Improving Web Application Security: Threats and - CGISecurity

700 Improving Web Application Security: Threats and CountermeasuresConfiguration File Settings (continued)Check DescriptionCustom error pages are returned to the client and detailed exception details are preventedfrom being returned by setting mode=“On”.A generic error page is specified by the defaultRedirect attribute.The authentication mode is appropriately configured to support application requirements. Toenforce the use of a specific authentication type, a element withallowOverride=“false” is used.The Web site is partitioned for public and restricted access.The Forms authentication configuration is secure:The authentication cookie is encrypted and integrity checked (protection).SSL is required for authentication cookie (requireSSL).Sliding expiration is set to false if SSL is not used (slidingExpiration).The session lifetime is restricted (timeout).Cookie names and paths are unique (name and path).The element is not used.