Improving Web Application Security: Threats and - CGISecurity

Chapter 10: Building Secure ASP.NET Pages and Controls 283Use Secure Credential ManagementIdentity spoofing is one of the most common authentication-related threats to yourapplication. Identity spoofing occurs when an attacker gains access to the applicationunder the guise of another user. One way to do this is to hijack the session cookie, butif you have secured the authentication cookie as described earlier, the risk issignificantly reduced. In addition, you must build secure credential management anda secure user store to mitigate the risk posed by brute force password attacks,dictionary attacks, and SQL injection attacks.The following recommendations help you reduce risk:● Use one-way hashes for passwords.●●Use strong passwords.Prevent SQL injection.Use One-Way Hashes for PasswordsIf your user store is SQL Server, store one-way password digests (hash values) withan added random salt value. The added salt value mitigates the risk of brute forcepassword cracking attempts, for example, dictionary attacks. The digest approachmeans you never actually store passwords. Instead, you retrieve the password fromthe user and validate it by recalculating the digest and comparing it with the storedvalue.Use Strong PasswordsUse regular expressions to ensure that user passwords conform to strong passwordguidelines. The following regular expression can be used to ensure that passwordsare between 8 and 10 characters in length and contain a mixture of uppercase,lowercase, numeric, and special characters. This further mitigates the dictionaryattack risk.private bool IsStrongPassword( string password ){return Regex.IsMatch(password, @"^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,10}$");}Prevent SQL InjectionForms authentication is especially prone to vulnerabilities that lead to SQL injectionattacks because of the way that the user-supplied logon credentials are used to querythe database. To mitigate the risk:● Thoroughly validate the supplied credentials. Use regular expressions to makesure they do not include SQL characters.● Use parameterized stored procedures to access the user store database.● Use a login to the database that is restricted and least privileged.