Niels Tanis -- A Slice of the Razor with ASP.Net Core

0:00Chris RomeoHey folks, season 4, episode 7 of the AppSec Podcast. On this episode, I'm joined by Niels Tannes, and we talk about a slice of the Razor with ASP.NET Core. We talk all things web applications in a Microsoft or .NET C# world, and Niels explains some of the intricacies of Razor Pages, which is a relatively new technology in the world of C# and .NET. Please enjoy.

0:28Robert HurlbutThe Application Security Podcast. Here we go.

1:00Chris RomeoHey folks, we are once again at AppSecEU and we happen to be looking over at Westminster Chapel, I think? Westminster Abbey? Something like that. I don't know. A long line of people not here for the security conference but here to apparently see Westminster Abbey.

1:16Robert HurlbutI'm joined today by Niels Tannes and we are going to talk about ASP.NET Core. That's right.

1:22Chris RomeoCore in general and many different things in that area.

1:25Robert HurlbutBut Niels, first we always like to ask, what is your security origin story? How did you get into the world of security?

1:31Niels TanisSo when I started out my career, I was infected with the OPSEC virus by doing my bachelor thesis at a company, and then I moved on to the development space but still kept an eye on security. And then after 10, 12 years doing .NET development I got the ability to move into the security space full-time, uh, did some ethical hacking, pentesting, more like AppSec consultancy after that. And right now I'm part of CA Veracode and I'm doing research for our static engine. So it's like combining all those things into one job, which is pretty awesome to do, like developing but also still keeping an eye on everything that's tied to security.

2:12Robert HurlbutSo yeah, that's the first time I've heard someone say that they were infected with the AppSec virus.

2:17Niels TanisThat's usually how we call it.

2:20Chris RomeoI get it.

2:20Robert HurlbutI know what you mean, but infected with the AppSec virus. So your development background was in the C# world? Yeah.

2:27Niels TanisSo I started out with the first versions of the Framework 1.0. I think it's 2002 or something that it was released.

2:33Robert HurlbutOkay.

2:33Niels TanisAnd I always was working in that space for quite some time. And I really enjoyed the way that this tech has evolved over time. If you would compare, let's say, the Microsoft company, how it is right now and how they deal with IDEs and development tools in general, and what they've done recently with the stuff like acquiring companies like GitHub and so on. I think they're on a pretty good track compared to what it was, how it started out doing web forms like a big black box framework. You just use it, a lot of bad stuff happening. And if you compare it to right now, let's say with ASP.NET Core, it's all open, it's pretty transparent what's happening. Of course, there's always a programmer that will write software that's might end up being vulnerable to something, right? That still is something that will remain. But no, I think it's like really matured. And if you compare, let's say, even Microsoft a couple of years ago and how it is right now and how they are like doing stuff for developers, yeah, it's pretty good. So, and C# has always been the main language, done a lot of web development, more like say backend services, WCF, I've done the whole stack from back to front.

3:44Robert HurlbutOkay, so yeah, so front-end, back-end of C#. So what are you talking about here then at AppSecEU?

3:51Niels TanisSo with ASP.NET Core, they introduced a multi-platform targeting framework which you can use to— if you ask them like, why should I use it? It's mostly focused on doing microservices and running everywhere, right? So that's the whole thing.

4:07Robert HurlbutSo it's taking .NET and bringing it back into a microservices architecture?

4:13Niels TanisNo, it's more like being able to target different platforms, like running it on Linux or Mac OS X, or of course Windows. And, and, and it's modular-based, and that's also a big difference compared to, let's say, the full framework, which you needed to install fully in order to use it. And with this, it's just composing your app based on packages that are on NuGet, right, on the repository of all the third-party components. Just pull them in and build your project and you will have an app running.

4:41Robert HurlbutSo instead of the classic way where I get the mono— I'll call it monolithic.

4:45Niels TanisYeah, that's probably not the right definition.

4:47Robert HurlbutThe monolithic full framework, I got to get all the pieces and have it installed as a runtime or whatever. In this type of environment, you just pick and choose what you need, so it's minimized install. Doesn't—

4:59Niels TanisYeah, you can also do a lot of optimizations how you deploy, but I think the most powerful part is that it composes itself. You have dependencies, you will get it, and you will just use it. And that also gives you the ability to— let's say that the release cycle has been pretty heavy for ASP.NET Core, especially for vendors to keep up with that kind of frameworks and supporting it.

