WEBVTT

00:00:00.952 --> 00:00:03.523
As an ASP.NET developer, you're already

00:00:03.523 --> 00:00:07.094
familiar with this model. The ASP.NET

00:00:07.094 --> 00:00:10.809
application runs on a server, which sends

00:00:10.809 --> 00:00:13.752
things down to the browser, things the

00:00:13.752 --> 00:00:16.952
browser can interpret like HTML, CSS,

00:00:16.952 --> 00:00:20.452
JavaScript, and cookies. But here's a

00:00:20.452 --> 00:00:22.618
problem. As developers, we don't have

00:00:22.618 --> 00:00:25.952
control over what happens with this data

00:00:25.952 --> 00:00:29.827
after we send it. We tend to think only

00:00:29.827 --> 00:00:32.552
about the application that runs on the

00:00:32.552 --> 00:00:35.380
server. Once everything is sent, we're

00:00:35.380 --> 00:00:38.452
assuming everything will be all right. But

00:00:38.452 --> 00:00:41.452
browsers are flexible, everything can be

00:00:41.452 --> 00:00:45.151
changed, HTML, CSS, JavaScript, cookies,

00:00:45.151 --> 00:00:48.174
everything. What might be worse, the

00:00:48.174 --> 00:00:50.285
browser is very permissive. This sound

00:00:50.285 --> 00:00:53.174
like a good thing, but because of that it

00:00:53.174 --> 00:00:56.452
can be easily exploited. Here are some

00:00:56.452 --> 00:00:59.952
examples. It is not restricted to get

00:00:59.952 --> 00:01:03.077
JavaScript from other servers while a page

00:01:03.077 --> 00:01:05.315
of your application is loaded. You could

00:01:05.315 --> 00:01:06.952
say this is more a feature than a bug

00:01:06.952 --> 00:01:11.252
because we've always made use of that. For

00:01:11.252 --> 00:01:13.351
example, when we load the CSS or

00:01:13.351 --> 00:01:15.952
JavaScript file from an internal or

00:01:15.952 --> 00:01:18.618
external CDN. But this feature can be

00:01:18.618 --> 00:01:20.952
exploited to load malicious JavaScript

00:01:20.952 --> 00:01:24.809
from a foreign site, for example. Pages in

00:01:24.809 --> 00:01:27.702
your application are also allowed to be

00:01:27.702 --> 00:01:30.752
shown everywhere, even in an iframe of a

00:01:30.752 --> 00:01:33.151
totally different application. That allows

00:01:33.151 --> 00:01:36.285
for clickjacking attacks. Anywhere in an

00:01:36.285 --> 00:01:39.327
HTML page, JavaScript can be executed as

00:01:39.327 --> 00:01:42.752
long as it is between script tags. This

00:01:42.752 --> 00:01:46.702
allows for JavaScript injection. And, all

00:01:46.702 --> 00:01:48.952
features of the browser like geolocation

00:01:48.952 --> 00:01:52.588
and local storage are available to all web

00:01:52.588 --> 00:01:55.552
pages by default. To mitigate these and

00:01:55.552 --> 00:01:57.952
other attacks explained in this course,

00:01:57.952 --> 00:02:00.452
the browser already has built-in

00:02:00.452 --> 00:02:02.952
protection that can help out. That's the

00:02:02.952 --> 00:02:05.507
good news. The bad news is that most of

00:02:05.507 --> 00:02:08.452
the time these browser features are turned

00:02:08.452 --> 00:02:12.352
off by default. We can turn them on by

00:02:12.352 --> 00:02:15.827
sending an HTTP header along with a

00:02:15.827 --> 00:02:18.327
response our ASP.NET application

00:02:18.327 --> 00:02:21.497
generates. An HTTP header is a line of

00:02:21.497 --> 00:02:25.174
text containing a key and a value that is

00:02:25.174 --> 00:02:27.952
attached to the response. Let's switch to

00:02:27.952 --> 00:02:30.552
the demo application we're using in the

00:02:30.552 --> 00:02:34.452
course. It's a customer loyalty site for a

00:02:34.452 --> 00:02:37.094
coffeeshop. A customer can gather points

00:02:37.094 --> 00:02:39.285
with purchases and then enter their

00:02:39.285 --> 00:02:42.077
loyalty number on the site and see the

00:02:42.077 --> 00:02:44.618
progress towards a free coffee. When I

00:02:44.618 --> 00:02:47.452
open the F12 tools of the browser, on the

00:02:47.452 --> 00:02:49.452
Network tab are all the requests through

00:02:49.452 --> 00:02:52.751
the server that were done. One of them is

00:02:52.751 --> 00:02:54.452
to an action in the controller called

00:02:54.452 --> 00:02:56.588
LoyaltyOverview. When I click on it and

00:02:56.588 --> 00:02:59.452
the select the Headers tab, observer the

00:02:59.452 --> 00:03:01.702
Response Headers. There's a Content-Type

00:03:01.702 --> 00:03:04.951
header that tells the browser what type of

00:03:04.951 --> 00:03:08.452
content response is. This is expressed in

00:03:08.452 --> 00:03:11.770
a so-called MIME type. In this case, it's

00:03:11.770 --> 00:03:14.952
HTML, which has the MIME type text/html.

00:03:14.952 --> 00:03:18.702
There's also a Date, Server, and

00:03:18.702 --> 00:03:21.152
Transfer-Encoding header. Sometimes HTTP

00:03:21.152 --> 00:03:24.751
headers just contain some metadata about

00:03:24.751 --> 00:03:27.666
the response, but we can also instruct the

00:03:27.666 --> 00:03:31.285
browser to turn one of its built-in

00:03:31.285 --> 00:03:33.952
security mechanisms on by using a header.

00:03:33.952 --> 00:03:37.452
So we have to modify our ASP.NET

00:03:37.452 --> 00:03:40.452
application to add headers to the

00:03:40.452 --> 00:03:48.952
response. Let's see how to do that in the

00:03:48.952 --> 00:03:50.952
next clip.
