Improving Web Application Security: Threats and - CGISecurity

584 Part IV: Securing Your Network, Host, and ApplicationNote ASP.NET does not address packet-level attacks. You must address this by hardening theTCP/IP stack. For more information about configuring the TCP/IP stack, see “How To: Harden theTCP/IP Stack” in the “How To” section of this guide.Web Farm ConsiderationsIf your ASP.NET Web application runs in a Web farm, there is no guarantee thatsuccessive requests from the same client will be serviced by the same Web server.This has implications for:● Session state● Encryption and verification● DPAPISession StateTo avoid server affinity, maintain ASP.NET session state out of process in theASP.NET SQL Server state database or in the out-of-process state service that runs ona remote machine. For more information about securing session state in a remotestate store, see the “Session State” section earlier in this document.Encryption and VerificationThe keys used to encrypt and verify Forms authentication cookies and view statemust be the same across all servers in a Web farm. The AutoGenerate settings on the element must be replaced with common key values.For more information on generating and configuring the keys, see MicrosoftKnowledge Base article 312906, “How To: Create Keys by Using Visual C# .NET forUse in Forms.”DPAPITo encrypt data, developers sometimes use DPAPI. If you use DPAPI with themachine key to store secrets, the encrypted string is specific to a given computer andyou cannot copy the encrypted data across computers in a Web farm or cluster.If you use DPAPI with a user key, you can decrypt the data on any computer with aroaming user profile. However, this is not recommended because the data can bedecrypted by any machine on the network that can execute code using the accountwhich encrypted the data.DPAPI is ideally suited to storing configuration secrets, for example, databaseconnection strings, that live on the Web server. Other encryption techniques shouldbe used when the encrypted data is stored on a remote server, for example, in adatabase. For more information about storing encrypted data in the database, seeChapter 14, “Building Secure Data Access.”