Improving Web Application Security: Threats and - CGISecurity

118 Part II:Designing Secure Web ApplicationsUse the following questions to help validate the handling of sensitive data by yourapplication:● How are session identifiers exchanged?● Do you restrict session lifetime?● How is the session state store secured?How Are Session Identifiers Exchanged?Examine the session identifier that your application uses to manage user sessions andhow these session identifiers are exchanged. Consider the following:● Do you pass session identifiers over unencrypted channels?If you track session state with session identifiers — for example, tokens containedin cookies — examine whether or not the identifier or cookie is only passed over anencrypted channel, such as SSL.● Do you encrypt session cookies?If you use Forms authentication, make sure your application encrypts theauthentication cookies using the protection=“All” attribute on the element. This practice is recommended in addition to SSL to mitigate the risk of anXSS attack that manages to steal the authentication cookie of a user.●Do you pass session identifiers in query strings?Make sure that your application does not pass session identifiers in query strings.These strings can be easily modified at the client, which would allow a user toaccess the application as another user, access the private data of other users, andpotentially elevate privileges.Do You Restrict Session Lifetime?Examine how long your application considers a session identifier valid. Theapplication should limit this time to mitigate the threat of session hijacking andreplay attacks.How Is the Session State Store Secured?Examine how your application stores session state. Session state can be stored in theWeb application process, the ASP.NET session state service, or a SQL Server statestore. If you use a remote state store, make sure that the link from the Web server tothe remote store is encrypted with IPSec or SSL to protect data over the wire.For more information about securing ASP.NET session state, see “Session State” inChapter 19, “Securing Your ASP.NET Application and Web Services.”