Category: ASP.NET

Combine TLS, authn/z, validation, and rate limiting for APIs.

Enforce HTTPS redirects and HSTS in production.

Keep secrets in user-secrets, env vars, or Key Vault � not source.

Build Identity-based register/login/logout with locked-down pages.

Assert status codes and JSON contracts in automated API tests.

Mock interfaces with Moq/NSubstitute.

Apply OWASP ASVS/Top 10 thinking to ASP.NET apps.

Prevent SQL injection with parameterization and ORM queries.

Prevent XSS by encoding output and limiting HTML input.

Protect cookie-authenticated POSTs with anti-forgery tokens.