Improving Web Application Security: Threats and - CGISecurity

292 Part III: Building Secure Web ApplicationsIf you omit the second parameter or set it to false, then an error will not occur. If youwant to preserve the QueryString and Form collections instead of setting theenableViewStateMac to false, follow the workaround discussed in MicrosoftKnowledge Base article 316920, “PRB: View State Is Invalid” Error Message WhenYou Use Server.Transfer.”For information about configuring the element for view stateencryption and integrity checks, see Chapter 19, “Securing Your ASP.NETApplication and Web Services.”Use Page.ViewStateUserKey to Counter One-Click AttacksIf you authenticate your callers and use view state, set the Page.ViewStateUserKeyproperty in the Page_Init event handler to prevent one-click attacks. A one-clickattack occurs when an attacker creates a prefilled Web page (.htm or .aspx) with viewstate. The view state can be generated from a page that the attacker had previouslycreated, for example, a shopping cart page with 100 items. The attacker lures anunsuspecting user into browsing to the page, then causes the page to be sent to theserver where the view state is valid. The server has no way of knowing that the viewstate originated from the attacker. View state validation and MACs do not counterthis attack because the view state is valid and the page is executed under the securitycontext of the user.Set the Page.ViewStateUserKey property to a suitably unique value as acountermeasure to the one-click attack. The value should be unique to each user andis typically a user name or identifier. When the attacker creates the view state, theViewStateUserKey property is initialized to his or her name. When the user submitsthe page to the server, it is initialized with the attacker’s name. As a result, the viewstate MAC check fails and an exception condition is generated.Note This attack is usually not an issue for anonymously browsed pages (where no user name isavailable) because this type of page should make no sensitive transactions.Maintain Sensitive Data on the ServerDo not trust input parameters, especially when they are used to make securitydecisions at the server. Also, do not use clear text parameters for any form of sensitivedata. Instead, store sensitive data on the server in a session store and use a sessiontoken to reference the items in the store. Make sure that the user is authenticatedsecurely and that the authentication token is secured properly. For more information,see “Session Management” earlier in this chapter.