Improving Web Application Security: Threats and - CGISecurity

Checklist: Securing ASP.NET 701Configuration File Settings (continued)Check DescriptionImpersonation identities (if used) are encrypted in the registry by using Aspnet_setreg.exe:Correct format of role names is verified.If multiple ASP.NET Web applications are deployed on the same Web server, the“IsolateApps” setting is used to ensure that a separate key is generated for each Webapplication.If the ASP. NET Web application is running in a Web farm, specific machine keys are used,and these keys are copied across all servers in the farm.If the view state is enabled, the validation attribute is set to “SHA1”.The validation attribute is set to “3DES” if the Forms authentication cookie is to beencrypted for the application.If mode=“StateServer”, then credentials are stored in an encrypted form in the registry byusing Aspnet_setreg.exe.If mode=“SQLServer”, then Windows authentication is used to connect to the state storedatabase and credentials are stored in an encrypted form in the registry by usingAspnet_setreg.exe.Unused file types are mapped to HttpForbiddenHandler to prevent files from being retrievedover HTTP. For example:(continued)