Question

Before I enable access to a new site, what steps should be done to make sure it’s secure and “production ready”?

So far I have the following:

• logging of errors (via ELMAH)
• SSL is enabled, and I have a redirect from HTTP to HTTPS
• <customErrors mode="RemoteOnly" />
• Compiled without Debug

My current tech stack is IIS7 & ASP.Net MVC3.

I’m sure I’m forgetting or not aware of many other items. Any advice?

Answer 1

1. Protect against sql injection. Use stored procedures OR parameterized sql statements. You can use dynamic sql – but be very careful and if you do – make sure you use parameterized queries and do not form the sql statements ‘inline’ by appending variables.

2. Protect against cross site request forgery (CSRF) by making sure you use Html.AntiForgeryToken

3. Make sure tracing is turned off

4. Make sure custom errors is turned on so yellow screens of death (ie error details) ar enot displayed to the client.

5. Protect against cross site scripting by making sure any output you display in your system from your model, database, etc. is encoded by using <%: syntax on your aspx pages and simply @XXXX on your mvc 3 pages, as mvc3 encodes everything BY DEFAULT which is a great enhancement over past methods.

6. Make sure there are no test accounts in your database.

7. Ensure no actions can be performed just by the querystring – for instance passing in /MyApp/DeleteUser/10. Require a post to perform an action, and those posts must use Html.AntiForgeryToken and [ValidateAntiForgeryToken] on your controller

8. Ensure that any users editing information on your page cannot edit (using a tool like fiddler) a primary key hidden on the page thus changing what record they are editing when they post back the changes. You can hash for instance a CustomerId on the page into a hidden field and compare it upon post to make sure it matches what is in the model.

9. Visit me at tech ed in atlanta next month for my security talk : )