The following items should be set up as security best practice on Vuture websites, by ensuring the corresponding entry for each item is in the web.config.

 

1. Session Cookie 'Secure' Attribute
2. Content Security Policy (CSP)
3. HSTS Best Practices
4. X-Content-Type-Options Best Practices
5. Enforce HTTPS

 

1. Session Cookie 'Secure' Attribute

The secure attribute is an option set by the application server when sending a new cookie to the user within an HTTPS Response.

<httpCookies httpOnlyCookies="true" requireSSL="true" />

2. Content Security Policy (CSP)

The Content-Security-Policy meta-tag allows you to reduce the risk of XSS attacks by allowing you to define where resources can be loaded from, preventing browsers from loading data from any other locations. This makes it harder for an attacker to inject malicious code into your site.

 

<add name="Content-Security-Policy" value="script-src * 'self' 'unsafe-inline' 'unsafe-eval' ; style-src * 'self' 'unsafe-inline' ; img-src * 'self' data: ; font-src * 'self' data: ; connect-src * ; object-src 'none' ; frame-src * ; media-src: 'self' ; frame-ancestors 'self' ; upgrade-insecure-requests; block-all-mixed-content/>

3. HSTS Best Practices

The HTTP Strict-Transport-Security response header (often abbreviated as HSTS) informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS. Vuture will ask the client for the maximum age figure. The current default is 7 days (value must be in seconds) but this can be changed.

 

<add name="Strict-Transport-Security" value="max-age=604800" />

      4.   X-Content-Type-Options Best Practice

The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised in the Content-Type headers should be followed and not be changed. The header allows you to avoid MIME type sniffing by saying that the MIME types are deliberately configured.

 

<add name="X-Content-Type-Options" value="nosniff" />

5. Enforce HTTPS

This rule forces the site to run over HTTPS. Note that you must have installed a valid SSL certificate for the site. Replace mywebsite.com with the URL of the website.

 

<rule name="Enforce canonical hostname" enabled="true" stopProcessing="true"> 

          <match url="(.*)" /> 

          <conditions>

            <add input="{SERVER_PORT_SECURE}" pattern="^0$" /> 

          </conditions> 

          <action type="Redirect" url="https://mywebsite.com/{R:1}" redirectType="Permanent" /> 

        </rule> 

        <rule name="Enforce canonical hostname ssl" enabled="true" stopProcessing="true"> 

          <match url="(.*)" /> 

          <conditions> 

            <add input="{HTTP_HOST}" negate="true" pattern="^mywebsite\.com$" /> 

          </conditions> 

          <action type="Redirect" url="https://mywebsite.com/{R:1}" redirectType="Permanent" /> 

        </rule>