Improving Web Application Security: Threats and - CGISecurity

662 Part V: Assessing Your SecurityThe sessionState element configures user session state management for yourapplication. Review the following questions:● Do you use a remote state store?Check the state store by examining the mode attribute.If you use a remote state store and the mode attribute is set to stateServer orSQLServer, check the stateConnectionString and sqlConnectionString attributesrespectively. So that credentials are not included in the database connection string,make sure the connection strings are secured in encrypted format in the registryusing the Aspnet_setreg.exe tool, or that Windows authentication is used toconnect to the SQL Server state store.The following configuration shows what the stateConnectionString looks likewhen Aspnet_setreg.exe has been used to encrypt the string in the registry.●Do you use Windows authentication to the state database?If you use the SQL Server state store, check to see if you use Windowsauthentication to connect to the state database. This means that credentials are notstored in the connection string and that credentials are not transmitted over thewire.If you must use SQL authentication, make sure the connection string is encryptedin the registry and that a server certificate is installed on the database server toensure that credentials are encrypted over the wire.This element lists the HTTP handlers that process requests for specific file types.Check to ensure that you have disabled all unused file types.Map unused file types to System.Web.HttpForbiddenHandler to prevent their HTTPretrieval. For example, if your application does not use Web services, map the .asmxextension as follows: