[Asp.net] security precautions for developing Web Applications

When writing web development, security issues are often ignored.

Let's discuss the security technologies that I usually use when implementing projects.

1. SQL Injection

This is an old topic. However, you may writeProgramThis problem may occur occasionally. Because such injection attacks are potentially more likely in a program as the project grows.

The solution is:

Strictly control user input and strictly control data. This includes user character input, data form verification, and deliberate tampering with parameters.

For example, use the ado.net API. Stored procedures.

2. Cross-Site Scripting

Converts HTML tags submitted by users to htmlencode.

For example, label1.text = server. htmlencode (feedback. Text)

In this way, you can replace a script such as <SCRIPT> </SCRIPT>.

3. _ viewstate

For Asp.net, __viewstate records page data information. The data is encrypted using base64. We need to strictly verify it.

Solution:

Modify web. config:

<Pages buffer = "true" enablesessionstate = "true" enableviewstate = "true" enableviewstatemac = "true" autoeventwireup = "true" validaterequest = "true"> </pages>

And

<Machinekey validationkey = "autogenerate" decryptionkey = "autogenerate, isolateapps" validation = "sha1"/>

4. Verify

Strict authentication of identity and Directory Security.

For example, use Form Verification of Web. config. Strictly control directories, identities, and Operation permissions.

5. handle errors

It is prohibited to return sensitive information such as program content to the user when a program error occurs.

For example, modify <customerrors>

<Customerrors mode = "on" defaultredirect = "error.htm"/>

6. Web Service

Disable useless Web Services. Disable auto-generated WSDL

====================

The above is just a simple setting for the security of a single web application. If you need to configure a sound environment, it involves more and more.

For more information about security configuration, see:

Http://www.microsoft.com/china/technet/security/guidance/secmod92.mspx