Improving Web Application Security: Threats and - CGISecurity

104 Part II:Designing Secure Web ApplicationsHave You Considered Web Farm Issues?If your application is going to be deployed in a Web farm, you can make noassumptions about which server in the farm will process client requests. Successiverequests from the same client may be served by separate servers. As a result, youneed to consider the following issues:● How are you managing session state?In a Web farm, you cannot manage session state on the Web server. Instead, yourdesign must incorporate a remote state store on a server that is accessed by all theWeb servers in the farm. For more information, see “Session Management” later inthis chapter.● Are you using machine-specific encryption keys?If you plan to use encryption to encrypt data in a shared data source, such as adatabase, the encryption and decryption keys must be the same across allmachines in the farm. Check that your design does not require encryptionmechanisms that require machine affinity.● Are you using Forms authentication or protected view state?If so, you are reliant upon the settings. In a Web farm, you mustuse common key across all servers.● Are you using Secure Sockets Layer (SSL)?If you use SSL to encrypt the traffic between browser and Web server, where doyou terminate the SSL connection? Your options include the Web server, a Webserver with an accelerator card, or a load balancer with an accelerator card.Terminating the SSL session at a load balancer with an accelerator card generallyoffers the best performance, particularly for sites with large numbers ofconnections.If you terminate SSL at the load balancer, network traffic is not encrypted from theload balancer to the Web server. This means that an attacker can potentially sniffnetwork traffic after the data is decrypted, while it is in transit between the loadbalancer and Web server. You can address this threat either by ensuring that theWeb server environment is physically secured or by using transport-levelencryption provided by IPSec policies to protect internal data center links.What Trust Levels Does the Target Environment Support?The code access security trust level of the target environment determines theresources your code can access and the privileged operations it can perform. Checkthe supported trust level of your target environment. If your Web application isallowed to run with Full trust, your code can access any resources, subject tooperating system security.