Improving Web Application Security: Threats and - CGISecurity

462 Part IV: Securing Your Network, Host, and ApplicationStep 16. Machine.ConfigThis section covers hardening information about machine level settings that apply toall applications. For application specific hardening settings, see Chapter 19, “SecuringYour ASP.NET Application.”The Machine.config file maintains numerous machine wide settings for the .NETFramework, many of which affect security. Machine.config is located in the followingdirectory:%windir%\Microsoft.NET\Framework\{version}\CONFIGNote You can use any text or XML editor (Notepad, for example) to edit XML configuration files.XML tags are case sensitive, so be sure to use the correct case.During this step, you:● Map protected resources to HttpForbiddenHandler.●●●●Verify that tracing.is disabled.Verify that debug compiles are disabled.Verify that ASP.NET errors are not returned to the client.Verify session state settings.Map Protected Resources to HttpForbiddenHandlerHTTP handlers are located in Machine.config beneath the element. HTTP handlers are responsible for processing Web requests for specificfile extensions. Remoting should not be enabled on front-end Web servers; enableremoting only on middle-tier application servers that are isolated from the Internet.● The following file extensions are mapped in Machine.config to HTTP handlers:●●●●.aspx is used for ASP.NET pages.rem and .soap are used for Remoting..asmx is used for Web Services..asax, .ascx, .config, .cs, .csproj, .vb, .vbproj, .webinfo, .asp, .licx,.resx, and .resources are protected resources and are mapped toSystem.Web.HttpForbiddenHandler.For .NET Framework resources, if you do not use a file extension, then map theextension to System.Web.HttpForbiddenHandler in Machine.config, as shown in thefollowing example: