Improving Web Application Security: Threats and - CGISecurity

Contents xviiDeciding Which Approach to Take ............................................................................. 238Customizing Policy .............................................................................................. 238Sandboxing ........................................................................................................ 238Medium Trust ......................................................................................................... 239Reduced Attack Surface ...................................................................................... 239Application Isolation............................................................................................ 239Medium Trust Restrictions ....................................................................................... 240OLE DB .............................................................................................................. 240Event Log ........................................................................................................... 244Web Services ..................................................................................................... 248Registry ............................................................................................................. 250Summary ............................................................................................................... 252Additional Resources .............................................................................................. 252Chapter 10Building Secure ASP.NET Pages and Controls 253In This Chapter ....................................................................................................... 253Overview ................................................................................................................ 253How to Use This Chapter ......................................................................................... 254Threats and Countermeasures ................................................................................. 254Code Injection .................................................................................................... 255Session Hijacking ............................................................................................... 256Identity Spoofing................................................................................................. 257Parameter Manipulation ...................................................................................... 258Network Eavesdropping ....................................................................................... 259Information Disclosure ........................................................................................ 259Design Considerations ............................................................................................ 260Use Server-Side Input Validation .......................................................................... 260Partition Your Web Site........................................................................................ 261Consider the Identity That Is Used for Resource Access......................................... 262Protect Credentials and Authentication Tickets...................................................... 262Fail Securely ....................................................................................................... 262Consider Authorization Granularity........................................................................ 263Place Web Controls and User Controls in Separate Assemblies .............................. 263Place Resource Access Code in a Separate Assembly ........................................... 263Input Validation....................................................................................................... 263Constrain, Then Sanitize...................................................................................... 264Regular Expressions............................................................................................ 264String Fields ....................................................................................................... 265Date Fields......................................................................................................... 267Numeric Fields.................................................................................................... 267Sanitizing Input................................................................................................... 269Validating HTML Controls..................................................................................... 269Validating Input Used for Data Access .................................................................. 270Validating Input Used For File I/O ......................................................................... 270Common Regular Expressions.............................................................................. 271