5:21Chris RomeoYeah.

5:21Niels TanisIt's like going in a quick pace, major release every year, minor release twice a year even, I think, with Core. So yeah, it gives a lot more flexibility, and that also changes, of course, the game, how you need to develop software in general, right? And the fact that it's rewritten from scratch— so ASP.NET Core MVC has got some relation with MVC in the full framework, and it's using Razor, but there's also stuff that's completely different and APIs that are different and will behave differently if a developer uses them. And yeah, there are some glitches that developers need to be aware of on how to deal with that, right?

5:57Robert HurlbutYeah, so let's kind of circle back here, and I told you before we started here, I'm not an in-depth C# .NET person. So I understand, and I think most of our listeners will understand .NET as a conceptual idea of a framework here, but give us a little bit more detail on ASP.NET Core in general. What are we talking about when you're specifically using those terms?

6:21Niels TanisWhat do they mean? So ASP.NET is mostly the, the web-based framework to expose, let's say, an HTTP, HTTPS endpoint that will allow you to expose API services that will render either, let's say, web pages, and it's then using Razor Views or Razor Pages, for example, from ASP.NET Core 2.0, and microservices that render, let's say, JSON structures or maybe even XML, if that's the thing that you're working with. And all that, APIs, right? So that's more like the microservices.

6:53Robert HurlbutSo that all comes from ASP.NET?

6:55Niels TanisYeah.

6:56Robert HurlbutSo when you say Core in general, are these 2 different things?

6:59Niels TanisAnd you've got .NET Core as the basis framework, so that's the framework itself. And on top of that, you run ASP.NET Core MVC in order to expose the whole MVC pattern, like the controllers, the view, like the basic—

7:14Robert HurlbutOkay, Model-View-Controller, standard architecture stuff. So ASP.NET Core, and then ASP.NET General sits on top of that?

7:21Niels TanisAnd ASP.NET, like, what do you mean with ASP.NET General? Like, for Core, that's, that's, that's the stack, and that's the way how you use it. So I'm not sure what you mean.

7:31Robert HurlbutOkay, okay. So there is—

7:32Niels Tanisokay, all right.

7:33Robert HurlbutSo ASP.NET Core is the stack, the pieces that I use for my web. It provides my web app framework.

7:38Niels TanisYeah, exactly. So it allows you to create either services or expose some HTML and more richer content from that. Okay.

7:46Robert HurlbutAnd so there, you know, we know that writing secure software in any language is difficult.

7:53Chris RomeoYeah.

7:54Robert HurlbutWhat are some of the challenges?

7:55Chris RomeoI mean, does ASP.NET provide any—

7:57Robert Hurlbutis there any different challenges that ASP.NET provides from— I'm much more familiar with Java, the world of Java. So, but I'm wondering, is there You know, you got to be considered with cross-site scripting.

8:11Niels TanisYeah.

8:11Robert HurlbutSQL injection.

8:12Niels TanisYeah.

8:13Robert HurlbutXXE for XML, you know, XML injection. Serialization is not a— from what I remember, what I understand, serialization is not as big of a problem.

8:23Niels TanisThere are some subtleties that you need to be aware of. I think to maybe jump on that story, I think also attack surface and what's being exposed is one of the major attention points. if we compare ASP.NET Core MVC with the full framework.

8:37Robert HurlbutOkay.

8:38Niels TanisSo, in an MVC, in a normal MVC pattern, the controller will be the thing that gets instantiated once a user wants to request, let's say, data or has a form, web form, it fills in data and it posts it back. With ASP.NET Core, that's convention-based resolved, meaning that anything that ends up with word controller will be found by the framework once it hooks up a web host endpoint. So there's a Kestrel web server internally that will start out, that will have the MVC pipeline configured. You can do a lot, it's all open, you can all replace it, it's pretty cool. But the controllers will be resolved based on name. And one downside it has, being convention-based, any third-party library that will be referenced by the main project will be exposed if there is something inside which is called controller. And that's one downside, like developers need to be aware of the fact that if they take any third-party library from the internet, of course we need to build on top of open source and frameworks that help us out being more productive.

