I am creating an ASP.NET MVC 3 web application which is used for looking up very private data at home. The data is stored in a database on the server, on which the IIS-Server is running.
Since I have finished most parts of the actual programming, I want to make the application as secure as possible.
I am already using https, but I guess this won’t be enough.
What I’m looking for is something like… sending the data requested encrypted over the wire and decrypt it at the client locally, or something like that.
Anyone, ideas?
You might want to read about XSS (cross site scripting) and SQL Injection. SSL is secure enough to transport your data so that it won’t be able to be read if intercepted, but it doesn’t mean that your site can’t be hacked.
What makes an input vulnerable to XSS?
What is SQL injection?