Improving Web Application Security: Threats and - CGISecurity

290 Part III: Building Secure Web ApplicationsDo Not Mix Session Tokens and Authentication TokensSecure session management requires that you do not mix the two types of tokens.First, secure the authentication token to make sure an attacker cannot capture it anduse it to gain access to the restricted areas of your application. Second, build yourapplication in such a way that the session token alone cannot be used to gain accessto sensitive pages or data. The session token should be used only for personalizationpurposes or to maintain the user state across multiple HTTP requests. Withoutauthentication, do not maintain sensitive items of the user state.Use SSL EffectivelyIf your site has secure areas and public access areas, you must protect the secureauthenticated areas with SSL. When a user moves back and forth between secure andpublic areas, the ASP.NET-generated session cookie (or URL if you have enabledcookie-less session state) moves with them in plaintext, but the authentication cookieis never passed over unencrypted HTTP connections as long as the Secure cookieproperty is set.Note You can set the Secure property for a Forms authentication cookie by settingrequireSSL="true" on the element.An attacker is able to obtain a session cookie passed over an unencrypted HTTPsession, but if you have designed your site correctly and place restricted pages andresources in a separate and secure directory, the attacker can use it to access only tothe non-secure, public access pages. In this event, there is no security threat becausethese pages do not perform sensitive operations. Once the attacker tries to replay thesession token to a secured page, because there is no authentication token, the attackeris redirected to the application’s login page.For more information about using the Secure cookie property and how to buildsecure Forms authentication solutions, see “Forms Authentication” earlier in thischapter.Secure the Session DataIf the session data on the server contains sensitive items, the data and the store needsto be secured. ASP.NET supports several session state modes. For information abouthow to secure ASP.NET session state, see “Session State” in Chapter 19, “SecuringYour ASP.NET Application and Web Services.”