لطفا منتظر باشید ...
Coding Standards Fast Track
Maintaining State
Designing a Secure Token
Where possible, use extra measures to bind the token to the client session.
Always transmit authentication credentials using SSL or IPSec.
Always use a sufficiently large keyspace (at least 120 bits) for session tokens.
Always use a strong random-number generator for session tokens.
Never accept new tokens submitted by a client.
Never include visible plaintext user identifiers in the token.
Always limit the token’s scope to the current application.
Use both relative and absolute timeouts for tokens.
Take measures to prevent the client from storing the session token after the session ends.
Allow users to manually terminate a session.
Always issue a new token with each session login.
Selecting a Token Mechanism
Avoid using URL-based token mechanisms.
Use cookie-based tokens whenever possible.
Use HttpOnly tokens with Internet Explorer clients.
Use SSL whenever possible to protect session tokens.
Using State Providers
Disable the ASP.NET State Service if you are not using it.
Use aspnet_setreg.exe to encrypt the state connection string.
Avoid using cookieless tokens.
Set short cookie timeouts as appropriate for your application.
Using ASP.NET Tokens
Using Cookies
Always set a specific domain and path on all cookies.
Always check the domain and path on incoming cookies to block cookies with the incorrect scope.
Do not set an expiration on cookies to have them expire when the browser closes.
If using persistent cookies, use a short expiration date.
If using SSL, mark cookies as secure to prevent transmitting them over non-SSL connections.
Never store sensitive information in a cookie, and always encrypt what you do store.
Working with View State
Disable View State on all pages where you do not specifically use it.
Wherever you enable View State, also enable the View State MAC.
Set the validation attribute of the machineKey element in machine.config to 3DES.
Set a unique View State user key for each user.
Enhancing ASP.NET State Management
Creating Tokens
Always use a strong random-number generator for session tokens.
Use a MAC based on a random number to ensure the authenticity of the session token.
Use the IsolateApps settings to ensure unique keys between applications.
Use client variables to tightly bind to the client session.
Terminating Sessions
Use absolute timeouts in addition to idle timeouts to enforce a maximum token age.
Use hit counters to limit the use of any one token.
