ASP.NET Security Best Practices [closed]

问题:

What are others ASP.NET Security Best Practices?

So far identified are listed here:

• Always generate new encryption keys and admin passwords whenever you are moving an application to production.

• Never store passwords directly or in encrypted form. Always stored one way hashed passwords.

• Always store connection strings in tag of Web.config and encrypt it in configuration section by using protected configuration providers (RSA or DPAPI). See example here

• Use user ID with least-privilege to connect to SQL server or the database you are using. E.g if you are only executing stored procedures from a certain module of application then you must create a user ID which has permissions to execute only.

• Use PrincipalPermission if you want to use role-base security on pages.

  [PrincipalPermission(SecurityAction.Demand, Role="Admin")]  
  public class AdminOnlyPage : BasePageClass  
  {  
    // ...  
  }

• Always use parameters to prevent SQL Injection in the SQL queries.

  1. Consider installing URLScan on your IIS servers to protect against SQL Injection. Also, for protecting against XSS attacks. You can use MSFT's AntiXSS library instead of the built to encode output instead of the built in HtmlEncode found in HttpServerUtility.

• Always keep on customErrors in web config to make you errors/exceptions private

  <customErrors mode="On" defaultRedirect="MyErrorPage.htm" />

• In web applications, always validate the user's inputs for html tags or any scripts.

• Never store sensitive information, like passwords in cookies.

• Don't display system error messages, stack traces etc, in case of exception.

回答1:

I found Microsoft's Developer Highway Code to be a useful security checklist.

回答2:

Microsoft has a lot to say about this subject:

• ASP.NET Web Application Security.
• Improving Web Application Security (an entire book dedicated to the subject)

回答3:

1. Never store sensitive information like passwords in cookies.
2. Don't display system error messages, stack traces etc. in case of exception.

回答4:

Check out the new Security Runtime Engine (beta came out on November 14):

http://blogs.msdn.com/cisg/archive/2008/10/24/a-sneak-peak-at-the-security-runtime-engine.aspx

http://blogs.msdn.com/cisg/archive/2008/11/13/an-update-on-some-upcoming-free-tools.aspx

This should replace the current Anti-XSS library.

Anthony :-) www.codersbarn.com

回答5:

While displaying content from database on the page, you may use HttpServerUtility.HtmlEncode to encode output to avoid Cross site scripting (XSS) attacks.

回答6:

Consider installing URLScan on your IIS servers to protect against SQL Injection.
Also, for protecting against XSS attacks, I would use MSFT's AntiXSS library instead of the built to encode output instead of the built in HtmlEncode found in HttpServerUtility.

回答7:

You could be interested in this article Security Best Practices: ASP.NET Applications. HTH