Securing BlazorHero for production use

[snapper1975]

Hi all

I like the look of this project a lot but before I start building a system on it, please can someone tell me how secure it is? I’m not a developer by trade so I’d be learning as I go and any input would be appreciated. Of course the default usernames and passwords would have to be wiped and an SSL certificate installed but apart from that, is this framework secure enough to be used on internet-facing systems, with sensitive data? Are there any known vulnerabilities to be aware of?

Put another way: If there are specific tasks required to secure it, what are those steps?

Thank you very much.

[snapper1975]

Anybody able to help me please?
🙏

[matthewcorven]

@snapper1975 every app has its own security requirements. What are yours?

BlazorHero goes a long way to align with OWASP recommendations by implementing ASP .NET Security options, but ultimately it is up to your engineering and infrastructure teams to configure and implement per your requirements.

[neozhu]

As far as the application itself is concerned, as your password is complex enough, it is safe.

[snapper1975]

Thanks for the feedback guys.

My requirement is to use the system to store and report on client accounts, so the database would contain the personal information of those clients such as names, addresses, and payment data. Hence my question about security.

For a bit more insight:

If a duplicate of "brands" was renamed to "clients" and the corresponding "products" renamed to "purchases" (iow with the same many-to-one relationship it contained the transaction history of each client), that would be the sort of information stored in the system. As well as data about actual brands and products that we sell.

My sales staff could then log in from wherever they are and review/update "clients" data (very basic CRM functionality) and also review their purchase history with us before/after each meeting.

I'd then also be able to build some simple task management functions around those clients by using a third entity. So a new purchase of a product could trigger a workflow (send an email, or whatever).

And so on.

Ultimately, our remote as well as on-site staff could work on the same system, managing products, brands, clients and order history, along with some task flows, all via BH.

My though is to duplicate the brands/products entities and tweak them accordingly for each function of the system.

Does that make more sense?

[matthewcorven]

@snapper1975 thanks for the information on use cases. I don't see any security-related requirements called out specifically so I will jump to the conclusion that you are still discovering that information. From what I hear:

• You'll be needing roles to define what each type of user (perhaps by persona?) can access and perform. BlazorHero is ready for this, but it'll need customization at the configuration level at the least.
• "Payment data" may have numerous requirements based on the nature of that data and the regulations you're obligated to abide by. At the very least, be sure to determine if PCI Compliance applies to your company given it's role to the user and other entities. If so, BlazorHero isn't going to make you compliant out of the box. Things like encryption-at-rest and payment method tokenization are outside what BlazorHero does right away for you.

Good luck

[snapper1975]

Great answers, thanks guys. That is pretty much what I needed to know. 👍🏼