9:40Robert HurlbutYeah.

9:41Niels TanisBut you also rely on them doing a good job. And most of the time, like, open source projects are done by people in their spare time. Let's say there are 5 of them that do such thing, for example. You need to keep up with security components or software that's being breached. We have seen a couple of examples lately about a big software like Gentoo Linux that was recently, of course, that got hacked by just a simple password on Git, right? So how can you as a developer— you need to be sure as a developer that if you pull in third-party libraries that there's a risk tied to that. And by doing that convention-based resolving you open up a door. So if somebody has bad intentions, he can put in a controller somewhere in the back. You don't even notice if you just use it because it's convention-based and maybe open up a backdoor, right? And that's of course maybe a bit paranoid, but I think it's good that a developer needs to be aware that that happens internally.

10:33Robert HurlbutYeah.

10:33Niels TanisAnd the same counts for Razor Pages, which is like one of the newest additions to the family.

10:37Robert HurlbutTell me what that is real quick.

10:39Niels TanisRazor Pages?

10:40Robert HurlbutRazor Pages.

10:41Niels TanisSo most of the people that have done .NET development in the past know Web Forms. which is like the point-and-click and what you see is what you get. You drop buttons on it and click on it and you can write your code. Razor Pages is something that's been written on top of MVC, so it runs in the same pipeline, but it has an MVVM pattern tied to it, meaning that there's a view model that has a single purpose that will execute something, and there's also some convention-based stuff happening.

11:09Robert HurlbutOkay.

11:09Niels TanisThe nice thing is that it really covers a lot of the downsides if we're going to talk about request forgery. Like Razor Pages will have default tokens and a double submit synchronizer inside of it with a cookie.

11:22Robert HurlbutIt's all by default.

11:23Niels TanisIt's all by default. Developers don't need to do anything for that, which is good compared to MVC where you need to make sure that the tokens are being turned on. They're being rendered, but the controller hasn't got that turned on by default.

11:36Robert HurlbutTo check the token.

11:37Niels TanisTo check the token.

11:38Robert HurlbutOkay.

11:38Niels TanisSo, and that's, that's another glitch compared to what Core does better than MVC in total.

11:44Chris RomeoAfter the break, we'll explore Razor Pages. Is it a better way of doing web forms and receiving information from a user? The Application Security Podcast operates with support from Security Journey. A security belt program provides the 3 pillars of successful AppSec training, learning, application, and experience. Visit us on the web at www.securityjourney.com to learn how you can teach and empower your developers using a new kind of security training. Now let's hear from Niels again about Razor Pages and are they really a better way of doing Web Forms and security in an ASP.NET context?

12:29Niels TanisI think that the power of it is that it really takes away a bit of the complexity that you need to deal with from MVC, because a controller can render multiple views. You don't know which view will be rendered.

12:40Robert HurlbutOkay.

12:41Niels TanisAnd a single Razor Page has got one purpose, and but it's still interchangeable, so they can both coexist. So it's easy to ramp up with Razor Pages, and then if you need to do more advanced, just replace it with the others and move on. So I think that's a pretty powerful pattern that they introduced over there. As I said, Razor Pages are pretty like configuring the pipeline in the best way possible from security perspective. So request forgery is turned on for MVC controllers in Core. As I said, the views render them, but the attribute needs to be annotated. If people are familiar with Visual Studio, there's a lot of scaffolding you can do based on a data structure. I want to expose data.

13:19Chris RomeoYep.

13:22Niels TanisAnd the thing that it renders by default is pretty good, but, and it will inject the validate forgery token for you on top of the method, which is like an annotation, right? If this method gets executed, make sure you validate the request forgery token before continuing. That's all good. And there's also a filter you can turn it on by default. But there was some struggles, I believe, with the fact that controllers can be used for APIs, pure APIs, like non-web-based, let's say, HTML.

13:47Chris RomeoYeah.

13:48Niels Tanisexposed APIs and MVC. So that's the reason why they couldn't turn it on by default, is what I've heard from, from people from Microsoft. With the latest version of Core, which is 2.1— they're going at such a quick pace— they introduced an attribute that you can use to annotate an API controller, which makes it even easier to distinct it from a normal controller. And I think that opens up the door door for people to have nice base class libraries for their own applications.

