Asp.net 网站防攻击安全设置

针对已解密的_ViewStat参数漏洞整改建议:在<system.web>下添加

<machineKey validation="3DES"/>

禁用脚本调试
<compilation debug="true">

跨站点请求伪造,如果要避免 CSRF 攻击，每个请求都应该包含唯一标识，它是攻击者所无法猜测的参数。 
protected override void OnInit(EventArgs e)
 {
      base.OnInit(e);
      if (System.Web.HttpContext.Current.Session != null)
     {
            ViewStateUserKey = Session.SessionID;
      }
  }

防止伪造用户身份

public partial class AdminLogin : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        if(!Page.IsPostBack)
            Session.Clear();
    }

}

防SQL注入

public static bool FilterChar(string oldstr)
        {
            bool flag = true;
            string[] filterstr = {"and ","exec ","insert ","select ","delete ","update ","count(","from ","drop ","asc(","char(","or ","chr(","mid("," master",
            "truncate ","declare ","sitename","net user","xp_cmdshell "," /add","exec master.dbo.xp_cmdshell","net localgroup administrators",
            "%",";","/'","/"","-","@",",","//","!","(",")","[","]","{","}","|"};
            for (int i = 0; i < filterstr.Length; i++)
            {
                if (oldstr.Contains(filterstr[i]))
                {
                    flag = false;
                    break;
                }
            }
            return flag;
        }