Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have a website which uses membership/roles for security. However, I really want this site to be secure. My concern is one day something happens to server and the membership/roles is turned off.

Is there anyway that I could add an additional layer of security to website that would not be too intrusive?

This would be "on-top" of the ASP.NET security. My thought would be maybe a session cookie that is sent when a password is answered correctly.

Looking for ideas. I primarily want keep the site secure even if the security on the website is turned off. In worst case scenario, I imagine that someone might could even browse the files. This would require me to put the check in every page which sounds very cumbersome and a hack.

share|improve this question
2  
In what way are you thinking that security may be turned off? Assuming you're checking that the user has been authenticated and has a particular role to view an area of the application, then if where you retrieve membership or role data from is shut down, no one will be able to log in to the application. could you add more details about your concerns? –  Russ Cam Mar 23 '11 at 22:01
    
Did you really intend for this to be here, versus webmasters.stackexchange.com ? –  Andy Finkenstadt Mar 23 '11 at 22:04
add comment

migrated from stackoverflow.com Mar 24 '11 at 12:46

This question came from our site for professional and enthusiast programmers.

4 Answers

Server security should be covered by your hosting company. If you dont trust them either host your own server or move to another host.

Concering the website security. "KISS - Keep it stupid-simple", every application running could turn into a exploit whole. May search up for exploit sites to get a bare idea, stay updated on 0day exploits. An outdated CMS can turn into a swiss cheese...

To protect your site, prevent XSS, SQLI and application exploits. Set correct user rights for folders and files. Make use of htaccess/robots.txt. Store passwords encrypted - ideally with salt. If CMS is in use, prevent applications guessing the CMS, move admin logins, edit out parts in the visible source that lets an attacker easily identify your CMS.

share|improve this answer
add comment

The simplest way to show that additional site security is wasted, is to disable the ASP component of IIS. Boom, all of your source code are belong to us.

share|improve this answer
add comment

I think you might be approaching this from the wrong direction. Whatever measure you come up with will most likely not be as secure as the built in security that is turned off and might just open up another avenue for getting in even.

Put in place measures to check that the security is working and do not allow the application to work if it is not.

share|improve this answer
add comment

I have to say, I think adding an extra layer is a bad idea. Perhaps you could have a global check on Application_Start in Global.asax to ensure Membership is hooked up and operational? If not, show an error message?

Regarding browsing for files, you can secure files at the folder level using ASP.NET Membership roles.

share|improve this answer
    
+1 I was thinking the same thing. An additional layer would feel out-of-place. Instead I like the idea of executing code during Application_Start to verify that the environment is compliant with your expectations –  Simen S Mar 23 '11 at 22:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.