Improving Web Application Security: Threats and - CGISecurity

xxImproving Web Application Security: Threats and CountermeasuresThreats and Countermeasures ................................................................................. 320Unauthorized Access........................................................................................... 321Parameter Manipulation ...................................................................................... 322Network Eavesdropping ....................................................................................... 322Disclosure of Configuration Data .......................................................................... 323Message Replay ................................................................................................. 323Design Considerations ............................................................................................ 325Authentication Requirements ............................................................................... 325Privacy and Integrity Requirements ....................................................................... 325Resource Access Identities.................................................................................. 325Code Access Security.......................................................................................... 326Input Validation....................................................................................................... 326Strongly Typed Parameters................................................................................... 326Loosely Typed Parameters ................................................................................... 328XML Data ........................................................................................................... 328SQL Injection ...................................................................................................... 331Cross-Site Scripting............................................................................................. 331Authentication ........................................................................................................ 332Platform Level Authentication............................................................................... 332Message Level Authentication.............................................................................. 333Application Level Authentication........................................................................... 335Authorization .......................................................................................................... 335Web Service Endpoint Authorization...................................................................... 336Web Method Authorization ................................................................................... 336Programmatic Authorization ................................................................................. 336Sensitive Data ........................................................................................................ 337XML Encryption................................................................................................... 337Encrypting Parts of a Message............................................................................. 338Parameter Manipulation .......................................................................................... 339Exception Management ........................................................................................... 339Using SoapExceptions......................................................................................... 340Application Level Error Handling in Global.asax...................................................... 341Auditing and Logging ............................................................................................... 341Proxy Considerations............................................................................................... 341Code Access Security Considerations ....................................................................... 342Deployment Considerations ..................................................................................... 343Intranet Deployment............................................................................................ 343Extranet Deployment ........................................................................................... 343Internet Deployment............................................................................................ 344Summary ............................................................................................................... 345Additional Resources .............................................................................................. 345