在 Internet 上打开 ASP.Net 应用程序之前，我需要具备哪些功能？
在启用对新站点的访问之前，应采取哪些步骤来确保其安全且“生产就绪”？
到目前为止，我有以下内容：
- 错误日志记录（通过 ELMAH）
- SSL 已启用，并且我有从 HTTP 到 HTTPS 的重定向
- 编译时无需调试
我当前的技术堆栈是 IIS7 & ASP.NET MVC3。
我确信我忘记或不知道许多其他项目。有什么建议吗？
Before I enable access to a new site, what steps should be done to make sure it's secure and "production ready"?
So far I have the following:
- logging of errors (via ELMAH)
- SSL is enabled, and I have a redirect from HTTP to HTTPS
<customErrors mode="RemoteOnly" />- Compiled without Debug
My current tech stack is IIS7 & ASP.Net MVC3.
I'm sure I'm forgetting or not aware of many other items. Any advice?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
防止sql注入。使用存储过程或参数化 SQL 语句。您可以使用动态 sql - 但要非常小心，如果您这样做 - 请确保使用参数化查询，并且不要通过附加变量形成“内联”sql 语句。
确保使用 Html.AntiForgeryToken，防止跨站请求伪造 (CSRF)
确保关闭跟踪
确保自定义错误已打开，以便死机黄屏（即错误详细信息）不会显示给客户端。
通过确保在系统中显示的模型、数据库等的任何输出都通过在 aspx 页面上使用 <%: 语法进行编码并在 mvc 3 页面上简单地使用 @XXXX 进行编码，来防止跨站点脚本编写，如下所示mvc3 默认对所有内容进行编码，这对过去的方法来说是一个很大的增强。
确保您的数据库中没有测试帐户。
确保仅通过查询字符串无法执行任何操作 - 例如传入 /MyApp/DeleteUser/10。需要帖子才能执行操作，并且这些帖子必须在控制器上使用 Html.AntiForgeryToken 和 [ValidateAntiForgeryToken]
确保在页面上编辑信息的任何用户都无法编辑（使用 fiddler 等工具）隐藏在页面上的主键页面，从而在回发更改时更改他们正在编辑的记录。例如，您可以将页面上的 CustomerId 散列到隐藏字段中，并在发布时进行比较，以确保它与模型中的内容匹配。
下个月在亚特兰大的 tech ed 上拜访我，参加我的安全演讲 :)
Protect against sql injection. Use stored procedures OR parameterized sql statements. You can use dynamic sql - but be very careful and if you do - make sure you use parameterized queries and do not form the sql statements 'inline' by appending variables.
Protect against cross site request forgery (CSRF) by making sure you use Html.AntiForgeryToken
Make sure tracing is turned off
Make sure custom errors is turned on so yellow screens of death (ie error details) ar enot displayed to the client.
Protect against cross site scripting by making sure any output you display in your system from your model, database, etc. is encoded by using <%: syntax on your aspx pages and simply @XXXX on your mvc 3 pages, as mvc3 encodes everything BY DEFAULT which is a great enhancement over past methods.
Make sure there are no test accounts in your database.
Ensure no actions can be performed just by the querystring - for instance passing in /MyApp/DeleteUser/10. Require a post to perform an action, and those posts must use Html.AntiForgeryToken and [ValidateAntiForgeryToken] on your controller
Ensure that any users editing information on your page cannot edit (using a tool like fiddler) a primary key hidden on the page thus changing what record they are editing when they post back the changes. You can hash for instance a CustomerId on the page into a hidden field and compare it upon post to make sure it matches what is in the model.
Visit me at tech ed in atlanta next month for my security talk : )
如果您使用 ELMAH，请确保对 elmah.axd 处理程序的访问是安全的且未开放。否则，您就会向潜在的黑客提供有价值的信息。
确保您的网络服务器完全更新了补丁，并在 MS 提供补丁时自动下载/安装它们。太多的网站未能应用这些补丁并被攻击。
确保您的站点中的动态 sql 为零；或者，至少一切都是通过参数化查询来处理的。按照这些原则，请确保数据库用户凭据被锁定，以便它仅具有您实际需要的功能（提示：dbo 级别不合适）。
确保用户输入的每一位数据都经过正确转义，以便在显示时不会导致跨站点脚本问题。基本上，进行全面的安全审核。如果它足够重要，请聘请外部公司来执行此操作。
If you are using ELMAH, make sure that access to the elmah.axd handler is secured and not open. Otherwise you are giving potential hackers valuable information.
Ensure your web server is completely up to date with patches and automatically downloads / installs them when available from MS. Way too many sites fail to apply these and get pwned.
Ensure that you have zero dynamic sql in your site; or, at the absolute very least everything is handled via parameterized queries. Along these lines, make sure the database user credentials are locked down so that it only has the capabilities you actually need (hint: dbo level is NOT appropriate).
Ensure that every bit of data entry done by a user is properly escaped so that if it is displayed it does not result in cross site scripting issues. Basically, do a full security audit. If it's important enough, hire an outside firm to do this.
首先想到的是搜索引擎优化（SEO）。使用 MS 的 SEO 工具包 开始使用。
First thing comes to mind is Search engine optimization (SEO). Use the SEO Toolkit by MS to get started.
除此之外，我总是运行免费工具 Xenu ( http://home.snafu .de/tilman/xenulink.html#Description ）来检查损坏的链接。即使您使用其他工具，这也可以提供出色的双重检查。
考虑将 web.config 放置在具有适当权限的每个子文件夹中。例如，如果所有图像都保存在文件夹 \images 中，则该文件夹不应提供 ASCX 文件，而只能提供具有正确图像扩展名的文件。
当您找不到页面时，您是否正在执行一些用户友好的操作，例如将用户重定向到搜索页面？自定义错误页面可以大大提高网站的可用性。
您可能需要一个 robots.txt 文件和一个自定义图标，这些项目经常被忽视。
To add to the above, I always run the free tool Xenu ( http://home.snafu.de/tilman/xenulink.html#Description ) to check for broken links. Even if you use another tool, this provides an excellent double check.
Consider placing a web.config in each sub-folder with appropriate permissions. For example if all images are held in a folder \images then that folder should not be able to serve up an ASCX file, only files with a proper image extension.
Are you doing something user friendly when you get a page not found, such as re-directing the user to a search page? Custom error pages can go a long way to making the site more useable.
You may want to have a robots.txt file and a custom icon, items that are often overlooked.