zydronium/websitepanel
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

As are result of security penetration test the following changes applied:

Browse source 
All authentication related cookies tagged as httpOnly
web.config: enabledVersionHeader=false
autocomplete disabled
Login url injection redirection fixed
session hijacking implemented

Dont forget to apply ssl to your website with https and to set the requireSSL="false" to true
This commit is contained in:
robvde 2012-06-21 19:39:58 +04:00
parent 6794315198
commit 38592df9e6
8 changed files with 397 additions and 121 deletions
Download patch file Download diff file Expand all files Collapse all files

3
WebsitePanel/Sources/WebsitePanel.WebPortal/Code/PortalUtils.cs
View file

@ -268,6 +268,7 @@ namespace WebsitePanel.Portal
authCookie.Secure = FormsAuthentication.RequireSSL;
authCookie.Path = FormsAuthentication.FormsCookiePath;
authCookie.Value = FormsAuthentication.Encrypt(ticket);
authCookie.HttpOnly = true;
if (persistent)
authCookie.Expires = DateTime.Now.AddMonths(1);
@ -500,6 +501,8 @@ namespace WebsitePanel.Portal
// store last successful username in the cookie
HttpCookie cookie = new HttpCookie("WebsitePanelLogin", username);
cookie.Expires = DateTime.Now.AddDays(7);
cookie.Secure = FormsAuthentication.RequireSSL;
cookie.HttpOnly = true;
HttpContext.Current.Response.Cookies.Add(cookie);
// set language