Forms authentication security - Advise needed.

[DaveB]

Client co want to put in a forms driven authentication system for web access to an SQL database. I'm not coding it but have been asked for direction in terms of security measures to be taken into account. For various reasons this is the way they want to do it. This is a little outside my area of technical expertise but what I've got so far in term of security considerations for the devs is:

• Constrain input to valid ranges.
• Encode unsafe output.
• Use command parameters or stored procedures for SQL queries.
• Do not return ASP errors.
• Use HTTP Request Validation
• Use HTML Encoding
• Use ViewStateUserkey with the SessionID.

Any one see anything I've missed?

[TheFaQQer]

Client co want to put in a forms driven authentication system for web access to an SQL database. I'm not coding it but have been asked for direction in terms of security measures to be taken into account. For various reasons this is the way they want to do it. This is a little outside my area of technical expertise but what I've got so far in term of security considerations for the devs is:

• Constrain input to valid ranges.
• Encode unsafe output.
• Use command parameters or stored procedures for SQL queries.
• Do not return ASP errors.
• Use HTTP Request Validation
• Use HTML Encoding
• Use ViewStateUserkey with the SessionID.

Any one see anything I've missed?

Bind variables to avoid SQL injection

[eek]

Based on the tulip penetration results we got a while back

don't use an identity key or sequence for identifying users. You should use a guid of some form.

ensure that all cookies are sent with secure and httpOnly flags. Of course the secure flag is only useful if the entire site uses HTTPS.

Have a single consistent error message for all login failure errors.

Check session variables against the ip address of the request.

and my favourite one.

Session ids are consistent during the entirety of the user's visit. Can you do something about it? We ignored this one.

[lightng]

Ensure SQL server account used by the app has just enough access to do what you want.

Audit OS account policy on the web / DB servers.

Avoid plain text DB passwords in configuration files. Encrypt / embed or both. Ensure that a casual browser does not have read access to any config files you do have.

Try to hide anything which gives away the operating system/web server/platform you are using to the user.

Ensure you are fully patched up. OS / DB / Web server etc. If using a secure transport protocol, ensure it is the latest version and disable lesser versions.

Look at login and password policies. Enforce strong passwords, consider using memorable word fragments, lock out accounts not used in a specified time frame, consider lockout policy, record login events etc.

Remove any timestamp information from responses. Could be used to work out pseudo random number generation schemes.