Improving Web Application Security: Threats and - CGISecurity

658 Part V: Assessing Your SecurityThe element controls default page level configuration settings. From asecurity perspective, review the view state and session state settings.● Do you use view state?If enableViewState is set to true, make sure that enableViewStateMac is also setto true to protect the view state over the network. Also make sure that you reviewthe configuration because this specifies the encryption andhashing algorithms to use together with the associated keys.● Do you use session state?If enableSessionState is set to true, make sure you review the element configuration.Make sure that the mode attribute is set to On to ensure that detailed exceptioninformation is not disclosed to the client. Also check that a default error page isspecified via the defaultRedirect attribute.This element governs your application’s authentication mechanism. Check the modeattribute to see which authentication mechanism is configured and then use thespecific review questions for your configured authentication mode.Forms AuthenticationReview the following questions to verify your Forms authentication configuration.●Do you encrypt the authentication cookie?Cookies should be encrypted and checked for integrity to detect tampering evenover an SSL channel because cookies can be stolen through cross-site scripting(XSS) attacks. Check that the protection attribute of the element is setto All.All indicates encryption and verification