14:16Robert HurlbutSo you're talking about baseline security libraries?

14:20Niels TanisYeah, if you do development at a big scale in a company, I would assume that— I would make sure that if I do ASP.NET Core development, I would have my own base template, which I would expect every development team to use from. Like, if you would deal with it from an AppSec perspective, and that's like the base that everybody will use. And you can turn this on by default.

14:41Robert HurlbutYeah, because you hear the stories of big companies where they have lots of different microservices that make up some type of an API.

14:50Niels TanisYeah.

14:51Robert HurlbutAnd one of them has authentication and the next one next to it doesn't. One has authorization but no audit or authentication. And so they're not using any type of standardization across the board.

15:01Niels TanisNo.

15:01Robert HurlbutSo it sounds like you're kind of— Your perspective is there should be a standardized approach to what security services are implemented there.

15:10Niels TanisYeah, and I think the same, that will also allow you to easily check if somebody takes a sidestep, and maybe that's needed, right? So I think the best thing that I like about ASP.NET Core compared to the full framework ASP.NET is that the defaults are pretty good, and if somebody wants to do a bad thing, then the API will explicitly mention to you that you're doing stuff that might be a bit smelly at that point.

15:32Robert HurlbutOkay.

15:32Niels TanisBut it still can be a decision because it's needed. Let's say that if we move to cross-site scripting and how that's being solved. So Razor itself is the view engine that's responsible for both rendering the views for MVC, and it also renders the Razor Pages. It's similar syntax. The nice thing about that, it will do HTML or it will do context specific encoding for the thing it needs at that point, right? There's a lot of tech helpers that will render, let's say, button input things.

16:04Robert HurlbutAnd that's coming from Razor?

16:06Niels TanisYes, that's coming from the Razor.

16:07Robert HurlbutSo I don't have to make a call— I'm gonna— okay, maybe I do know something about it. So anti-XSS, so I don't have to do that with Razor Pages. It all happens automatically.

16:16Niels TanisAnd if you want to do— let's say if you still have a piece of rich text, let's say HTML, you want to render at some point, and you've done all the things you need to do, make sure it's safe, you know the origin, maybe you validate the structure and you say like, this is something I want to not be re-encoded because that's the whole problem, you will mark it with HTML raw in the view. And it will then be wrapped inside of a marker class that's called HTML string. And the engine will then see like, hey, this is something I won't touch, I won't re-encode. And in my opinion, that should be a code smell. Like, if somebody does it, then there should be some thorough review, like, hey, where does the data originate from? Like, why are we doing this for that reason?

16:56Robert HurlbutMake sure you got all the right checks happening in advance of that being exposed.

17:00Niels TanisExactly. So I think that's pretty, pretty, pretty powerful. And there's not much of a difference for MVC and the full framework because Razor does exactly the same. The namespaces and the type of classes are a bit different. But by default, the encoders are pretty good. Like, the anti-cross-site scripting one was moved to the framework itself, and the one for ASP.NET Core is derived from anti-cross-site scripting and is now part of that whole pipeline.

17:26Robert HurlbutAnd they just automatically— they automatically use it though? The Razor Pages don't let you— so you have to basically turn it off if you don't want it?

17:35Chris RomeoExactly.

17:35Niels TanisAnd the nice thing also, because still you would like to give developers freedom to choose something else if needed. So the whole ASP.NET Core pipeline has got its own native dependency injection inside of it. You can still override the HTML encoder with something else or make it less strict, because what it does right now, if you're, let's say, using it to render a page with Russian text or Chinese characters, it will double— it will also encode those. And maybe for performance reasons, you don't want to do that, right? So at the other end, like, if you're doing high performance, let's say web browsers on machines usually are pretty quick, but still you might want to smoothen it out. You can still decide to, let's say, exclude that Russian code page from being encoded by default because you're like, this is safe, I know what I'm doing. And that also is a good sign of the defaults are good. If you want to do something else, yeah, you can do it, but it's explicitly done in the API by doing a specific call, which makes it easier to check from a static analysis perspective, right? And also, yeah, you can mark it off. And as I said, if you then take the whole— I've got a basic template, I maybe create my own tools. Like, the thing I'm going to talk about is also you can leverage the compiler, which is called Roslyn, Microsoft Compiler Infrastructure. You can easily do some basic checks and And I always say, like, why? Like, if you do secure development as a whole, you will have a whole lifecycle that includes more tools, that includes maybe pentesting at some point in that stage. If you're doing DevOps more continuously, like, that's a whole different story, but tools will be used. There are different vendors for that, of course. But you can still also write your small tools yourself by saying, like, hey, if I have this controller method that does a POST, I want to make sure that the entire— that the validateForgeToken attribute is being set on that method if it's a POST. It's not really 3 lines of code, that's what I wanted to say, but it's a bit more, but it's easily— you can do it. So in my talk, I'm also having— I'm showing a demo app and I've created some small tools that will be included with that demo app.

