Security practices in asp.net core a gray literature review
Introduction: This article is a product of research focused on the adoption of secure development practices in educational settings, developed at Universidad Veracruzana in 2024. Security is crucial in web development to guarantee data protection against unauthorized access; frameworks like ASP.NET Core offer built-in mechanisms, yet the lack of structured models can lead to system exploitation.
Problem: Despite the availability of technical documentation, knowledge gaps persist regarding the effective contexts for these mechanisms, the specific threats they mitigate, and consolidated practical guidelines.
Objective: This study identifies and analyzes ASP.NET Core security mechanisms, application scenarios, associated threats, and best practices.
Methodology: A Gray Literature Review (GLR) was conducted following Garousi’s methodology, analyzing 38 sources from 2022 to 2024 to capture industry practices.
Results: Eight mechanisms and thirteen threats were identified. The review highlights that most vulnerabilities arise from incorrect configurations and improper handling of sensitive data.
Conclusion: These findings provide a foundation for developers to implement secure coding, emphasizing that effectiveness depends on correct configuration rather than just the tools. Originality: This research bridges the gap between documentation and practitioner experience by linking mechanisms to real-world attack vectors and practices.
Limitations: The scope is limited to ASP.NET Core and gray literature, potentially excluding proprietary industry practices.
How to Cite
License
Copyright (c) 2026 Ingeniería Solidaria
This work is licensed under a Creative Commons Attribution 4.0 International License.
Cession of rights and ethical commitment
As the author of the article, I declare that is an original unpublished work exclusively created by me, that it has not been submitted for simultaneous evaluation by another publication and that there is no impediment of any kind for concession of the rights provided for in this contract.
In this sense, I am committed to await the result of the evaluation by the journal Ingeniería Solidaría before considering its submission to another medium; in case the response by that publication is positive, additionally, I am committed to respond for any action involving claims, plagiarism or any other kind of claim that could be made by third parties.
At the same time, as the author or co-author, I declare that I am completely in agreement with the conditions presented in this work and that I cede all patrimonial rights, in other words, regarding reproduction, public communication, distribution, dissemination, transformation, making it available and all forms of exploitation of the work using any medium or procedure, during the term of the legal protection of the work and in every country in the world, to the Universidad Cooperativa de Colombia Press.
[1] I. Schaefer et al., “Software diversity: State of the art and perspectives,” International Journal on Software Tools for Technology Transfer, vol. 14, no. 5, pp. 477–495, Jul. 2012, doi: https://doi.org/10.1007/s10009-012-0253-y. DOI: https://doi.org/10.1007/s10009-012-0253-y
[2] H. Sadia, S. Q. Abbas, and M. Faisal, “A Bayesian network-based software requirement complexity prediction model,” in Intelligent Technologies and Applications. Cham, Switzerland: Springer, 2022, pp. 197–213, doi: https://doi.org/10.1007/978-981-19-3015-7_15. DOI: https://doi.org/10.1007/978-981-19-3015-7_15
[3] M. Haleem, M. F. Farooqui, and M. Faisal, “Tackling requirements uncertainty in software projects: A cognitive approach,” International Journal of Cognitive Computing in Engineering, vol. 2, pp. 180–190, 2021, doi: https://doi.org/10.1016/j.ijcce.2021.10.003. DOI: https://doi.org/10.1016/j.ijcce.2021.10.003
[4] J. C. Najar Pacheco, J. A. Bohada Jaime, and H. C. I. Alemán Novoa, “Vulnerability of information on the Internet of Things,” Revista Ingeniería Solidaria, vol. 18, no. 3, pp. 1–17, Sep. 2022, doi: https://doi.org/10.16925/2357-6014.2022.03.07. DOI: https://doi.org/10.16925/2357-6014.2022.03.07
[5] N. Mohamed, “Artificial intelligence and machine learning in cybersecurity: A deep dive into state-of-the-art techniques and future paradigms,” Knowledge and Information Systems, vol. 67, no. 8, pp. 6969–7055, 2025, doi: https://doi.org/10.1007/s10115-025-02429-y. DOI: https://doi.org/10.1007/s10115-025-02429-y
