Improving Web Application Security: Threats and - CGISecurity

632 Part V: Assessing Your Security●●●How do you validate string types?Check that input strings are validated for length and an acceptable set ofcharacters and patterns by using regular expressions. You can use aRegularExpressionValidator validation control or use the RegEx class directly.Do not search for invalid data; only search for the information format you knowis correct.Do you use validation controls?If you use a validation control such as RegularExpressionValidator,RequiredFieldValidator, CompareValidator, RangeValidator, orCustomValidator, check that you have not disabled the server side validation andare not relying purely on client-side validation.Do you rely on client side validation?Do not do this. Use client-side validation only to improve the user experience.Check that all input is validated at the server.Are You Vulnerable to XSS Attacks?Be sure to review your Web pages for XSS vulnerabilities. For more information, see“Cross-Site Scripting (XSS)” earlier in this chapter.Do You Validate Query String and Cookie Input?Check that your code validates input fields passed by URL query strings and inputfields extracted from cookies. To locate vulnerable code search for the following textstrings:● “Request.QueryString”● “Request.Cookies”Check that input is validated for type, range, format, and length using typed objects,and regular expressions as you would for form fields (see the previous section, “DoYou Validate Form Field Input?”). Also consider HTML or URL encoding any outputderived from user input, as this will negate any invalid constructs that could lead toXSS bugs.