Improving Web Application Security: Threats and - CGISecurity

566 Part IV: Securing Your Network, Host, and ApplicationFor more information about setting up the SQL Server session state store database,see Microsoft Knowledge Base article 311209, “How To: Configure ASP.NET forPersistent SQL Server Session State Management.”Use Windows Authentication to the DatabaseIf you use mode=“SQLServer”, use Windows authentication to connect to the statedatabase and use a least privileged account, such as a duplicate local ASPNETaccount. This means that you can use a trusted connection, you do not havecredentials in the connection string, and credentials are not passed over the wire tothe database.Encrypt the sqlConnectionStringEncrypt the sqlConnectionString attribute value using the Aspnet_setreg.exe tool.This is particularly important if you use SQL authentication to connect to the statedatabase because of the credentials in the connection string, but it is alsorecommended if you use Windows authentication. To encrypt the sqlConnectionString1. Run the following command from the command prompt.aspnet_setreg -k:Software\YourApp\sessionState -c:{your connection string}This stores the encrypted connection string in the specified registry key andsecures the registry key with a restricted ACL that grants Full Control to System,Administrators, and Creator Owner.2. Reconfigure the element and add the followingsqlConnectionString attribute.3. Use Regedt32.exe to create an ACL on the above registry key that grants readaccess to the ASP.NET process account.Limit the Application’s Login in the DatabaseThe application’s login in the database should be restricted so that it can only be usedto access the necessary state tables and the stored procedures used by ASP.NET toquery the database.