Improving Web Application Security: Threats and - CGISecurity

276 Part III: Building Secure Web ApplicationsInstall URLScan on Your Web ServerURLScan is an ISAPI filter that is installed when you run the IISLockdown tool. Thishelps mitigate the threat of XSS attacks by rejecting potentially malicious input. Formore information about IISLockdown and URLScan, see Chapter 16, “Securing YourWeb Server.”Note IIS 6.0 on Windows Server 2003 has functionality equivalent to URLScan built in.Use the HttpOnly Cookie OptionInternet Explorer 6 Service Pack 1 supports a new HttpOnly cookie attribute, whichprevents client-side script from accessing the cookie from the document.cookieproperty. Instead, an empty string is returned. The cookie is still sent to the serverwhenever the user browses to a Web site in the current domain.Note Web browsers that do not support the HttpOnly cookie attribute either ignore the cookie orignore the attribute, which means it is still subject to XSS attacks.The System.Net.Cookie class does not currently support an HttpOnly property. Toadd an HttpOnly attribute to the cookie, you need to use an ISAPI filter, or if youwant a managed code solution, add the following code to your application’sApplication_EndRequest event handler in Global.asax:protected void Application_EndRequest(Object sender, EventArgs e){string authCookie = FormsAuthentication.FormsCookieName;foreach (string sCookie in Response.Cookies){// Just set the HttpOnly attribute on the Forms authentication cookie// Skip this check to set the attribute on all cookies in the collectionif (sCookie.Equals(authCookie)){// Force HttpOnly to be added to the cookie headerResponse.Cookies[sCookie].Path += ";HttpOnly";}}}Note A future version of the .NET Framework is likely to have an HttpOnly property on theCookie class.