Direct Object Reference within an MVC controller

A Direct Object Reference security breach occurs when a user changes an id, usually within a url (or perhaps a hidden field) and suddenly sees information (or performs an action) that he or she is not supposed to be able to do. So a the url had in it “order=1″ and a user changes it to “order=2″ hopefully the website […]

ORM\ERM and hidden fields

Hidden fields can pose a major security risk when used in conjunction with ORM\ERM. An ORM\ERM provides a way to map your classes into a database scheme and usually provides code to retrieve and save the objects. Sometimes the mapping is a simple 1:1 between the class and the database tables behind it or it can […]

ASP.NET (Client\Active) XSS

Below is an example of active\client XSS that I ran into sometime ago. Active\client XSS refers to the situation when the user themselves does something to inject malicious code or html into a website that compromises themselves. You are probably thinking why on earth would they do that. Well below is a good example of how a […]

IIS Retail set to True

One handy deployment tip is to set IIS retail mode to true in the Machine.config: <system.web> <deployment retail=”true”/> </system.web> This will disable tracing output & debug mode and also force custom errors to On. Note if you are trying to debug a problem on webserver using CustomErrors set to remoteonly and it is not working this […]

Accessing Databases from your applications

The best advice really depends on how your infrastructure is configured and how complex your deployment is. Is the code split between web and app servers? Which domains do the machines sit on (web, app, sql) are they all one domain or different domains? As with all things one size does not fit all -however […]

Balancing User experience UX (usability) versus security

When designing a security system for a website, one of the consideration is user experience versus security. For instance displaying the following different error messages often leaks information file not found folder not found server error has occurred username not found email address not found As someone enters different urls then information about your website […]

Uploading and Storing Files Safely on a Website

Letting users upload files into a website is an area that requires careful management. Obviously there is a decision to be made around whether to store the file in a database or on the file system. Also the file should be virus scanned. Note that in business systems users can often upload files like pdf that […]

RequireSSL – Marking Cookies As Secure

If your site always intends to serve its content over HTTPS/SSL then every request that is passes between the browser\webserver will encrypt the cookies. Excellent – no one monitoring or sniffing the traffic can see the cookie value. However even if you intend to always use HTTPS if ANY content is supplied over http (javascript files, images, […]

Mark Cookies as HTTPONLY

Marking your cookies as HTTPONLY will mean that JavaScript code running in most browsers cannot access a user’s cookies. This is important as if a hacker does manage to compromise your site and inject JavaScript it may be possible for the hacker to steal values of cookies (including security cookies). If HTTPONLY is set on the cookies […]