Improving Web Application Security: Threats and - CGISecurity

698 Improving Web Application Security: Threats and CountermeasuresSensitive DataCheck DescriptionSSL is used to protect sensitive data on the wire.Sensitive data is not passed across pages; it is maintained using server-side statemanagement.Sensitive data is not stored in cookies, hidden form fields, or query strings.Do not cache sensitive data. Output caching is off by default.Plain text passwords are avoided in Web.config and Machine.config files. (Aspnet_setreg.exeis used to encrypt credentials.)Session ManagementCheck DescriptionThe session cookie is protected using SSL on all pages that require authenticated access.The session state service is disabled if not used.The session state service (if used) runs using a least-privileged account.Windows authentication is used to connect to Microsoft®SQL Server state database.Access to state data in the SQL Server is restricted.Connection strings are encrypted by using Aspnet_setreg.exe.The communication channel to state store is encrypted (IPSec or SSL).Parameter ManipulationCheck DescriptionView state is protected using message authentication codes (MACs).Query strings with server secrets are hashed.All input parameters are validated.Page.ViewStateUserKey is used to counter one-click attacks.