[6] K. Svensson, D. Axelrod, M. Mohamad, and R. Wohlrab, “Guidelines for supporting software engineers in developing secure web applications,” in Product-Focused Software Process Improvement (PROFES 2024), Lecture Notes in Computer Science, vol. 15452. Cham, Switzerland: Springer, 2024, pp. 123–138, doi: https://doi.org/10.1007/978-3-031-78386-9_9. DOI: https://doi.org/10.1007/978-3-031-78386-9_9
[7] Y. R. Selivorstova, I. V. Liutenko, and S. V. Orekhov, “Frameworks analysis and evaluation used in web application development,” Bulletin of National Technical University “KhPI”. Series: System Analysis, Control and Information Technologies, no. 2, pp. 44–50, Dec. 2020, doi: https://doi.org/10.20998/2079-0023.2020.02.08. DOI: https://doi.org/10.20998/2079-0023.2020.02.08
[8] M. del Pilar Salas-Zárate, G. Alor-Hernández, R. Valencia-García, L. Rodríguez-Mazahua, A. Rodríguez-González, and J. L. López-Cuadrado, “Analyzing best practices on web development frameworks: The Lift approach,” Science of Computer Programming, vol. 102, pp. 1–19, May 2015, doi: https://doi.org/10.1016/j.scico.2014.12.004. DOI: https://doi.org/10.1016/j.scico.2014.12.004
[9] S. Bangani, L. Futcher, and J. van Niekerk, “An approach to teaching secure programming in the .NET environment,” in ICT Education, Communications in Computer and Information Science, vol. 1136. Cham, Switzerland: Springer, 2019, pp. 35–49, doi: https://doi.org/10.1007/978-3-030-35629-3_3. DOI: https://doi.org/10.1007/978-3-030-35629-3_3
[10] A. Alkussayer and W. H. Allen, “The ISDF framework: Integrating security patterns and best practices,” in Advances in Information Security and Its Application (ISA 2009), Communications in Computer and Information Science, vol. 36. Berlin, Germany: Springer, 2009, pp. 17–28, doi: https://doi.org/10.1007/978-3-642-02633-1_3. DOI: https://doi.org/10.1007/978-3-642-02633-1_3
[11] S. A. Slaughter, “Software development practices and software maintenance performance: A field study,” Ph.D. dissertation, (ND), USA, 1996, doi: https://doi.org/10.1287/mnsc.44.4.433.
[12] S. Maheshwari, “Mapping challenges in teaching-learning software testing,” in Proc. IEEE Frontiers in Education Conf. (FIE), Cincinnati, OH, USA, Oct. 2019, pp. 1–9, doi: https://doi.org/10.1109/FIE43999.2019.9028452. DOI: https://doi.org/10.1109/FIE43999.2019.9028452
[13] T. E. Gasiba, U. Lechner, M. Pinto-Albuquerque, and D. Mendez, “Is secure coding education in the industry needed? An investigation through a large-scale survey,” in Proc. 43rd International Conference on Software Engineering: Joint Track on Software Engineering Education and Training (ICSE-JSEET), May 2021, pp. 241–252, doi: https://doi.org/10.1109/ICSE-SEET52601.2021.00034. DOI: https://doi.org/10.1109/ICSE-SEET52601.2021.00034
[14] R. D. Banker, G. B. Davis, and S. A. Slaughter, “Software development practices, software complexity, and software maintenance performance: A field study,” Management Science, vol. 44, no. 4, pp. 433–450, 1998, doi: https://doi.org/10.1287/mnsc.44.4.433. DOI: https://doi.org/10.1287/mnsc.44.4.433
[15] S. S. Alqahtani, “Beyond the code: Analyzing OSS developers’ security awareness and practices,” International Journal of Information Security, vol. 24, no. 3, (ND), 2025, doi: https://doi.org/10.1007/s10207-025-01023-1. DOI: https://doi.org/10.1007/s10207-025-01023-1
[16] R. Fatima, A. Yasin, L. Liu, and J. Wang, “The use of grey literature and Google Scholar in software engineering systematic literature reviews,” in Proc. IEEE 44th Annual Computers, Software, and Applications Conference (COMPSAC), Oct. 2020, pp. 1099–1100, doi: https://doi.org/10.1109/COMPSAC48688.2020.00121. DOI: https://doi.org/10.1109/COMPSAC48688.2020.0-121
[17] V. Garousi, M. Felderer, and M. V. Mäntylä, “Guidelines for including grey literature and conducting multivocal literature reviews in software engineering,” Information and Software Technology, vol. 106, pp. 101–121, 2019, doi: https://doi.org/10.1016/j.infsof.2018.09.006. DOI: https://doi.org/10.1016/j.infsof.2018.09.006
[18] T. Dykstra, “ASP.NET Core security topics,” Microsoft Learn, Nov. 2024. [Online]. Available: https://learn.microsoft.com/en-us/aspnet/core/security/?view=aspnetcore-10.0
[19] J. Popay et al., Guidance on the Conduct of Narrative Synthesis in Systematic Reviews, Version 1.0. ESRC Methods Programme, 2006. [Online]. doi: https://doi.org/10.13140/2.1.1018.4643.
