Improving Web Application Security: Threats and - CGISecurity

Chapter 21: Code Review 613Check the HttpOnly Cookie OptionInternet Explorer 6 SP 1 supports a new HttpOnly cookie attribute that preventsclient-side script from accessing the cookie from the document.cookie property.Instead, an empty string is returned. The cookie is still sent to the server wheneverthe user browses to a Web site in the current domain. For more information, see the“Cross-Site Scripting” section in Chapter 10, “Building Secure ASP.NET Pages andControls.”Check the Security AttributeInternet Explorer 6 and later supports a new security attribute on the and elements. You can use the security attribute to apply the user’s RestrictedSites Internet Explorer security zone settings to an individual frame or iframe. Formore information, see the “Cross-Site Scripting” section in Chapter 10, “BuildingSecure ASP.NET Pages and Controls.”Check the Use of the innerText and innerHTML PropertiesIf you create a page with untrusted input, verify that you use the innerText propertyinstead of innerHTML. The innerText property renders content safe and ensures thatscript is not executed.More InformationFor more information about XSS, see the following articles:● “CSS Quick Start: What Customers Can Do to Protect Themselves from Cross-SiteScripting,” at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/news/crsstQS.asp●●●●“CSS Overview,” at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/news/csoverv.asp.Microsoft Knowledge Base article 252985, “How To: Prevent Cross-Site ScriptingSecurity Issues““CERT Advisory CA-2000-02, Malicious HTML Tags Embedded in ClientWeb Requests,” on the CERT/CC Web site at http://www.cert.org/advisories/CA-2000-02.html“Understanding Malicious Content Mitigation for Web Developers,” on theCERT/CC Web site at http://www.cert.org/tech_tips/malicious_code_mitigation.html/