Improving Web Application Security: Threats and - CGISecurity

464 Part IV: Securing Your Network, Host, and ApplicationVerify That ASP.NET Errors Are Not Returned to ClientsYou can use the element to configure custom, generic error messagesthat should be returned to the client in the event of an application exceptioncondition.Make sure that the mode attribute is set to “RemoteOnly” as shown in the followingexample:After installing an ASP.NET application, you can configure the setting to point toyour custom error page as shown in the following example:Verify Session State SettingsIf you do not use session state, verify that session state is disabled in Machine.configas shown in the following example:Also, ensure that the ASP.NET State Service is disabled. The default session statemode is “InProc” and the ASP.NET State Service is set to manual. For moreinformation about securing session state if you install an ASP.NET application thatrequires it, see “Session State,” in Chapter 19, “Securing Your ASP.NET Applicationand Web Services.”Step 17. Code Access SecurityMachine level code access security policy is determined by settings in theSecurity.config file located in the following directory:%windir%\Microsoft.NET\Framework\{version}\CONFIGRun the following command to be sure that code access security is enabled on yourserver:caspol -s OnFor more information about configuring code access security for ASP.NET Webapplications, see Chapter 9, “Using Code Access Security with ASP.NET.”During this step, you:● Remove all permissions for the local intranet zone.●Remove all permissions for the Internet zone.