Prácticas de seguridad en asp.net core una revisión de la literatura gris
Introducción: Este artículo es producto de la investigación centrada en la adopción de prácticas de desarrollo seguro en entornos educativos, desarrollada en la Universidad Veracruzana en el año 2024. La seguridad es crucial en el desarrollo web para proteger los datos; marcos como ASP.NET Core ofrecen mecanismos integrados, pero la falta de modelos estructurados puede derivar en la explotación del sistema.
Problema: A pesar de la documentación técnica, persisten brechas de conocimiento sobre los contextos de efectividad de estos mecanismos, las amenazas que mitigan y la falta de guías prácticas consolidadas.
Objetivo: Este estudio identifica y analiza los mecanismos de seguridad de ASP.NET Core, sus escenarios de aplicación, amenazas y mejores prácticas.
Metodología: Se realizó una Revisión de Literatura Gris (GLR) siguiendo la metodología de Garousi, analizando 38 fuentes entre 2022 y 2024.
Resultados: Se identificaron ocho mecanismos y trece amenazas. La revisión resalta que la mayoría de las vulnerabilidades surgen de configuraciones incorrectas y del manejo inadecuado de datos sensibles.
Conclusión: Los hallazgos ofrecen una base para que los desarrolladores implementen codificación segura, enfatizando que la efectividad depende de la configuración correcta más que de las herramientas.
Originalidad: Esta investigación cierra la brecha entre la documentación y la experiencia práctica al vincular mecanismos con vectores de ataque y prácticas reales.
Limitaciones: El alcance se limita a ASP.NET Core y a la literatura gris, pudiendo omitir prácticas propietarias de la industria.
Cómo citar
Licencia
Derechos de autor 2026 Ingeniería Solidaria
Esta obra está bajo una licencia internacional Creative Commons Atribución 4.0.
Compromiso ético y cesión de derechos
El autor debe declarar que su trabajo es original e inédito y que no se ha postulado a evaluación simultánea para su publicación por otro medio. Además, debe asegurar que no tiene impedimentos de ninguna naturaleza para la concesión de los derechos previstos en el contrato.
El autor se compromete a esperar el resultado de evaluación de la revista Ingeniería Solidaria, antes de considerar su presentación a otro medio; en caso de que la respuesta de publicación sea positiva, adicionalmente, se compromete a responder por cualquier acción de reivindicación, plagio u otra clase de reclamación que al respecto pudiera sobrevenir por parte de terceros.
Asimismo, debe declarar que, como autor o coautor, está de acuerdo por completo con los contenidos presentados en el trabajo y ceder todos los derechos patrimoniales, es decir, su reproducción, comunicación pública, distribución, divulgación, transformación, puesta a disposición y demás formas de utilización de la obra por cualquier medio o procedimiento, por el término de su protección legal y en todos los países del mundo, al Fondo Editorial de la Universidad Cooperativa de Colombia, de manera gratuita y sin contraprestación presente o futura.
[1] I. Schaefer et al., “Software diversity: State of the art and perspectives,” International Journal on Software Tools for Technology Transfer, vol. 14, no. 5, pp. 477–495, Jul. 2012, doi: https://doi.org/10.1007/s10009-012-0253-y. DOI: https://doi.org/10.1007/s10009-012-0253-y
[2] H. Sadia, S. Q. Abbas, and M. Faisal, “A Bayesian network-based software requirement complexity prediction model,” in Intelligent Technologies and Applications. Cham, Switzerland: Springer, 2022, pp. 197–213, doi: https://doi.org/10.1007/978-981-19-3015-7_15. DOI: https://doi.org/10.1007/978-981-19-3015-7_15
[3] M. Haleem, M. F. Farooqui, and M. Faisal, “Tackling requirements uncertainty in software projects: A cognitive approach,” International Journal of Cognitive Computing in Engineering, vol. 2, pp. 180–190, 2021, doi: https://doi.org/10.1016/j.ijcce.2021.10.003. DOI: https://doi.org/10.1016/j.ijcce.2021.10.003
[4] J. C. Najar Pacheco, J. A. Bohada Jaime, and H. C. I. Alemán Novoa, “Vulnerability of information on the Internet of Things,” Revista Ingeniería Solidaria, vol. 18, no. 3, pp. 1–17, Sep. 2022, doi: https://doi.org/10.16925/2357-6014.2022.03.07. DOI: https://doi.org/10.16925/2357-6014.2022.03.07
[5] N. Mohamed, “Artificial intelligence and machine learning in cybersecurity: A deep dive into state-of-the-art techniques and future paradigms,” Knowledge and Information Systems, vol. 67, no. 8, pp. 6969–7055, 2025, doi: https://doi.org/10.1007/s10115-025-02429-y. DOI: https://doi.org/10.1007/s10115-025-02429-y
