Authentication and Authorization

In general, I think that the ASP.NET team did a pretty good job with the security of the framework. Sure, there are some annoyances, like the fact that CSRF tokens never expire, and some gotchas, like you need to take extra steps to ensure that any IHtmlHelper extensions are secure, but in general, the framework offers decent security.