2

I have a website which uses membership/roles for security. However, I really want this site to be secure. My concern is one day something happens to server and the membership/roles is turned off.

Is there anyway that I could add an additional layer of security to website that would not be too intrusive?

This would be "on-top" of the ASP.NET security. My thought would be maybe a session cookie that is sent when a password is answered correctly.

Looking for ideas. I primarily want keep the site secure even if the security on the website is turned off. In worst case scenario, I imagine that someone might could even browse the files. This would require me to put the check in every page which sounds very cumbersome and a hack.

Improve this question
2
  • 2
    In what way are you thinking that security may be turned off? Assuming you're checking that the user has been authenticated and has a particular role to view an area of the application, then if where you retrieve membership or role data from is shut down, no one will be able to log in to the application. could you add more details about your concerns?
    – Russ Cam
    Mar 23, 2011 at 22:01
  • Did you really intend for this to be here, versus webmasters.stackexchange.com ?
    – Andy Finkenstadt
    Mar 23, 2011 at 22:04

4 Answers 4

Reset to default
4

I have to say, I think adding an extra layer is a bad idea. Perhaps you could have a global check on Application_Start in Global.asax to ensure Membership is hooked up and operational? If not, show an error message?

Regarding browsing for files, you can secure files at the folder level using ASP.NET Membership roles.

Improve this answer
1
  • +1 I was thinking the same thing. An additional layer would feel out-of-place. Instead I like the idea of executing code during Application_Start to verify that the environment is compliant with your expectations
    – Simen S
    Mar 23, 2011 at 22:02
1

I think you might be approaching this from the wrong direction. Whatever measure you come up with will most likely not be as secure as the built in security that is turned off and might just open up another avenue for getting in even.

Put in place measures to check that the security is working and do not allow the application to work if it is not.

Improve this answer
0

Server security should be covered by your hosting company. If you dont trust them either host your own server or move to another host.

Concering the website security. "KISS - Keep it stupid-simple", every application running could turn into a exploit whole. May search up for exploit sites to get a bare idea, stay updated on 0day exploits. An outdated CMS can turn into a swiss cheese...

To protect your site, prevent XSS, SQLI and application exploits. Set correct user rights for folders and files. Make use of htaccess/robots.txt. Store passwords encrypted - ideally with salt. If CMS is in use, prevent applications guessing the CMS, move admin logins, edit out parts in the visible source that lets an attacker easily identify your CMS.

Improve this answer
-1

The simplest way to show that additional site security is wasted, is to disable the ASP component of IIS. Boom, all of your source code are belong to us.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.