Security, best-practice question 1

[gwillr]

I have a few forms for collecing user input. The are processed via .asp scripts. teh data from the form goes to files in a password protected area. Is it necessary or better to have the .asp files that process the input in that protected area as well?

Thanks in advance for any input.

Gary

http://www.robarspages.ca

 

[Castor66]

Personally, I wouldn't as that may expose the location of the stored data. Ideally, you would offload the stored data to an external server (DB or some other storage resource). What I would do is have the pages that collect the data running under an SSL wrapper.

 

[gwillr]

Thanks for the response!

It all makes sense, but, aside from offloading the stored data at regular intervals (which i will do, thanks for that suggestion), isnt the initial storage location traceable? ie: check html to view where the code is submitted (in this case it is to an .asp page) then check the asp page to see where it writes the data to. is there a way (with permissions/authentication or something) to restrict read access to the asp file that initially processes the data while still keeping it accessable for when it needs to process a new submission?

Gary

http://www.robarspages.ca

 

[Castor66]

The client should not be able to view the contents of an ASP page remotely. If they can then you haven't locked the server down properly. The entire web site should be accessible only by the user that IIS is using to serve the content, e.g. IUSR_xxxxx. You probably want to give the systems people access as well. Don't make the web site available as a share to your internal network as then any user with the right access would be able to see the contents of any files on your network.

Generally, by default, a user can use 'view source' on the HTML but they can't view the contents of an ASP file.

 

[gwillr]

Excellent. It looks like I have some work to do. Thanks for pointing me in the right direction!

Gary

http://www.robarspages.ca