Improving Web Application Security: Threats and - CGISecurity

Chapter 10: Building Secure ASP.NET Pages and Controls 291Parameter ManipulationParameters, such as those found in form fields, query strings, view state, and cookies,can be manipulated by attackers who usually intend to gain access to restricted pagesor trick the application into performing an unauthorized operation.For example, if an attacker knows that you are using a weak authentication tokenscheme such as a guessable number within a cookie, the attacker can construct acookie with another number and make a request as a different (possibly privileged)user.The following recommendations help you avoid parameter manipulationvulnerabilities:● Protect view state with MACs.●●●Use Page.ViewStateUserKey to counter one-click attacks.Maintain sensitive data on the server.Validate input parameters.Protect View State with MACsIf your Web pages or controls use view state to maintain state across HTTP requests,ensure that the view state is encrypted and integrity checked through the use ofMACs. By default, the enableViewStateMac attribute on the element inMachine.config ensures that view state is protected with a MAC.Note The @Page directive also supports the preceding attributes, which allows you to customizesettings on a per-page basis.While you can override whether or not view state is enabled on a per-control, page,or application basis, make sure enableViewStateMac is set to true whenever you useview state.Server.TransferIf your application uses Server.Transfer as shown below and sets the optional secondBoolean parameter to true so that the QueryString and Form collections arepreserved, then the command will fail if enableViewStateMac is set to true.Server.Transfer("page2.aspx", true);