Improving Web Application Security: Threats and - CGISecurity

Chapter 5: Architecture and Design Review for Security 121Examine the following questions to help ensure that your design is not susceptible toparameter manipulation attacks:●●●Do you validate all input parameters?Do you pass sensitive data in parameters?Do you use HTTP header data for security?Do You Validate All Input Parameters?Check that your application validates all input parameters, including regular andhidden form fields, query strings, and cookies.Do You Pass Sensitive Data in Parameters?If your application passes sensitive data in parameters such as query strings or formfields, examine why your application favors this approach over the much moresecure approach of passing a session identifier (for example, in an encrypted cookie).Use this information to associate the session with the state of a user that ismaintained in the state store on the server. Consider the following review points:● Do you encrypt cookies with sensitive data?If your application uses a cookie that contains sensitive data, such as a user nameor a role list, make sure it is encrypted.● Do you pass sensitive data in query strings or Form fields?This is not recommended because there is no easy way to prevent themanipulation of data in query strings or form fields. Instead, consider usingencrypted session identifiers and store the sensitive data in the session state storeon the server.● Do you protect view state?If your Web pages or controls use view state to maintain state across HTTPrequests, check that the view state is encrypted and checked for integrity withmessage authentication codes (MACs). You can configure this at the machine levelor on a page-by-page basis.Do You Use HTTP Header Data for Security?Make sure that your Web application does not make security decisions based oninformation in HTTP headers because an attacker can easily manipulate the header.Do not rely on the value of the HTTP referer field to check that the request originatedfrom a page that is generated by your Web application — this creates vulnerabilities.Doing this is inherently insecure because the referer field can easily be changed bythe client.