Improving Web Application Security: Threats and - CGISecurity

Chapter 22: Deployment Review 657Machine.ConfigThe .NET Framework configuration for all applications on your server is maintainedin Machine.config. For the purposes of the security review, this section examines thesettings in Machine.config from top to bottom and considers only those settings thatrelate to security.The majority of security settings are contained beneath the element,with the notable exception of Web service configuration and .NET Remotingconfiguration. The review process for Web services and .NET Remoting configurationis presented later in this chapter.For more information and background about the issues raised by the followingreview questions, see Chapter 19, “Securing Your ASP.NET Application and WebServices.” The following elements are reviewed in this section:●●●●●●●●●●●●●Make sure tracing is disabled with the following setting.Verify the value of the maxRequestLength attribute on the element.You can use this value to prevent users from uploading very large files. Themaximum allowed value is 4 MB.Check that you do not compile debug binaries. Make sure the debug attribute is setto false.