Improving Web Application Security: Threats and - CGISecurity

568 Part IV: Securing Your Network, Host, and ApplicationSecure the ChannelTo protect sensitive session state over the network between the Web server andremote state store, secure the channel to the two servers using IPSec or SSL. Thisprovides privacy and integrity for the session state data across the network. If youuse SSL, you must install a server certificate on the database server. For moreinformation about using SSL with SQL Server, see Chapter 18, “Securing YourDatabase Server.”Securing the Out-of-Process State ServiceIf you use mode=StateServer, use the following recommendations to help securesession state:● Use a least privileged account to run the state service● Secure the channel● Consider changing the default port● Encrypt the state connection stringUse a Least Privileged Account to Run the State ServiceThe state service runs by default using the ASPNET local, least privileged account.You should not need to change this configuration.Secure the ChannelIf the state service is located on a remote server, secure the channel to the remote statestore using IPSec to ensure the user state remains private and unaltered.Consider Changing the Default PortThe ASP.NET state service listens on port 42424. To avoid using this default, wellknown port, you can change the port by editing the following registry key:HKLM\SYSTEM\CurrentControlSet\Services\aspnet_state\ParametersThe port number is defined by the Port named value. If you change the port numberin the registry, for example, to 45678, you must also change the connection string onthe element, as follows:stateConnectionString="tcpip=127.0.0.1:45678"