[20] G. Roshan, “Architecting secure web applications: Best practices for software architects,” Medium, Nov. 2024. [Online]. Available: https://medium.com/@gavandiroshan/architecting-secure-web-applications-best-practices-for-software-architects-7639f2445bea
[21] J. Kanjilal, “How to improve API security in ASP.NET Core,” InfoWorld, Aug. 2023. [Online]. Available: https://www.infoworld.com/article/2334732/how-to-improve-api-security-in-asp-net-core.html
[22] L. Rodríguez, “Top 20 ASP.NET security interview questions (+ answers),” Medium, Jun. 2023. [Online]. Available: https://medium.com/bytehide/top-20-asp-net-security-interview-questions-answers-b780ea071a56
[23] T. Kalos, “ASP.NET security best practices,” Escape Blog, Aug. 2024. [Online]. Available: https://escape.tech/blog/asp-dot-net-security/
[24] Ramotion, “What is cross-origin resource sharing (CORS)?,” Oct. 2023. [Online]. Available: https://www.ramotion.com/blog/what-is-cors-in-web-development/
[25] R. Anderson, “Introduction to authorization in ASP.NET Core,” Microsoft Learn, Dec. 2024. [Online]. Available: https://learn.microsoft.com/en-us/aspnet/core/security/authorization/introduction?view=aspnetcore-10.0
[26] P. Jason, “ASP.NET website hosting: Best practices for securing your web applications,” AccuWeb Hosting Blog, Dec. 2024. [Online]. Available: https://www.accuwebhosting.com/blog/asp-net-website-hosting-best-practices-for-secure-your-web-applications/
[27] ByteHide, “ASP.NET security interview questions and answers (2023),” May 2023. [Online]. Available: https://www.bytehide.com/blog/asp-net-security-interview-questions
[28] K. Kara, “Authentication and authorization in ASP.NET Core: A comprehensive guide,” Medium, Dec. 2023. [Online]. Available: https://medium.com/@kerimkkara/authentication-and-authorization-in-asp-net-core-a-comprehensive-guide-2025-84ff96df7264
[29] R. Patel, “A beginner’s guide to ASP.NET Core Identity for authentication and authorization (.NET 8),” Medium, Nov. 2024. [Online]. Available: https://medium.com/@ravipatel.it/a-beginners-guide-to-asp-net-core-identity-for-authentication-and-authorization-with-net-8-e6c-8deb612f4
[30] R. Anderson and K. Larkin, “Safe storage of app secrets in development in ASP.NET Core,” Microsoft Learn, Nov. 2024. [Online]. Available: https://learn.microsoft.com/en-us/aspnet/core/security/app-secrets?view=aspnetcore-10.0&tabs=windows
[31] F. Hasan and R. Anderson, “Prevent cross-site request forgery (XSRF/CSRF) attacks in ASP.NET Core,” Microsoft Learn, Oct. 2024. [Online]. Available: https://learn.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-10.0
[32] A. Kumar, “Avoiding cross-site scripting (XSS) attacks in C# and .NET Core,” C# Corner, Apr. 2024. [Online]. Available: https://www.c-sharpcorner.com/article/avoiding-cross-site-scripting-xss-attacks-in-c-sharp-and-net-core/
[33] S. Kataria, “Securing your financial data with ASP.NET Core solutions,” QServices, Nov. 2024. [Online]. Available: https://www.qservicesit.com/securing-your-financial-data-with-asp-net-core-solutions
[34] D. Rathod, “Complete guide to content security policy (CSP) in ASP.NET,” Atharva System, Nov. 2024. [Online]. Available: https://www.atharvasystem.com/the-complete-guide-to-content-security-policy-csp-in-asp-net/
[35] K. E. (ND), “10 best practices to secure ASP.NET Core MVC web applications,” Syncfusion Blog, Dec. 2024. [Online]. Available: https://www.syncfusion.com/blogs/post/10-practices-secure-asp-net-core-mvc-app