[6] K. Svensson, D. Axelrod, M. Mohamad, and R. Wohlrab, “Guidelines for supporting software engineers in developing secure web applications,” in Product-Focused Software Process Improvement (PROFES 2024), Lecture Notes in Computer Science, vol. 15452. Cham, Switzerland: Springer, 2024, pp. 123–138, doi: https://doi.org/10.1007/978-3-031-78386-9_9. DOI: https://doi.org/10.1007/978-3-031-78386-9_9
[7] Y. R. Selivorstova, I. V. Liutenko, and S. V. Orekhov, “Frameworks analysis and evaluation used in web application development,” Bulletin of National Technical University “KhPI”. Series: System Analysis, Control and Information Technologies, no. 2, pp. 44–50, Dec. 2020, doi: https://doi.org/10.20998/2079-0023.2020.02.08. DOI: https://doi.org/10.20998/2079-0023.2020.02.08
[8] M. del Pilar Salas-Zárate, G. Alor-Hernández, R. Valencia-García, L. Rodríguez-Mazahua, A. Rodríguez-González, and J. L. López-Cuadrado, “Analyzing best practices on web development frameworks: The Lift approach,” Science of Computer Programming, vol. 102, pp. 1–19, May 2015, doi: https://doi.org/10.1016/j.scico.2014.12.004. DOI: https://doi.org/10.1016/j.scico.2014.12.004
[9] S. Bangani, L. Futcher, and J. van Niekerk, “An approach to teaching secure programming in the .NET environment,” in ICT Education, Communications in Computer and Information Science, vol. 1136. Cham, Switzerland: Springer, 2019, pp. 35–49, doi: https://doi.org/10.1007/978-3-030-35629-3_3. DOI: https://doi.org/10.1007/978-3-030-35629-3_3
[10] A. Alkussayer and W. H. Allen, “The ISDF framework: Integrating security patterns and best practices,” in Advances in Information Security and Its Application (ISA 2009), Communications in Computer and Information Science, vol. 36. Berlin, Germany: Springer, 2009, pp. 17–28, doi: https://doi.org/10.1007/978-3-642-02633-1_3. DOI: https://doi.org/10.1007/978-3-642-02633-1_3
[11] S. A. Slaughter, “Software development practices and software maintenance performance: A field study,” Ph.D. dissertation, (ND), USA, 1996, doi: https://doi.org/10.1287/mnsc.44.4.433.
[12] S. Maheshwari, “Mapping challenges in teaching-learning software testing,” in Proc. IEEE Frontiers in Education Conf. (FIE), Cincinnati, OH, USA, Oct. 2019, pp. 1–9, doi: https://doi.org/10.1109/FIE43999.2019.9028452. DOI: https://doi.org/10.1109/FIE43999.2019.9028452
[13] T. E. Gasiba, U. Lechner, M. Pinto-Albuquerque, and D. Mendez, “Is secure coding education in the industry needed? An investigation through a large-scale survey,” in Proc. 43rd International Conference on Software Engineering: Joint Track on Software Engineering Education and Training (ICSE-JSEET), May 2021, pp. 241–252, doi: https://doi.org/10.1109/ICSE-SEET52601.2021.00034. DOI: https://doi.org/10.1109/ICSE-SEET52601.2021.00034
[14] R. D. Banker, G. B. Davis, and S. A. Slaughter, “Software development practices, software complexity, and software maintenance performance: A field study,” Management Science, vol. 44, no. 4, pp. 433–450, 1998, doi: https://doi.org/10.1287/mnsc.44.4.433. DOI: https://doi.org/10.1287/mnsc.44.4.433
[15] S. S. Alqahtani, “Beyond the code: Analyzing OSS developers’ security awareness and practices,” International Journal of Information Security, vol. 24, no. 3, (ND), 2025, doi: https://doi.org/10.1007/s10207-025-01023-1. DOI: https://doi.org/10.1007/s10207-025-01023-1
[16] R. Fatima, A. Yasin, L. Liu, and J. Wang, “The use of grey literature and Google Scholar in software engineering systematic literature reviews,” in Proc. IEEE 44th Annual Computers, Software, and Applications Conference (COMPSAC), Oct. 2020, pp. 1099–1100, doi: https://doi.org/10.1109/COMPSAC48688.2020.00121. DOI: https://doi.org/10.1109/COMPSAC48688.2020.0-121
[17] V. Garousi, M. Felderer, and M. V. Mäntylä, “Guidelines for including grey literature and conducting multivocal literature reviews in software engineering,” Information and Software Technology, vol. 106, pp. 101–121, 2019, doi: https://doi.org/10.1016/j.infsof.2018.09.006. DOI: https://doi.org/10.1016/j.infsof.2018.09.006
[18] T. Dykstra, “ASP.NET Core security topics,” Microsoft Learn, Nov. 2024. [Online]. Available: https://learn.microsoft.com/en-us/aspnet/core/security/?view=aspnetcore-10.0
[19] J. Popay et al., Guidance on the Conduct of Narrative Synthesis in Systematic Reviews, Version 1.0. ESRC Methods Programme, 2006. [Online]. doi: https://doi.org/10.13140/2.1.1018.4643.
