zydronium/websitepanel
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

As are result of security penetration test the following changes applied:

Browse source 
All authentication related cookies tagged as httpOnly
web.config: enabledVersionHeader=false
autocomplete disabled
Login url injection redirection fixed
session hijacking implemented

Dont forget to apply ssl to your website with https and to set the requireSSL="false" to true
This commit is contained in:
robvde 2012-06-21 19:39:58 +04:00
parent 6794315198
commit 38592df9e6
8 changed files with 397 additions and 121 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WebsitePanel/Sources/WebsitePanel.WebPortal/Default.aspx
View file

@ -13,7 +13,7 @@
<![endif]-->
</head>
<body>
<form id="form1" runat="server">
<form id="form1" runat="server" autocomplete="off">
<asp:PlaceHolder ID="skinPlaceHolder" runat="server"></asp:PlaceHolder>
</form>
</body>