Improving Web Application Security: Threats and - CGISecurity

Chapter 19: Securing Your ASP.NET Application and Web Services 569Encrypt the stateConnectionStringEncrypt the stateConnectionString attribute value to hide the IP address and portnumber of your state store. Use the Aspnet_setreg.exe tool. To encrypt the stateConnectionString1. Run the following command from the command prompt.aspnet_setreg -k:Software\YourApp\sessionState -d:{your connection string}This stores the encrypted connection string in the specified registry key andsecures the registry key with a restricted ACL that grants Full Control to System,Administrators, and Creator Owner.2. Reconfigure the element and add the followingstateConnectionString attribute:3. Use Regedt32.exe to create an ACL on the above registry key that grants readaccess to the ASP.NET process account.View StateIf your applications use view state, make sure it is protected with messageauthentication codes (MACs) to ensure it is not modified at the client. View state andMAC protection can be enabled or disabled for all applications on the machine usingthe element in Machine.config.By default, the enableViewStateMac attribute on the element inMachine.config ensures that view state is protected with a MAC.If you use view state, make sure that enableViewStateMac is set to true. The element defines the algorithms used to protect view state.