Improving Web Application Security: Threats and - CGISecurity

630 Part V: Assessing Your SecurityASP.NET Pages and ControlsUse the review questions in this section to review your ASP.NET pages and controls.For more information about the issues raised in this section, see Chapter 10,“Building Secure ASP.NET Pages and Controls.”● Do you disable detailed error messages?● Do you disable tracing?● Do you validate form field input?● Are you vulnerable to XSS attacks?● Do you validate query string and cookie input?● Do you rely on HTTP headers for security?● Do you secure view state?● Do you prevent XSS?● Are your global.asax event handlers secure?● Do you provide adequate authorization?Do You Disable Detailed Error Messages?If you let an exception propagate beyond the application boundary, ASP.NET canreturn detailed information to the caller. This includes full stack traces and otherinformation that is useful to an attacker. Check the element andensure that the mode attribute is set to “On” or “RemoteOnly”.Do You Disable Tracing?Trace information is also extremely useful to attackers. Check the element toensure that tracing is disabled.