Beginning ASP.NET Security

Beginning ASP.NET Security......Page 1
Contents......Page 15
ACKNOWLEDGMENTS......Page 13
INTRODUCTION......Page 23
CHAPTER 1: WHY WEB SECURITY MATTERS......Page 29
Ana Tomy of an Attack......Page 30
Risks and Rewards......Page 33
Building Security from the Ground Up......Page 34
Use Least Privilege......Page 36
Security Should Be Your Default State......Page 37
The OWASP Top Ten......Page 38
Checklists......Page 40
PART I: THE ASP.NET SECURITY BASICS......Page 41
Examining HTTP......Page 43
Requesting a Resource......Page 44
Responding to a Request......Page 46
Sniffing HTTP Requests and Responses......Page 47
Understanding HTML Forms......Page 50
Understanding How ASP.NET Events Work......Page 58
Writing HTTP Modules......Page 62
Summary......Page 65
Defining Input......Page 67
Echoing User Input Safely......Page 69
Mitigating Against XSS......Page 73
The Microsoft Anti-XSS Library......Page 75
The Security Run-time Engine......Page 76
Constraining Input......Page 78
Protecting Cookies......Page 80
Validating Form Input......Page 81
Validation Controls......Page 83
Standard ASP.NET Validation Controls......Page 85
Using the RangeValidator......Page 86
Using the CompareValidator......Page 87
Using the CustomValidator......Page 88
Validation Groups......Page 89
A Checklist for Handling Input......Page 91
Using the Right Input Type......Page 93
Query Strings......Page 94
Form Fields......Page 96
Request Forgery and How to Avoid It......Page 97
Mitigating Against CSRF......Page 99
Protecting ASP.NET Events......Page 109
Avoiding Mistakes with Browser Information......Page 111
A Checklist for Query Strings, Forms, Events, and Browser Information......Page 113
Controlling Viewstate......Page 115
Validating ViewState......Page 117
Encrypting ViewState......Page 119
Protecting Against ViewState One-Click Attacks......Page 120
Disabling Browser Caching......Page 122
Error Handling and Logging......Page 123
Improving Your Error Handling......Page 125
Watching for Special Exceptions......Page 126
Using the Windows Event Log......Page 127
Using Email to Log Events......Page 128
Using ASP.NET Tracing......Page 130
Using Performance Counters......Page 132
Using WMI Eve......Page 135
Another Alternative: Logging Frameworks......Page 136
Limiting Search Engines......Page 140
Controlling Robots with robots.txt......Page 141
Protecting Passwords in Config Files......Page 142
A Checklist for Query Strings, Forms, Events, and Browser Information......Page 144
CHAPTER 6: KEEPING SECRETS SECRET – HASHING AND ENCRYPTION......Page 145
Protecting Integrity with Hashing......Page 146
Choosing a Hashing Algorithm......Page 147
Protecting Passwords with Hashing......Page 148
Generating Secure Random Numbers......Page 149
Understanding Symmetric Encryption......Page 152
Protecting Data with Symmetric Encryption......Page 153
Sharing Secrets with Asymmetric Encryption Plain......Page 161
Using Asymmetric Encryption without Certificates......Page 162
Getting a Certificate......Page 164
Using the Windows DPAPI......Page 175
A Checklist for Encryption......Page 176
PART II: SECURING COMMON ASP.NET TASKS......Page 177
CHAPTER 7: ADDING USERNAMES AND PASSWORDS......Page 179
Discovering Your Own Identity......Page 180
Configuring Forms Authentication......Page 182
Using SQL as a Membership Store......Page 186
Creating Users......Page 188
Examining How Users Are Stored......Page 191
Configuring the Membership Settings......Page 192
Creating Users Programmatically......Page 194
Windows Authentication......Page 195
Configuring IIS for Windows Authentication......Page 196
Impersonation with Windows Authentication......Page 199
Authorization in ASP.NET......Page 200
Examining  and ......Page 201
Configuring Roles with Forms-Based Authentication......Page 202
Using the Configuration Tools to Manage Roles......Page 204
Managing Roles Programmatically......Page 205
Roles with Windows Authentication......Page 207
Limiting Access to Files and Folders......Page 208
Securing Object References......Page 211
A Checklist for Authentication and Authorization......Page 212
CHAPTER 8: SECURELY ACCESSING DATABASES......Page 213
Writing Bad Code: Demonstrating SQL Injection......Page 214
Fixing the Vulnerability......Page 218
Connecting Without Passwords......Page 222
SQL Permissions......Page 224
Groups and Roles......Page 225
Using Views......Page 226
Dynamic SQL Stored Procedures......Page 228
Using SQL Encryption......Page 229
SQL Symmetric Encryption......Page 230
SQL Asymmetric Encryption......Page 232
A Checklist for Securely Accessing Databases......Page 233
Accessing Existing Files Safely......Page 235
Making Static Files Secure......Page 241