[20] G. Roshan, “Architecting secure web applications: Best practices for software architects,” Medium, Nov. 2024. [Online]. Available: https://medium.com/@gavandiroshan/architecting-secure-web-applications-best-practices-for-software-architects-7639f2445bea
[21] J. Kanjilal, “How to improve API security in ASP.NET Core,” InfoWorld, Aug. 2023. [Online]. Available: https://www.infoworld.com/article/2334732/how-to-improve-api-security-in-asp-net-core.html
[22] L. Rodríguez, “Top 20 ASP.NET security interview questions (+ answers),” Medium, Jun. 2023. [Online]. Available: https://medium.com/bytehide/top-20-asp-net-security-interview-questions-answers-b780ea071a56
[23] T. Kalos, “ASP.NET security best practices,” Escape Blog, Aug. 2024. [Online]. Available: https://escape.tech/blog/asp-dot-net-security/
[24] Ramotion, “What is cross-origin resource sharing (CORS)?,” Oct. 2023. [Online]. Available: https://www.ramotion.com/blog/what-is-cors-in-web-development/
[25] R. Anderson, “Introduction to authorization in ASP.NET Core,” Microsoft Learn, Dec. 2024. [Online]. Available: https://learn.microsoft.com/en-us/aspnet/core/security/authorization/introduction?view=aspnetcore-10.0
[26] P. Jason, “ASP.NET website hosting: Best practices for securing your web applications,” AccuWeb Hosting Blog, Dec. 2024. [Online]. Available: https://www.accuwebhosting.com/blog/asp-net-website-hosting-best-practices-for-secure-your-web-applications/
[27] ByteHide, “ASP.NET security interview questions and answers (2023),” May 2023. [Online]. Available: https://www.bytehide.com/blog/asp-net-security-interview-questions
[28] K. Kara, “Authentication and authorization in ASP.NET Core: A comprehensive guide,” Medium, Dec. 2023. [Online]. Available: https://medium.com/@kerimkkara/authentication-and-authorization-in-asp-net-core-a-comprehensive-guide-2025-84ff96df7264
[29] R. Patel, “A beginner’s guide to ASP.NET Core Identity for authentication and authorization (.NET 8),” Medium, Nov. 2024. [Online]. Available: https://medium.com/@ravipatel.it/a-beginners-guide-to-asp-net-core-identity-for-authentication-and-authorization-with-net-8-e6c-8deb612f4
[30] R. Anderson and K. Larkin, “Safe storage of app secrets in development in ASP.NET Core,” Microsoft Learn, Nov. 2024. [Online]. Available: https://learn.microsoft.com/en-us/aspnet/core/security/app-secrets?view=aspnetcore-10.0&tabs=windows
[31] F. Hasan and R. Anderson, “Prevent cross-site request forgery (XSRF/CSRF) attacks in ASP.NET Core,” Microsoft Learn, Oct. 2024. [Online]. Available: https://learn.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-10.0
[32] A. Kumar, “Avoiding cross-site scripting (XSS) attacks in C# and .NET Core,” C# Corner, Apr. 2024. [Online]. Available: https://www.c-sharpcorner.com/article/avoiding-cross-site-scripting-xss-attacks-in-c-sharp-and-net-core/
[33] S. Kataria, “Securing your financial data with ASP.NET Core solutions,” QServices, Nov. 2024. [Online]. Available: https://www.qservicesit.com/securing-your-financial-data-with-asp-net-core-solutions
[34] D. Rathod, “Complete guide to content security policy (CSP) in ASP.NET,” Atharva System, Nov. 2024. [Online]. Available: https://www.atharvasystem.com/the-complete-guide-to-content-security-policy-csp-in-asp-net/
[35] K. E. (ND), “10 best practices to secure ASP.NET Core MVC web applications,” Syncfusion Blog, Dec. 2024. [Online]. Available: https://www.syncfusion.com/blogs/post/10-practices-secure-asp-net-core-mvc-app
