StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POASP.NET MVC Security checklist
text
Body
copied!<p>There are tons of good papers about designing and developing for security (and even a bunch of posts on SO), but all of them seem to concentrate on <strong>what</strong> you should do. </p> <p>What I'm after, however, is a think-like-a-hacker checklist. A list of simple actions you should to go through once you're done with development, to make sure the solution is secure. </p> <p><strong><em>(UPDATE: I'm mostly interested in a blackbox checklist - "go to a page, try this and that" kind of things, but a whitebox checklist might be of interest as well.)</em></strong></p> <hr> <p>Here's something I've come up with so far:</p> <h2>Security Blackbox Checklist</h2> <ul> <li>Submit incorrect/malicious data (<strong>examples here?</strong>) to make sure that input is validated for type, length, format and range by javascript.</li> <li>Turn off client-side validation and repeat the step above, to make sure that <ul> <li>you don't only check with javascript but validate on the server side as well</li> <li>input is validated on the server for type, length, format, and range</li> <li>free form input is sanitized</li> <li>output that includes input is encoded with <code>HtmlEncode</code> and <code>UrlEncode</code></li> </ul></li> <li>Insert extremely large amount of data in the query string as per <code>http://www.example.com/foo?bar=HugeAmountOfData</code> to make sure you constrain inputs and do boundary checks.</li> <li>Visit a POST action via GET, to make sure that "form submit" actions are restricted to be POST-only.</li> <li>If applicable, upload a file of incorrect size/format (huge file, empty file, executable with renamed extension, etc) to make sure uploads are handled gracefully.</li> <li>(how to check from UI?) ensure that absolute URLs are used for navigation.</li> <li>Access the URL as a user without correct permissions, to make sure permissions are explicitly tested via action/controller attributes.</li> <li>Access the URL providing non-existing details (like non-existing product ids, items you don't have access to, etc) to make sure a correct error (404 or 403 etc) is returned.</li> <li>Access the sensitive page via HTTP, to make sure it's available via HTTPS only.</li> </ul> <h2>Security Whitebox Checklist</h2> <p><em>Web tier.</em></p> <ul> <li>In debug mode, break the code so that it throws an exception, to make sure it fails securely. Make sure you catch exceptions and log detailed messages but do not leak information to the client.</li> <li>If applicable, make sure MVC actions, are restricted on POST/GET only, particular user role, <strong>anything else?</strong>.</li> <li>Make sure POST actions are accompanied with <code>[ValidateAntiForgeryToken]</code> attribute to prevent Cross-Site Request Forgery attacks. </li> <li>Make sure <code>Response.Write</code> (either directly or indirectly) is never used to display user input.</li> <li>Make sure sensitive data is not passed in query strings or form fields.</li> <li>Make sure your security decisions do not rely on HTTP headers info.</li> </ul> <p><em>Service tier.</em></p> <ul> <li>In debug mode, break the code so that it throws an exception, to make sure it fails securely. Make sure you catch exceptions and log detailed messages but do not leak information to the client.</li> <li>Ensure that if updating anything in the database you operate within a transaction.</li> </ul> <p><em>Database tier.</em></p> <ul> <li>Ensure that retrieval stored procs don't use <code>SELECT *</code> but always specify the list of columns explicitly.</li> <li>Ensure that update/delete stored procs operate within a transaction (via <code>@@TRANCOUNT</code>, etc) and explicitly commit/rollback it.</li> </ul> <hr> <p>Comments? Corrections? Missing steps? </p> <p>Making it a community wiki, feel free to edit as much as you like.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload