Improving Web Application Security: Threats and - CGISecurity

10Building Secure ASP.NET Pagesand ControlsIn This Chapter●●●●●●OverviewPreventing cross-site scripting (XSS) attacksPartitioning sites into public and restricted areasPreventing session hijacking and cookie replay attacksDeveloping secure Forms authenticationPreventing rich exception details from reaching the clientValidating input in Web pages and controlsWeb pages and controls are in your application’s front line of defense and can besubject to intense probing by attackers who are intent on compromising yourapplication’s security. These attacks are often ultimately aimed at back-end systemsand data stores.Input data validation should be a top consideration when you build Web pagesbecause the majority of top application-level attacks rely on vulnerabilities in thisarea. One of the most prevalent attacks today is cross-site scripting (XSS), which ismore of an attack on your application’s users than on the application itself, but itexploits server-side application vulnerabilities all the same. The results can bedevastating and can lead to information disclosure, identity spoofing, and elevationof privilege.