Improving Web Application Security: Threats and - CGISecurity

Checklist: Securing ASP.NET 697Authentication (continued)Check DescriptionThe forms authentication cookie is restricted to HTTPS connections by using the requireSSLattribute or the Secure cookie property.The authentication cookie is encrypted and integrity checked (protection=“All”).Authentication cookies are not persisted.Application cookies have unique path/name combinations.Personalization cookies are separate from authentication cookies.Passwords are not stored directly in the user store; password digests with salt are storedinstead.The impersonation credentials (if using a fixed identity) are encrypted in the configuration fileby using Aspnet_setreg.exe.Strong password policies are implemented for authentication.The element is not used inside element for Forms authentication(use it for testing only).AuthorizationCheck DescriptionURL authorization is used for page and directory access control.File authorization is used with Windows authentication.Principal permission demands are used to secure access to classes and members.Explicit role checks are used if fine-grained authorization is required.Configuration ManagementCheck DescriptionConfiguration file retrieval is blocked by using HttpForbiddenHandler.A least-privileged account is used to run ASP.NET.Custom account credentials (if used) are encrypted on the element byusing Aspnet_setreg.exe.To enforce machine-wide policy, Web.config settings are locked by usingallowOveride=“false” in Machine.config.