Understanding best practices to secure client and server applications
There are several best practices that are recommended to secure your web application. The .NET Core and Azure services make it easy to ensure their adoption. The following are key ones you could consider:
- Enforce HTTPS for web applications. Use
UseHttpsRedirectionmiddleware to redirect requests from HTTP to HTTPS. - Use modern authentication frameworks based on OAuth 2.0 and OIDC to secure your web or API app.
- If you are using the Microsoft identity platform, use open source libraries such as MSAL.js and MSAL.NET to acquire or renew tokens.
- Configure strong password requirements and lock your account in the case of continuous failed login attempts—for example, five consecutive failed attempts. This can prevent a brute-force attack.
- Enable MFA for privileged accounts such as back-office admin, back-office staff accounts, and more.
- Configure session timeouts, invalidate your session...
