Improving Web Application Security: Threats and - CGISecurity

Chapter 4: Design Guidelines for Secure Web Applications 91Limit Session LifetimeReduce the lifetime of sessions to mitigate the risk of session hijacking and replayattacks. The shorter the session, the less time an attacker has to capture a sessioncookie and use it to access your application.Protect Session State from Unauthorized AccessConsider how session state is to be stored. For optimum performance, you can storesession state in the Web application’s process address space. However, this approachhas limited scalability and implications in Web farm scenarios, where requests fromthe same user cannot be guaranteed to be handled by the same server. In thisscenario, an out-of-process state store on a dedicated state server or a persistent statestore in a shared database is required. ASP.NET supports all three options.You should secure the network link from the Web application to state store usingIPSec or SSL to mitigate the risk of eavesdropping. Also consider how the Webapplication is to be authenticated by the state store. Use Windows authenticationwhere possible to avoid passing plaintext authentication credentials across thenetwork and to benefit from secure Windows account policies.CryptographyCryptography in its fundamental form provides the following:●●●●Privacy (Confidentiality). This service keeps a secret confidential.Non-Repudiation (Authenticity). This service makes sure a user cannot denysending a particular message.Tamperproofing (Integrity). This service prevents data from being altered.Authentication. This service confirms the identity of the sender of a message.Web applications frequently use cryptography to secure data in persistent stores or asit is transmitted across networks. The following practices improve your Webapplication’s security when you use cryptography:● Do not develop your own cryptography.●●●Keep unencrypted data close to the algorithm.Use the correct algorithm and correct key size.Secure your encryption keys.