Improving Web Application Security: Threats and - CGISecurity

570 Part IV: Securing Your Network, Host, and ApplicationMachine KeyThe element is used to specify encryption keys, validation keys, andalgorithms that are used to protect Forms authentication cookies and page-level viewstate. The following code sample shows the default setting from Machine.config:Consider the following recommendations when you configure the :●●●Use unique encryption keys with multiple applicationsSet validation=“SHA1”Generate keys manually for Web farmsUse Unique Encryption Keys with Multiple ApplicationsIf you host multiple applications on a single Web server, use unique keys for eachapplication on the machine instead of using a single key across all applications. Thiseliminates the likelihood that one application can spoof view state or encryptedForms authentication cookies in hosting environments.Also use the IsolateApps setting. This is a new .NET Framework version 1.1 settingthat instructs ASP.NET to automatically generate encryption keys and to make themunique for each application.Set validation=“SHA1”The validation attribute specifies the algorithm used for integrity-checking, pagelevelview state. Possible values are “SHA1”, “MD5”, and “3DES”.If you used protection=“All” on the element, then the Forms authenticationcookie is encrypted, which also ensures integrity. Regardless of the validationattribute setting, Forms authentication uses TripleDES (3DES) to encrypt the cookie.Note Forms-authentication cookie encryption is independent of the validationkey setting, and thekey is based on the decryptionKey attribute.If you set validation=“SHA1” on the , then page-level view state isintegrity checked using the SHA1 algorithm, assuming that the element isconfigured for view state MACs. For more information, see “View State” earlier inthis chapter.You can also set the validation attribute to MD5. You should use SHA1 because thisproduces a larger hash than MD5 and is therefore considered more secure.