From a security point of view, there really is no difference in the .master file and the .aspx file. They have a unique execution path when it comes to the page life cycle, but they execute in the same way and will be subject to the same security and protection flaws.
However, shortening the code that the .master file resolves (and also makes you think about generalization) will help you develop a reliable website (security-related).
Kevin source
share