ASP.NET 2.0 Security Guidelines

From Guidance Share

- J.D. Meier, Alex Mackman, Blaine Wastell, Prashant Bansode, Andy Wigley, Kishore Gopalan

Contents 1 Auditing and Logging 2 Authorization 3 Code Access Security 4 Communication Security 5 Input/Data Validation 6 Data Access 7 Exception Management 8 Forms Authentication 9 Impersonation/Delegation 10 Parameter Manipulation 11 Sensitive Data 12 Session Management 13 Windows Authentication 14 Deployment Considerations

Auditing and Logging

• Use health monitoring to log and audit events
• Instrument for user management events
• Instrument for unusual activity
• Instrument for significant business operations
• Consider using an application-specific event source
• Protect audit and log files

Authorization

• Use URL authorization for page and directory access control
• Configure ACLs on your Web site files
• Use ASP.NET role manager for roles authorization
• If your role lookup is expensive, consider role caching
• Protect your authorization cookie

Code Access Security

• Consider code access security for partial trust applications
• Choose a trust level that does not exceed your application's requirements
• Create a custom trust policy if your application needs additional permissions
• Use Medium trust in shared hosting environments

Communication Security

• Consider SSL vs. IPSec
• Optimize pages that use SSL

Input/Data Validation

• Do not rely on ASP.NET request validation
• Validate input for length, range, format, and type
• Validate input from all sources like QueryString, cookies, and HTML controls
• Do not rely on client-side validation
• Avoid user-supplied file name and path input
• Do not echo untrusted input
• If you need to write out untrusted data, encode the output

Data Access

• Encrypt your connection strings
• Use least-privileged accounts for database access
• Use Windows authentication where possible
• If you use Windows authentication, use a trusted service account
• If you cannot use a domain account, consider mirrored accounts
• When using SQL authentication, use strong passwords
• When using SQL authentication, protect credentials over the network
• When using SQL authentication, protect credentials in configuration files
• Validate untrusted input passed to your data access methods
• When constructing SQL queries, use type safe SQL parameters
• Avoid dynamic queries that accept user input

Exception Management

• Use structured exception handling
• Do not reveal exception details to the client
• Use a global error handler to catch unhandled exceptions

Forms Authentication

• Use membership providers instead of custom authentication
• Use SSL to protect credentials and authentication cookies
• If you cannot use SSL, consider reducing session lifetime
• Validate user login information
• Do not store passwords directly in the user store
• Enforce strong passwords
• Protect access to your credential store
• Do not persist authentication cookies
• Restrict authentication tickets to HTTPS connections
• Consider partitioning your site to restricted areas and public areas
• Use unique cookie names and paths

Impersonation/Delegation

• Know your tradeoffs with impersonation
• Avoid Calling LogonUser
• Avoid programmatic impersonation where possible
• If you need to impersonate, consider threading issues
• If you need to impersonate, clean up appropriately
• Avoid losing impersonation tokens

Parameter Manipulation

• Do not make security decisions based on parameters accessible on the client-side
• Validate all input parameters
• Avoid storing sensitive data in ViewState
• Encrypt ViewState if it must contain sensitive data

Sensitive Data

• Avoid plaintext passwords in configuration files
• Use platform features to manage keys where possible
• Do not pass sensitive data from page to page
• Protect sensitive data over the wire
• Do not cache sensitive data

Session Management

• Do not rely on client-side state management options
• Protect your out-of-process state service
• Protect SQL Server session state

Windows Authentication

• Choose Windows authentication when you can
• Enforce strong password policies

Deployment Considerations

• Use a least-privileged account for running ASP.NET applications
• Encrypt configuration sections that store sensitive data
• Consider your key storage location
• Block Protected File Retrieval by Using HttpForbiddenHandler
• Configure the MachineKey to use the same keys on all servers in a Web farm
• Lock configuration settings to enforce policy settings