4 min read
Security Fundamentals
Prerequisites: Performance optimization & profiling
- Let EF Core parameterize queries (as shown earlier) rather than building SQL by string concatenation.
- Never log or hard-code secrets — read them from environment
variables,
appsettings.json(excluded from source control for real secrets), or a secrets manager. - Validate external input — ASP.NET Core's model binding plus
data annotation attributes (
[Required],[Range]) catch a large share of this automatically. - Hash passwords with
ASP.NET Core Identity's built-in password hasher (itself backed by a purpose-built algorithm) — never store them in plain text.
Common mistakes
- Rolling a custom authentication scheme instead of using ASP.NET Core Identity or a well-audited third-party library — exactly the same advice as Java's Security Fundamentals lesson, for exactly the same reason.