ASP.NET Core meets OWASP Top 10 2025 - Anders Abel - NDC Oslo 2026
Keywords
Summary
149 words
Critical Evaluation
Value of the Information & Strength of the Argument
The talk delivers high-value information by bridging the OWASP Top 10 2025 with concrete ASP.NET Core implementations. The speaker’s argumentation is solid, drawing on real incidents (e.g., the cat iframe CSRF example) and practical coding patterns. He clearly explains complex topics like authorization policies, resource-based authorization, and data protection, and provides compelling reasoning for locking down applications by default. He also offers pragmatic advice on dependency management and the value of support contracts for open-source sustainment. The flow is logical, and he reinforces each point with live code snippets and configuration examples, making the content actionable.
Scientific Rigor, Source Quality, Title Accuracy
The speaker references OWASP Top 10 as the canonical source but does not cite specific URLs during the talk. However, the information aligns with current OWASP documentation and Microsoft’s official ASP.NET Core security guidance. The talk’s technical accuracy is high; he correctly describes features like the anti-forgery token mechanism and the Data Protection API. The title accurately reflects the content, which is a direct walkthrough of the OWASP Top 10 list applied to ASP.NET Core. No supporting material is provided, but the speaker’s expertise lends credibility. Community feedback is not available for this video.
205 words
Title / Content Match
Titre exactly reflects the content: a session focused on mapping OWASP Top 10 2025 to ASP.NET Core security measures.
Quality & Reliability
8/10
The talk is well-structured, technically accurate, and based on the speaker's extensive experience in identity and security. It provides practical guidance on ASP.NET Core built-in protections and explains OWASP Top 10 2025 clearly. No sources are explicitly cited beyond general knowledge, but the content aligns with official OWASP documentation and Microsoft best practices.
Key Moments
Markers derived by PSI from the transcript: the creator did not define chapters.
- Introduction and agenda overview, including the OWASP Top 10 2025 list.
- Discussion on broken access control (direct object reference) and authorization policies.
- Explanation of resource-based authorization and require assertion pattern.
- Open redirects and how ASP.NET Core validates local URLs.
- CSRF protection with anti-forgery tokens and the real-world ADSL modem story.
- Security misconfiguration and secure-by-default features in ASP.NET Core.
- Software supply chain attacks, package pinning, and support contracts for open-source.
- Cryptographic failures and the Data Protection API, including purpose and key management.
Cited Sources
- NDC Conferences official website — Mentioned as the event organiser.
- NDC Oslo official website — Mentioned as the specific conference location.
Concurring Sources
- OWASP Top 10 — The talk is based on this list.
- ASP.NET Core Security Overview — Microsoft's official documentation on built-in protections.
Contribution & Novelties
The talk’s original contribution is its focused, practical mapping of the OWASP Top 10 2025 to ASP.NET Core features. It goes beyond theory by showing specific code patterns and configuration options that developers can immediately implement, such as fallback policies for secure defaults, resource-based authorization, and the Data Protection API. It also highlights lesser-known aspects like the new anti-forgery enhancements in .NET 11.
Pour aller plus loin :
- OWASP Top 10 2025 — Official list and documentation.
- ASP.NET Core Security Documentation — Microsoft’s guide on authentication, authorization, and data protection.
- Data Protection API — Official docs on the crypto API mentioned in the talk.
- OWASP Cheat Sheet Series — Practical security guidance for various web vulnerabilities.
116 words
Radar Profile
The radar profile shows high scores across all dimensions, indicating a well-balanced technical talk. The high 'niveau_technique' and 'quantite_information' reflect the depth of content, while 'qualite_information' and 'fiabilite_globale' indicate reliable, accurate information. This is a comprehensive and technically sound presentation.