102 posts tagged with "Security"

By default, ASP.NET Core reads a request body of up to about 28.6 MB. An API that takes small JSON documents has no use for that, and lowering it means a huge body gets turned away before your code spends any time on it.

A rate limit per client address stops one caller from using up what's meant for everyone. ASP.NET Core has this built in, as a fixed window for each address. It takes a few lines, plus a little more to tell the client when to come back.

A connection string is a list of name=value pairs, split by ;. So a ; in your password ends the value early, and the rest looks like a strange option. Here's every case I tested, and the way to avoid thinking about it.

MySQL 9.7 allows TLS 1.3, and .NET 10 supports it, yet MySql.Data connects with TLS 1.2. It's the driver's default, on every platform. One connection string option changes that, and macOS needs one more setting.

SslMode=VerifyFull is the strongest check MySql.Data has: it verifies who signed the server's certificate, and that it's for the host you're connecting to. With PEM files, the driver also demands a client certificate and key, in one exact format. I hit each requirement in turn, so here they all are.

SslMode=Required encrypts the connection, and doesn't check who's at the other end. VerifyCA adds that check: your app only connects to a server whose certificate was signed by a CA you trust. It takes one file, and two options.

SslMode in a MySql.Data connection string decides two things: whether the connection is encrypted, and whether the driver checks who's on the other end. Required, the one most examples show, does the first and not the second. I tested each mode to see what it really does.

MySQL can invent a strong password for an account and show it to you once, so nobody has to think one up. Just look at what it produces before you paste it into a connection string.

MySQL can refuse weak passwords, with a component that's off by default in the Docker image. It takes one statement to turn on, and it's easy to see its rules, or score a password, before you rely on it.

To stop an account signing in, without deleting it or changing its rights or password, lock it. One thing to know first: sessions that are already open carry on working.