0

I am developing a website which will be open to the public. In other projects I've never had worry with the way that the login was made​​, but in this case it is important. Is there any way to protect the information being sent to the server, to prevent sniff the network and thus capture the login and password openly?

Additional information: the site is in ASP.NET MVC 4

3 Answers 3

1

Yes. It's call HTTPS. If you get a cert for your domain and apply it to your site in IIS, and of course, require HTTPS on the any auth actions. Then, the traffic will be encrypted end-to-end. It's not unbreakable mind you, but it's really all there is and is largely effective, unless you leak your private key or the client's computer has been compromised in some way.

1

Just use

Html.AntiForgeryToken();

in your view, where you have the form, and then use the data annotation

[ValidateAntiForgeryToken]

in your controller method where the POST action is, and for SSL add the data annotation

[RequireHttps]

in the same method

1
  • 2
    Anti-forgery tokens have nothing to do with data going over the line unencrypted. They're still important, but for a completely different and unrelated reason: CSRF. Feb 21, 2014 at 18:03
0

You should always use an SSL certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.