19:43Robert HurlbutOkay.

19:43Niels TanisAnd you can see it. And I think that's like, we need to make sure that we automate in the best way possible, take small steps in order to give feedback as quick as possible to the developer.

19:52Robert HurlbutAnd so what are the tools— what's the tool called?

19:55Niels TanisSo right now it's just part of my code examples, but in the near future I'm hoping to publish a tool on NuGet that you can use. And the nice thing is that .NET Core 2.1 has changed the way that the CLI works, and you can now get CLI tools from NuGet. That opens up the door for lot of automation. So then I would give away a bit of a teaser, like keep an eye on my Twitter and I will at some point publish a component. I'm working on it, so there's some things that I need to take care of before I can do that.

20:24Chris RomeoYeah.

20:24Robert HurlbutAnd so I feel like with Razor we talked about token synchronization, we talked about cross-site scripting and the overall encoding process that was going to happen there. How does Razor do— does Razor Provide any native input validation?

20:40Niels TanisSo good that you point that one out. So if you use MVC and if you have a complex type that at some point— let's say you're going to do the scaffolding story we talked about earlier. I've got a data structure that I want to have CRUD functionality on, and I want to have create, read, update, and delete on that. That can be generated by Visual Studio for you, you can write it yourself depending on what you want. Those usually involve class structures that will then be bound to fields on a view.

21:12Robert HurlbutOkay.

21:12Niels TanisAnd there's a concept called model binding in the whole pipeline, which is helping you out on— once the user provides data to the system that needs to be processed, to map that data to a data structure before it's stored. And in that model binding, you can do data annotations in order to validate that, right? So, that's like first step for web app security, in my opinion. So, make sure that the data is properly sanitized and validated before you do anything with it, right?

21:39Robert HurlbutYep.

21:39Niels TanisBut the model binder helps out in the whole MVC story to process the data and make it available inside the controller. And there's a piece called model— the model binder has something called model state.

21:55Robert Hurlbutstate.

21:55Niels TanisAnd that's something you always need to explicitly check before you continue. As far as I'm aware, for both Razor Pages and Razor Views, or Razor Controllers that end up processing data, you always need to do that call explicitly. Model state needs to be checked. And that helps out the view to do that string length validation or say, like, this is a postal code or email address that that's been put in. Then the controller will get that data, and then it will do exactly the same. And there's just one data annotation done. So it's pretty— I think it's pretty powerful if you use it in that. There's one other risk tied to that. So if you scaffold based on Entity Framework context that will store data inside a database, you will get edit pages that will have Entity Framework fields on it. Let's say there is a field that you don't want to have edited, right? There's always the risk of over-posting or mass assignment. That's what they call it. And it's even that prevalent, let's say, for Razor Pages. It's got a lot of binding happening by default. I believe Scott Hanselman from Microsoft published a blog post 2 months ago which he said, like, be aware that mass assignment can still be a big issue. It's nice to scaffold code and take it as it is, but you always need to be aware that data needs to be validated, as you already mentioned. And you only want to have the user being able to edit the stuff that really matters. And in my talk, I got an example. You've got order as a data structure, and there's order details tied to it. But there's also a decimal field called total price. And if you just scaffold it by default, that will be exposed. You might not have the UI being rendered, because you removed it, but that field will still be mapped by the model binder. It will still, once the data is supplied, it will be put in.

23:44Robert HurlbutSo a tester could find it by interacting directly with the service, even though it's not in the UI.