[36] A. Mohanty, “Web API security in .NET Core,” C# Corner, Oct. 2023. [Online]. Available: https://www.c-sharpcorner.com/article/web-api-security-in-net-core/
[37] Sanjay, “Broken access control in ASP.NET Core: OWASP Top 10,” Pro Code Guide, Oct. 2023. [Online]. Available: https://procodeguide.com/programming/broken-access-control-in-aspnet-core/
[38] S. X. (ND), “Creating fast and secure web API projects in .NET,” Softacom, Jun. 2024. [Online]. Available: https://www.softacom.com/blog/development/creating-fast-and-secure-web-api-project-in-net/
[39] D. M. Edirisinghe, “JWT authentication: Basics and best practices,” Medium, Feb. 2023. [Online]. Available: https://medium.com/@darshana-edirisinghe/jwt-security-concerns-f79e63ff4871
[40] P. Mehta, “Authentication and authorization in .NET Core,” Positiwise, Jul. 2024. [Online]. Available: https://positiwise.com/blog/authentication-and-authorization-in-net-core
[41] Riza (ND), “Best practices to secure your .NET Core application,” Codementor, Oct. 2024. [Online]. Available: https://www.codementor.io/@riza/best-practices-to-secure-your-net-core-application-2l0aue30mj
[42] J. Panchal, “Secure your APIs with .NET Core: Authentication and authorization,” Innovura Technologies, May 2024. [Online]. Available: https://innovuratech.com/implementing-authentication-and-authorization-in-net-core-apis/
[43] I. Baciu, “Building secure .NET applications,” Infobest Software Outsourcing Company, Aug. 2024. [Online]. Available: https://www.infobest.ro/building-secure-net-applications/
[44] S. Getachew, “Implementing role-based authorization in ASP.NET Core 8 Web API: Best practices for secure and scalable APIs,” Medium, Nov. 2024. [Online]. Available: https://medium.com/@solomongetachew112/implementing-role-based-authorization-in-asp-netc259f919fb5d
[45] M. Baldwin and T. Lanfear, “Best practices for protecting secrets,” Microsoft Learn, Aug. 2024. [Online]. Available: https://learn.microsoft.com/en-us/azure/security/fundamentals/secrets-best-practices
[46] Programmers.io Team, “Best practices for building secure web applications with ASP.NET Core,” Programmers.io, Dec. 2024. [Online]. Available: https://programmers.io/blog/building-web-application-with-asp-net-core/
[47] Peruzzi Services Limited, “How to deal with sensitive data in .NET,” May 2024. [Online]. Available: https://www.linkedin.com/pulse/how-deal-sensitive-data-net-peruzziservices-sqwtf/
[48] N. S. Filho, “Implementation and challenges of CORS in web applications developed with C#: A technical and practical analysis,” Leaders Tec, 2024. [Online]. Available: https://leaders.tec.br/article/26e6c8
[49] D. Galvan and R. Anderson, “Enforce HTTPS in ASP.NET Core,” Microsoft Learn, Oct. 2024. [Online]. Available: https://learn.microsoft.com/en-us/aspnet/core/security/enforcing-ssl?view=aspnetcore-10.0&tabs=visual-studio%2Clinux-sles
[50] R. Anderson, “Prevent cross-site scripting (XSS) in ASP.NET Core,” Microsoft Learn, Sep. 2024. [Online]. Available: https://learn.microsoft.com/en-us/aspnet/core/security/cross-site-scripting?view=aspnetcore-10.0
[51] A. Aborujilah, J. Adamu, S. M. Shariff, and Z. A. Long, “Descriptive analysis of built-in security features in web development frameworks,” in Proc. 16th International Conference on Ubiquitous Information Management and Communication (IMCOM), 2022, pp. 1–8, doi: https://doi.org/10.1109/IMCOM53663.2022.9721750. DOI: https://doi.org/10.1109/IMCOM53663.2022.9721750
