Security

Security

Security should be a key consideration during the installation and configuration of Safran Web Access. This article outlines important security details to keep in mind. Additional details may exist beyond those mentioned here; generally, it is advisable to follow Microsoft's recommendations for setting up applications on IIS

Secure your firewall.

1. Block Port 80: This will prevent HTTP traffic.
2. Open Port 443: This will allow HTTPS traffic.
3. Close unused Ports for improved security.
4. Follow the Microsoft guidelines for detailed instructions.
5. Configure Firewall Rules With Group Policy | Microsoft Learn

Database Connection Security

5. Avoid Using SAFRANSA: Do not use SAFRANSA as the database user in your web.config file.
6. Create a New User: Set up a new user with restricted access for database connections.
7. Follow the guide from Safran on how to create a new user.

Encrypt Your Connection String

8. Use aspnet_regiis.exe: Encrypt the connection string in your web.config file using this Microsoft tool.
9. Make a backup of the file prior encryption and store in a secure place.
10. Detailed instructions can be found in the Microsoft documentation.
11. Encrypting and Decrypting Configuration Sections | Microsoft Learn

Restrict IIS User Access

12. Limit Directory Access: Ensure the IIS user associated with your API only has access to the necessary directories on your server.
13. Follow the Microsoft guide for setting up these permissions.
14. Default permissions and user rights in IIS - Internet Information Services | Microsoft Learn

IIS configuration

It is recommended to configure the following settings for IIS:

1. "Enable Parent Paths" -> False / Disable
   The IIS setting asp enableParentPaths allows Classic ASP applications to use relative paths that include .. to refer to parent directories. This feature is disabled by default for security reasons. When enabled, it lets developers use paths like ..\example.asp to access files or folders in parent directories

<system.webServer>
   <asp enableParentPaths="false" />
</system.webServer>

2. "Allow double escaping" -> False / Disable
   The IIS setting allowDoubleEscaping allows URLs that contain double escape sequences (e.g., %2520 for a space) to be processed by the server. This setting is disabled by default to prevent certain types of attacks that exploit double-encoded characters. When enabled, it permits the server to handle URLs with double-escaped characters, which can be useful in specific scenarios but may introduce security risks.

<system.webServer>
   <security>
      <requestFiltering allowDoubleEscaping="false" />
   </security>
</system.webServer>

3. "Directory browsing" -> False / Disable
   The IIS setting directoryBrowse controls whether directory browsing is enabled for a website or application. When enabled, it allows users to see a list of files and directories within a specified directory on the web server. This can be useful for development or troubleshooting but may pose security risks if left enabled on a production server.

<system.webServer>
   <directoryBrowse enabled="false" />
</system.webServer>

4. "Always Allowed Urls" -> Should be empty
   The IIS setting alwaysAllowedUrls specifies a collection of URLs that are allowed through request filtering, regardless of other filtering rules. This means that even if certain URL sequences are generally denied, the URLs listed in alwaysAllowedUrls will be permitted.

<system.webServer>
   <security>
      <alwaysAllowedUrls>
      </alwaysAllowedUrls>
   </security>
</system.webServer>