asp.net mvc 5 - MVC 5 security measures -

i developing mvc 5 internet application , have questions in relation security.

what security measures need manually implement ensure internet application secure?

this have far:

• [validateantiforgerytoken] attributes on each httppost function
• sanitizer.getsafehtml function on model attribute has html data
• identity 2.1 authentication , authorization

thanks in advance.

update

the application simple mvc internet application web service hosted on azure. using entity framework 6, web api 2.0 , mvc 5. relevant information can give you?

that cover xsrf , stored xss. should check for:

• dom xss in javascript (when modifying dom using data query string example).
• json hijacking
• code injection (sql injection if using sql db example)
• enforce https login (both login form , login post)
• ... etc ...

the common vulnerabilities not technical bugs, example should:

• reduce data trust client. example, if have shopping cart, may idea put price hidden field in buying form, server not need go db price product, user may tamper form , buy @ $0, or -$100.

• check user cannot fool multi-step forms, example allow him order products without going through payment page.

• check if application returns files name, cannot http://example.com/home/getfile?filename=..\..\web.config.

• check enforcing authorization besides authentication. example, user 123 may authenticated, not authorized check user 456 profile.

• ... etc ...

the best thing do, check oswasp page : https://www.owasp.org/index.php/category:owasp_top_ten_project