Improving Web Application Security: Threats and - CGISecurity

Chapter 16: Securing Your Web Server 459Additional ConsiderationsBecause IIS processes a Web request first, you could map .NET Framework fileextensions that you do not want clients to call, to the 404.dll directly. This doestwo tasks:● The 404.dll handles and rejects requests before they are passed to ASP.NET andbefore they are processed by the ASP.NET worker process. This eliminatesunnecessary processing by the ASP.NET worker process. Moreover, blockingrequests early is a good security practice.● The 404.dll returns the message “HTTP 404 - File not found” andSystem.Web.HttpForbiddenHandler returns the message “This type of page isnot served.” Arguably, the “File not found” message reveals less information andthus could be considered more secure.Step 13. ISAPI FiltersIn the past, vulnerabilities in ISAPI filters caused significant IIS exploitation. Thereare no unneeded ISAPI filters after a clean IIS installation, although the .NETFramework installs the ASP.NET ISAPI filter (Aspnet_filter.dll), which is loaded intothe IIS process address space (Inetinfo.exe) and is used to support cookie-less sessionstate management.If your applications do not need to support cookie-less session state and they do notset the cookieless attribute to true on the element, this filter can beremoved.During this step, you remove unused ISAPI filters.Remove Unused ISAPI FiltersRemove any unused ISAPI filters as explained in the following section. To view ISAPI filters1. To start IIS, select Internet Services Manager from the Administrative Toolsprograms group.2. Right-click the machine (not Web site, because filters are machine wide), and thenclick Properties.3. Click Edit.