#suppor...

Re: Rapidly Build SaaS apps on ASP.NET/ServiceStack based on zero-trust security

#24

Post by TriNetra »

sbehlasp wrote: post #23

There are services like AuthZero for authentication/user management, how would you compare ASPSecurityKit with them?

Very pertinent question. with ASPSecurityKit, you get the whole auth/user management stack right as part of your application while with AuthZero, it's offered as a service. Your cost and risk will increase with such SaaS services as your product and number of its users grow while with ASK, the cost remains stable, and without risk of third-party exposure. IMO, user management is so core to any web application that it's not worth it to outsource it if you have a long-term plan for the product.

Additionally, even if you're using an auth service, the automatic data authorization feature that ASK provides through its ADA feature [0] and [1], is something you've to still build in your app, as authorization of input data depends on the domain model of your application and not something generic like user model. ASK can make it automatic because it lets you define convention once (and comes with default conventions based on best practices btw), and takes care of applying them throughout your requests, obviously working with you wherever you need to override something.

0: data authorization in design guide https://aspsecuritykit.net/guides/designing-activity-based-d...

1: data authorization in implementation guide: https://aspsecuritykit.net/docs/article/how-to-perform-activ...

Post reply on HN