Improving Web Application Security: Threats and - CGISecurity

258 Part III: Building Secure Web ApplicationsCountermeasuresYou can employ the following countermeasures to prevent identity spoofing:●●●Only transmit authentication credentials and cookies over HTTPS connections.Enforce strong passwords. Regular expressions can be used to ensure that usersuppliedpasswords meet suitable complexity requirements.Store password verifiers in the database. Store non-reversible password hashescombined with a random salt value to mitigate the risk of dictionary attacks.For more information about storing password hashes and other secrets in thedatabase, see Chapter 14, “Building Secure Data Access.”Parameter ManipulationParameters are the items of data that are passed from the client to the server over thenetwork. They include form fields, query strings, view state, cookies, and HTTPheaders. If sensitive data or data that is used to make security decisions on the serverare passed using unprotected parameters, your application is potentially vulnerableto information disclosure or unauthorized access.VulnerabilitiesVulnerabilities that can lead to parameter manipulation include:● Using hidden form fields or query strings that contain sensitive data● Passing cookies that contain security-sensitive data over unencrypted connectionsAttacksParameter manipulation attacks include:●●●Cookie replay attacks. The attacker captures and alters a cookie and then replaysit to the application. This can easily lead to identity spoofing and elevation orprivileges if the cookie contains data that is used for authentication orauthorization on the server.Manipulation of hidden form fields. These fields contain data used for securitydecisions on the server.Manipulation of query string parameters.