Improving Web Application Security: Threats and - CGISecurity

282 Part III: Building Secure Web ApplicationsKeep Authentication and Personalization Cookies SeparateKeep personalization cookies that contain user-specific preferences and non-sensitivedata separate from authentication cookies. A stolen personalization cookie might notrepresent a security threat, whereas an attacker can use a stolen authentication cookieto gain access to your application.Use Distinct Cookie Names and PathsUse unique name and path attribute values on the element. By ensuringunique names, you prevent possible problems that can occur when hosting multipleapplications on the same server. For example, if you don’t use distinct names, it ispossible for a user who is authenticated in one application to make a request toanother application without being redirected to that application’s logon page.For more information, see Microsoft Knowledge Base articles 313116, “PRB: FormsAuthentication Requests Are Not Directed to loginUrl Page,” and 310415, “PRB:Mobile Forms Authentication and Different Web Applications.”Use Absolute URLs for NavigationNavigating between the public and restricted areas of your site (that is, betweenHTTP and HTTPS pages) is an issue because a redirect always uses the protocol(HTTPS or HTTP) of the current page, not the target page.Once a user logs on and browses pages in a directory that is secured with SSL,relative links such as “..\publicpage.aspx” or redirects to HTTP pages result inthe pages being served using the https protocol, which incurs an unnecessaryperformance overhead. To avoid this, use absolute links such as “http://servername/appname/publicpage.aspx” when redirecting from an HTTPS page to an HTTPpage.Similarly, when you redirect to a secure page (for example, the login page) froma public area of your site, you must use an absolute HTTPS path, such as“https://servername/appname/secure/login.aspx”, rather than a relative path,such as restricted/login.aspx. For example, if your Web page provides a logonbutton, use the following code to redirect to the secure login page.private void btnLogon_Click( object sender, System.EventArgs e ){// Form an absolute path using the server name and v-dir namestring serverName =HttpUtility.UrlEncode(Request.ServerVariables["SERVER_NAME"]);string vdirName = Request.ApplicationPath;Response.Redirect("https://" + serverName + vdirName +"/Restricted/Login.aspx");}