Improving Web Application Security: Threats and - CGISecurity

Chapter 19: Securing Your ASP.NET Application and Web Services 561Partition Your Web SiteSeparate the public and restricted access areas of your Web site. Place yourapplication’s logon page and other pages and resources that should only be accessedby authentication users in a separate folder from the public access areas. Protect therestricted subfolders by configuring them in IIS to require SSL access, and then use elements to restrict access and force a login. For example, thefollowing Web.config configuration allows anyone to access the current directory(this provides public access), but prevents unauthenticated users from accessing therestricted sub folder. Any attempt to do so forces a Forms login.For additional programmatic considerations, such as how to navigate betweenrestricted and non-restricted pages, see “Forms Authentication” in Chapter 10,“Building ASP.NET Web Pages and Controls.”Set Protection=“All”This setting ensures that the Forms authentication cookie is encrypted to provideprivacy and integrity. The keys and algorithms used for cookie encryption arespecified on the element.Encryption and integrity checks prevent cookie tampering, although they do notmitigate the risk of cookie replay attacks if an attacker manages to capture the cookie.Also use SSL to prevent an attacker from capturing the cookie by using networkmonitoring software. Despite SSL, cookies can still be stolen with cross-site scripting(XSS) attacks. The application must take adequate precautions with an appropriateinput validation strategy to mitigate this risk.