[36] A. Mohanty, “Web API security in .NET Core,” C# Corner, Oct. 2023. [Online]. Available: https://www.c-sharpcorner.com/article/web-api-security-in-net-core/
[37] Sanjay, “Broken access control in ASP.NET Core: OWASP Top 10,” Pro Code Guide, Oct. 2023. [Online]. Available: https://procodeguide.com/programming/broken-access-control-in-aspnet-core/
[38] S. X. (ND), “Creating fast and secure web API projects in .NET,” Softacom, Jun. 2024. [Online]. Available: https://www.softacom.com/blog/development/creating-fast-and-secure-web-api-project-in-net/
[39] D. M. Edirisinghe, “JWT authentication: Basics and best practices,” Medium, Feb. 2023. [Online]. Available: https://medium.com/@darshana-edirisinghe/jwt-security-concerns-f79e63ff4871
[40] P. Mehta, “Authentication and authorization in .NET Core,” Positiwise, Jul. 2024. [Online]. Available: https://positiwise.com/blog/authentication-and-authorization-in-net-core
[41] Riza (ND), “Best practices to secure your .NET Core application,” Codementor, Oct. 2024. [Online]. Available: https://www.codementor.io/@riza/best-practices-to-secure-your-net-core-application-2l0aue30mj
[42] J. Panchal, “Secure your APIs with .NET Core: Authentication and authorization,” Innovura Technologies, May 2024. [Online]. Available: https://innovuratech.com/implementing-authentication-and-authorization-in-net-core-apis/
[43] I. Baciu, “Building secure .NET applications,” Infobest Software Outsourcing Company, Aug. 2024. [Online]. Available: https://www.infobest.ro/building-secure-net-applications/
[44] S. Getachew, “Implementing role-based authorization in ASP.NET Core 8 Web API: Best practices for secure and scalable APIs,” Medium, Nov. 2024. [Online]. Available: https://medium.com/@solomongetachew112/implementing-role-based-authorization-in-asp-netc259f919fb5d
[45] M. Baldwin and T. Lanfear, “Best practices for protecting secrets,” Microsoft Learn, Aug. 2024. [Online]. Available: https://learn.microsoft.com/en-us/azure/security/fundamentals/secrets-best-practices
[46] Programmers.io Team, “Best practices for building secure web applications with ASP.NET Core,” Programmers.io, Dec. 2024. [Online]. Available: https://programmers.io/blog/building-web-application-with-asp-net-core/
[47] Peruzzi Services Limited, “How to deal with sensitive data in .NET,” May 2024. [Online]. Available: https://www.linkedin.com/pulse/how-deal-sensitive-data-net-peruzziservices-sqwtf/
[48] N. S. Filho, “Implementation and challenges of CORS in web applications developed with C#: A technical and practical analysis,” Leaders Tec, 2024. [Online]. Available: https://leaders.tec.br/article/26e6c8
[49] D. Galvan and R. Anderson, “Enforce HTTPS in ASP.NET Core,” Microsoft Learn, Oct. 2024. [Online]. Available: https://learn.microsoft.com/en-us/aspnet/core/security/enforcing-ssl?view=aspnetcore-10.0&tabs=visual-studio%2Clinux-sles
[50] R. Anderson, “Prevent cross-site scripting (XSS) in ASP.NET Core,” Microsoft Learn, Sep. 2024. [Online]. Available: https://learn.microsoft.com/en-us/aspnet/core/security/cross-site-scripting?view=aspnetcore-10.0
[51] A. Aborujilah, J. Adamu, S. M. Shariff, and Z. A. Long, “Descriptive analysis of built-in security features in web development frameworks,” in Proc. 16th International Conference on Ubiquitous Information Management and Communication (IMCOM), 2022, pp. 1–8, doi: https://doi.org/10.1109/IMCOM53663.2022.9721750. DOI: https://doi.org/10.1109/IMCOM53663.2022.9721750
