Improving Web Application Security: Threats and - CGISecurity

714 Improving Web Application Security: Threats and CountermeasuresAuthenticationCheck DescriptionAnonymous authentication is disabled in IIS.ASP.NET is configured for Windows authentication.Client credentials are configured at the client through the proxy object.Authentication connection sharing is used to improve performance.Clients are forced to authenticate on each call (unsafeAuthenticatedConnectionSharing isset to “false”).connectionGroupName is specified to prevent unwanted reuse of authenticationconnections.Plain text credentials are not passed over the network.IPrincipal objects passed from the client are not trusted.AuthorizationCheck DescriptionIPSec is used for machine-level access control.File authorization is enabled for user access control.Users are authorized with principal-based role checks.Where appropriate, access to remote resources is restricted by settingrejectRemoteRequest attribute to “true”.Configuration ManagementCheck DescriptionConfiguration files are locked down and secured for both the client and the server.Generic error messages are sent to the client by setting the mode attribute of the element to “On”.