Skip to content

Secure by default attribute and analyzers #45658

Open
@haavapet

Description

@haavapet

Is your feature request related to a problem?

With «secure by default» being pushed more and more, and «insecure» still having to be supported for whatever legacy or compatibility reason, there could be a benefit in having a standardized way of giving warnings when you are not using the default approach.

The issue might be that an sdk, either internal to microsoft or external, follows best practices and implements secure by default, but the users of the sdks arent fully aware of the consequences of overriding this behavior. This can ofcourse be mitigated though shipping their own analyzers (high effort) or good documentation (less visible), but a standardized approach might be beneficial here.

Describe the solution you'd like

Might need investigation and usage analysis, but an example would be a (dotnet provided) attribute that can be added to extension methods, and a (dotnet provided) analyzer giving warnings on the usage of them.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions