Improving Web Application Security: Threats and - CGISecurity

260 Part III: Building Secure Web ApplicationsVulnerabilitiesVulnerabilities that lead to information disclosure include:●●Weak exception handlingLetting raw exception details propagate to the clientAttacksThere are many attacks that can result in information disclosure. These include:●●Buffer overflows.Sending deliberately malformed input.CountermeasuresTo prevent information disclosure:●●●Use structured exception handling.Return generic error pages to the client.Use default redirect pages that contain generic and harmless error messages.Design ConsiderationsBefore you develop Web pages and controls, there are a number of important issuesthat you should consider at design time. The following are the key considerations:●●●●●●●●Use server-side input validation.Partition your Web site.Consider the identity that is used for resource access.Protect credentials and authentication tickets.Fail securely.Consider authorization granularity.Place Web controls and user controls in separate assemblies.Place resource access code in a separate assembly.Use Server-Side Input ValidationAt design time, identify all the various sources of user input that your Web pages andcontrols process. This includes form fields, query strings, and cookies received fromthe Web user, as well as data from back-end data sources. The Web user clearly livesoutside your application’s trust boundary, so all of the input from that source must bevalidated at the server. Unless you can absolutely trust the data retrieved from backenddata sources, that data should also be validated and sanitized before it is sent tothe client. Make sure your solution does not rely on client-side validation because thisis easily bypassed.