OWASP A04: Cryptographic Failures (1) — Encoding, Hashing, Encryption and HTTPS
Why Base64 is not encryption and how hashing differs from encryption. We catch tampered data with AES-GCM, use RandomNumberGenerator instead of Random for password reset codes, see why MD5 is wrong for passwords, turn on the CA5351 and CA5394 analyzers, and inspect HTTPS redirection and HSTS defaults in ASP.NET Core with curl.
6 Nov 2026
·
9 min
·
11