Checking That Your Application Can Access Files......Page 243
Adding Role Checks......Page 244
Anti-Leeching Checks......Page 245
Creating Files Safely......Page 246
Handling User Uploads......Page 248
Using the File Upload Control......Page 249
A Checklist for Securely Accessing Files......Page 252
Validating XML......Page 253
Valid XML......Page 254
XML Parsers......Page 255
Querying XML......Page 262
Avoiding XPath Injection......Page 264
Securing XML Documents......Page 265
Using a Symmetric Encryption Key with XML......Page 266
Using an Asymmetric Key Pair to Encrypt and Decrypt XML......Page 270
Using an X509 Certificate to Encrypt and Decrypt XML......Page 273
Signing XML Documents......Page 274
A Checklist for XML......Page 280
PART III: ADVANCED ASP.NET SCENARIOS......Page 281
CHAPTER 11: SHARING DATA WITH WINDOWS COMMUNICATION FOUNDATION......Page 283
Creating and Consuming WCF Services......Page 284
Transport Security......Page 287
Message Security......Page 288
Selecting the Security Mode......Page 289
Choosing the Client Credentials......Page 290
Adding Security to an Internet Service......Page 291
Signing Messages with WCF......Page 302
Logging and Auditing in WCF......Page 305
Validating Parameters Using Inspectors......Page 308
Using Message Inspectors......Page 311
Throwing Errors in WCF......Page 314
A Checklist for Securing WCF......Page 315
CHAPTER 12: SECURING RICH INTERNET APPLICATIONS......Page 317
Security in Ajax Applications......Page 318
The XMLHttpRequest Object......Page 319
The Ajax Same Origin Policy......Page 320
Examining the UpdatePanel......Page 321
Examining the ScriptManager......Page 324
Security Considerations with UpdatePanel and ScriptManager......Page 327
Understanding the CoreCLR Security Model......Page 329
Using the HTML Bridge......Page 330
Controlling Access to the HTML DOM......Page 331
Exposing Silverlight Classes and Members to the DOM......Page 332
Accessing the Local File System......Page 334
Using Cryptography in Silverlight......Page 337
Accessing the Web and Web Services with Silverlight......Page 340
Using ASP.NET Authentication and Authorization in Ajax and Silverlight......Page 341
A Checklist for Securing Ajax and Silverlight......Page 342
CHAPTER 13: UNDERSTANDING CODE ACCESS SECURITY......Page 343
Understanding Code Access Security......Page 344
Using ASP.NET Trust Levels......Page 346
Demanding Minimum CAS Permissions......Page 347
Asking and Checking for CAS Permissions......Page 348
Testing Your Application Under a New Trust Level......Page 349
Using the Global Assembly Cache to Run Code Under Full Trust......Page 352
.NET 4 Changes for Trust and ASP.NET......Page 355
A Checklist for Code not Under Full Trust......Page 356
CHAPTER 14: SECURING INTERNET INFORMATION SERVER (IIS)......Page 357
Installing and Confi guring IIS7......Page 358
IIS Role Services......Page 359
Creating and Configuring Application Pools......Page 363
Configuring Trust Levels in IIS......Page 365
Locking Trust Levels......Page 366
Creating Custom Trust Levels......Page 367
Filtering Requests......Page 368
Filtering Requests Based on File Extension\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0......Page 369
Filtering Requests Based on HTTP Verbs......Page 370
Filtering Requests Based on a Request Header\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0......Page 371
Using Log Parser to Mine IIS Log Files......Page 372
USing Certificates......Page 379
Requesting an SSL Certificate......Page 380
Setting up a Test Certification Authority......Page 382
A Checklist for Securing Internet Information Server (IIS)......Page 385
A Brief History of Federated Identity\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0......Page 387
Using the Windows Identity Foundation to accept SAML and Information Cards......Page 390
Creating a “ Claims - Aware ” Web Site......Page 391
Accepting Information Cards......Page 393
Working with a Claims Identity......Page 401
Using OpenID with Your Web Site......Page 402
Using Windows Live ID with Your Web Site......Page 407
A Strategy for Integrating Third-Party Authentication with Forms Authentication......Page 410
Summary......Page 411
CHAPTER 16: SECURE DEVELOPMENT WITH THE ASP.NET MVC FRAMEWORK......Page 413
Protecting Yourself Against XSS......Page 414
Securing Model Binding......Page 415
Providing Validation for and Error Messages from Your Model......Page 417
Authorizing Actions and Controllers......Page 420
Discovering the Current User......Page 421
Customizing Authorization with an Authorization Filter......Page 422
Error Handling with ASP.NET MVC......Page 423
A Checklist for Secure Development with the ASP.NET MVC Framework......Page 426
INDEX......Page 427