Improving Web Application Security: Threats and - CGISecurity

xviiiImproving Web Application Security: Threats and CountermeasuresCross-Site Scripting................................................................................................. 272Validate Input ..................................................................................................... 273Encode Output.................................................................................................... 273Defense in Depth Countermeasures..................................................................... 274Authentication ........................................................................................................ 277Forms Authentication .......................................................................................... 277Partition Your Web Site........................................................................................ 278Secure Restricted Pages with SSL........................................................................ 279Use URL Authorization......................................................................................... 279Secure the Authentication Cookie......................................................................... 280Use Absolute URLs for Navigation ........................................................................ 282Use Secure Credential Management..................................................................... 283Authorization .......................................................................................................... 284Use URL Authorization for Page and Directory Access Control................................. 284Use File Authorization with Windows Authentication ............................................... 284Use Principal Demands on Classes and Methods .................................................. 284Use Explicit Role Checks for Fine-Grained Authorization ......................................... 285Impersonation ........................................................................................................ 286Using Programmatic Impersonation ...................................................................... 286Sensitive Data ........................................................................................................ 288Do not Pass Sensitive Data from Page to Page...................................................... 288Avoid Plaintext Passwords in Configuration Files.................................................... 288Use DPAPI to Avoid Key Management ................................................................... 288Do Not Cache Sensitive Data............................................................................... 288Session Management ............................................................................................. 289Require Authentication for Sensitive Pages ........................................................... 289Do Not Rely on Client-Side State Management Options.......................................... 289Do Not Mix Session Tokens and Authentication Tokens .......................................... 290Use SSL Effectively ............................................................................................. 290Secure the Session Data..................................................................................... 290Parameter Manipulation .......................................................................................... 291Protect View State with MACs .............................................................................. 291Use Page.ViewStateUserKey to Counter One-Click Attacks...................................... 292Maintain Sensitive Data on the Server.................................................................. 292Validate Input Parameters.................................................................................... 293Exception Management ........................................................................................... 293Return Generic Error Pages to the Client............................................................... 293Implement Page-Level or Application-Level Error Handlers....................................... 294Auditing and Logging ............................................................................................... 295EventLogPermission............................................................................................ 296Summary ............................................................................................................... 296Additional Resources .............................................................................................. 297