23:49Niels TanisNo, and you might not guess, like, okay, that's of course a little bit of guessing, like what type of things are available. The usually mass assignment overpost example you will see is the is_admin flag in a user account that has been And create it, right? That gives somebody more power, and that's the whole story.

24:05Robert HurlbutAnd it's an easier one to check, to have an automated tool that just scans and checks for that.

24:09Niels TanisYeah, so I'm a big fan of doing that scaffolding, but I would advise people, if you don't— like, don't use your data model exposed directly unless it's some closed system administration of that data structure. If it's publicly facing, then make view models that fit the purpose for that data have all the data annotations in that will validate that data, and then map it against the internal data structure before it processes. You want to have that separation of concerns in that world. So that depends a bit on what you want. And Razor Pages, because it's convention-based, it's pretty point-and-click and generation-heavy, it has the risk of introducing those kinds of things, like having a page that's exposing more internally without knowing it.

24:53Robert HurlbutSo is there any reason I haven't heard a reason yet to not use this. But there's always something.

25:00Niels TanisThe nice thing, ASP.NET Core MVC even runs on the full framework because of something called .NET Standard that they created. They want to have intersection between the 2 frameworks. And at some point in the future, my expectations would be like those 2 frameworks will not coexist, but that will be one version for all.

25:16Robert HurlbutOh, okay.

25:17Niels TanisI think Core will be the end station for everything. Is there a reason for not using it? No, I would say no, to be honest. And I can even see that there might be, let's say, companies that are pretty conservative about the technology that they use, that might still are doing their stuff on the framework itself. If you see the quick pace and the quick way that .NET Core also adapts to standards, let's say same-site cookies is a nice example.

25:43Chris RomeoMm-hmm.

25:44Niels TanisThey have introduced it a couple of months after it was was, let's say, done in the browsers. Not every browser supports it, but it's a nice mitigating control for a lot of factors. And they just put it in because they are able to release every 6 months. And I think that even makes it a bigger plus for me to say, like, please move to ASP.NET Core and have that. Because the last release of the framework, the full framework, I think it's 4.7.2, also included SameSite. So it's really—

26:11Chris RomeoYeah.

26:11Niels TanisAnd those are the small bits and pieces, like a really minor release. So yeah, I think if you look at Microsoft, that's the shift, and that's probably what's going to happen. There's no reason to start out developing on the full framework anymore. That's my story.

26:23Robert HurlbutSo where would you recommend somebody who is new to .NET and web app development? And you've shared a number of very cool things. that sound like great things people should be doing.

26:40Chris RomeoWhere's—

26:41Robert Hurlbutis there a good place? Does Microsoft have anything where people can start?

26:44Niels Tanisdocs.microsoft.com has been like really ramping up over the last year with pretty good documentation on almost everything I talked about. So how it deals with cross-site scripting, there are some definitely some good articles on, say, let's even look at crypto cryptography and how that's implemented internally done. So I think that should be the first stop. The mass assignment is being covered in an article. It's all like literally found there. And yeah, it's good, definitely.

27:15Robert HurlbutSo docs.microsoft.com is the place to go to dive into these issues in more detail. And just like normal, I'm assuming they'll have different levels of— they'll have some beginner stuff and Yeah, and things that get more technical as you start to figure them out more.

27:31Niels TanisYes, and definitely like Channel 9, the whole like video community of Microsoft. If you go to, let's say, one of the last conferences, there's always a good story that you can start out watching that will have some basics and then explain it to you, right?

27:47Robert HurlbutWell, Niels, thanks for taking the time to explain this to us.

27:50Niels TanisThanks, Chris, for having me. Yeah, we appreciate it.

27:53Robert HurlbutOur listeners will get something from about .NET, and I know there's a lot more .NET people out there than we realize. Between Java and .NET, it seems like that's what everybody's doing. It's one or the other at this point with a fancy front-end framework attached to it. So yeah, thank you very much. Have a great day.

28:10Niels TanisThanks, Chris, for your time.

28:12Chris RomeoThanks for listening to the Application Security Podcast. If you enjoy the podcast, please do us a favor and visit the iTunes Store and give us a 5-star rating. Our intro music is 8-Bit Kung Fu by Born and TJ, and the outro is Southern Delight by Stefan Cartenberg. You can find us on Twitter @AppSecPodcast or on the web at www.appsecpodcast.org.