Mass assignment vulnerability references

I am a fan of ASP.NET MVC. I am also a fan of security. The two posts below combine those interests by describing how to mitigate mass assignment vulnerabilities.

• What ASP.Net MVC Developers Can Learn From GitHub’s Security Woes
• 6 Ways To Avoid Mass Assignment in ASP.NET MVC

I am posting these so that my team can refer to them in future if needed.

Here's a bonus link. I can never remember this syntax: How to join two collections with LINQ

WCF Web API security in a domain

I've been building REST services using WCF Web API for use in an intranet. Upon deployment from my desktop to a server I started experiencing the error below even though the hosting application, ASP.NET MVC 3, was successfully using Windows authentication.

System.NotSupportedException: Security settings for this service require 'Anonymous' Authentication but it is not enabled for the IIS application that hosts this service.

A Google search shows that this isn't a novel situation, but I couldn't get the configuration and incantation right for Web API. Luckily, after a couple of hours of researching and fiddling with the web.config, I came across this post that revealed the solution to me.

When registering the service route:

var config = new HttpConfiguration();
   config.Security = (u, s) => {
      s.Transport.ClientCredentialType = System.ServiceModel.HttpClientCredentialType.Windows;
      s.Mode = HttpBindingSecurityMode.TransportCredentialOnly;
   };

   routes.MapServiceRoute<YourType>("YourRoutePrefix", config);

I hope that this post saves someone some time.