Improving Web Application Security: Threats and - CGISecurity

Chapter 10: Building Secure ASP.NET Pages and Controls 289Session ManagementThere are two main factors that you should consider to provide secure sessionmanagement. First, ensure that the session token cannot be used to gain access tosensitive pages where secure operations are performed or to gain access to sensitiveitems of data. Second, if the session data contains sensitive items, you must secure thesession data, including the session store.The following two types of tokens are associated with session management:●The session token. This token is generated automatically by ASP.NET if sessionstate is enabled, for example, by setting the mode attribute of the element to InProc, SQLServer, or StateServer.Note You can override the configuration and disable or enable session stateon a per-page basis using the EnableSessionState attribute on the @Page tag.●The authentication token. This is generated by authentication mechanisms, suchas Forms authentication, to track an authenticated user’s session. With a validauthentication token, a user can gain access to the restricted parts of your Web site.The following recommendations help you build secure session management:●●●●●Require authentication for sensitive pages.Do not rely on client-side state management options.Do not mix session tokens and authentication tokens.Use SSL effectively.Secure the session data.Require Authentication for Sensitive PagesMake sure that you authenticate users before allowing them access to the sensitiveand restricted parts of your site. If you use secure authentication and protect theauthentication token with SSL, then a user’s session is secure because an attackercannot hijack and replay a session token. The attacker would need the authenticationtoken to get past the authorization gates.For more information about how to secure the authentication token for Formsauthentication, see “Forms Authentication” earlier in this chapter.Do Not Rely on Client-Side State Management OptionsAvoid using any of the client-side state management options, such as view state,cookies, query strings, or hidden form fields, to store sensitive data. The informationcan be tampered with or seen in clear text. Use server-side state management options,for example, a database, to store sensitive data.