Building Secure ASP.NET Applications - People Search Directory

188
Building Secure ASP.NET Applications
SQL session state can be configured either in Machine.config or Web.config.
The default setting in machine.config is shown below.
By default, the SQL script InstallSqlState.sql, which is used for building the database
used for SQL session state is installed at the following location:
C:\WINNT\Microsoft.NET\Framework\v1.0.3705
When you use SQL session state there are two problems to consider.
● You must secure the database connection string.
● You must secure the session state as it crosses the network.
Securing the Database Connection String
If you use SQL authentication to connect to the server, the user ID and password
information is stored in plain text in web.config as shown below.
By default the HttpForbiddenHandler protects configuration files from being
downloaded. However, any user who has direct access to the folders where the
configuration files are stored can still see the user name and password. A better
practice is to use Windows authentication to SQL Server.
To use Windows authentication, you can use the ASP.NET process identity (typically
ASPNET)
1. Create a duplicate account (with the same name and password) on the database
server.
2. Create a SQL login for the account.
3. Create a database user in the ASPState database and map the SQL login to the
new user.
The ASPState database is created by the InstallSQLState.sql script.