3af40d8ee13eda120121e858d59727cbde15d7c4
Integration/Tutorials/Security.md
| ... | ... | @@ -140,4 +140,33 @@ public static void InitializeReporting() |
| 140 | 140 | AdHocSettings.AllowDeletingReports=false; |
| 141 | 141 | } |
| 142 | 142 | } |
| 143 | +``` |
|
| 144 | +### Preventing URL Cross Scripting |
|
| 145 | + |
|
| 146 | +In order to make sure a URL doesn't allow JavaScript injection, you must make sure that in your web.config that a page element has the validateRequest attribute set to true as you see |
|
| 147 | + |
|
| 148 | +Request Validation Source: [MSDN Request Validation](http://msdn.microsoft.com/en-us/library/hh882339%28v=vs.110%29.aspx) |
|
| 149 | +Modified Webconfig Source: http://archives.izenda.us/ri/webforms-cs.zip |
|
| 150 | + |
|
| 151 | +```xml |
|
| 152 | +<?xml version="1.0" encoding="UTF-8"?> |
|
| 153 | +<configuration> |
|
| 154 | + <system.web> |
|
| 155 | + <compilation debug="true"> |
|
| 156 | + </compilation> |
|
| 157 | + <!-- Needed on .NET 4.0 |
|
| 158 | + <httpRuntime requestValidationMode="2.0" /> |
|
| 159 | + --> |
|
| 160 | + <pages **validateRequest="true"** enableEventValidation="false" viewStateEncryptionMode="Never" /> |
|
| 161 | + <customErrors mode="Off"> |
|
| 162 | + <error statusCode="403" redirect="NoAccess.htm" /> |
|
| 163 | + <error statusCode="404" redirect="FileNotFound.htm" /> |
|
| 164 | + </customErrors> |
|
| 165 | + </system.web> |
|
| 166 | + <system.webServer> |
|
| 167 | + <staticContent> |
|
| 168 | + <remove fileExtension=".json" /> |
|
| 169 | + <mimeMap fileExtension=".json" mimeType="application/json" /> |
|
| 170 | + </staticContent> |
|
| 171 | + </system.webServer> |
|
| 143 | 172 | ``` |
| ... | ... | \ No newline at end of file |