Improving Web Application Security: Threats and - CGISecurity

696 Improving Web Application Security: Threats and CountermeasuresApplication Categories ConsiderationsInput ValidationCheck DescriptionUser input is validated for type, length, format, and range. Input is checked for known validand safe data and then for malicious, dangerous data.String form field input is validated using regular expressions (for example, by theRegularExpressionValidator control.)Regular HTML controls, query strings, cookies, and other forms of input are validated usingthe Regex class and/or your custom validation code.The RequiredFieldValidator control is used where data must be entered.Range checks in server controls are checked by RangeValidator controls.Free form input is sanitized to clean malicious data.Input file names are well formed and are verifiably valid within the application context.Output that includes input is encoded with HtmlEncode and UrlEncode.MapPath restricts cross-application mapping where appropriate.Character encoding is set by the server (ISO-8859-1 is recommended).The ASP.NET version 1.1 validateRequest option is enabled.URLScan is installed on the Web server.The HttpOnly cookie option is used for defense in depth to help prevent cross-site scripting.(This applies to Internet Explorer 6.1 or later.)SQL parameters are used in data access code to validate length and type of data and tohelp prevent SQL injection.AuthenticationCheck DescriptionSite is partitioned to restricted areas and public areas.Absolute URLs are used for navigation where the site is partitioned with secure and nonsecurefolders.Secure Sockets Layer (SSL) is used to protect credentials and authentication cookies.The slidingExpiration attribute is set to “false” and limited authentication cookie time-outsare used where the cookie is not protected by using SSL.