安全框架：配置管理 | 缓解措施Security Frame: Configuration Management | Mitigations

• 12/03/2020
• • J
  • v

实施内容安全策略 (CSP) 并禁用内联 JavaScriptImplement Content Security Policy (CSP), and disable inline javascript

示例Example

示例策略：Example policy:

Content-Security-Policy: default-src 'self'; script-src 'self' www.google-analytics.com 

此策略只允许从 Web 应用程序的服务器和 google 分析服务器加载脚本。This policy allows scripts to load only from the web application's server and google analytics server. 从其他任何站点加载的脚本会被拒绝。Scripts loaded from any other site will be rejected. 在网站上启用 CSP 后，以下功能会自动禁用以缓解 XSS 攻击。When CSP is enabled on a website, the following features are automatically disabled to mitigate XSS attacks.

示例Example

内联脚本不会执行。Inline scripts will not execute. 下面是内联脚本的示例Following are examples of inline scripts

<script> some Javascript code </script>
Event handling attributes of HTML tags (e.g., <button onclick="function(){}">
javascript:alert(1);

示例Example

不会将字符串作为代码评估。Strings will not be evaluated as code.

Example: var str="alert(1)"; eval(str);

启用浏览器的 XSS 筛选器Enable browser's XSS filter

ASP.NET 应用程序在部署之前必须禁用跟踪和调试ASP.NET applications must disable tracing and debugging prior to deployment

仅从受信任源访问第三方 JavaScriptAccess third-party javascripts from trusted sources only

确保在经过身份验证的 ASP.NET 页面中整合 UI 伪装或点击劫持防御机制Ensure that authenticated ASP.NET pages incorporate UI Redressing or click-jacking defenses

示例Example

可以通过 IIS web.config 设置 X-FRAME-OPTIONS 标头。永远不应设计框架的站点 Web.config 代码片段：The X-FRAME-OPTIONS header can be set via IIS web.config. Web.config code snippet for sites that should never be framed:

    <system.webServer>
        <httpProtocol>
            <customHeader>
                <add name="X-FRAME-OPTIONS" value="DENY"/>
            </customHeaders>
        </httpProtocol>
    </system.webServer>

示例Example

只应由同一域中的页面设计框架的站点 Web.config 代码：Web.config code for sites that should only be framed by pages in the same domain:

    <system.webServer>
        <httpProtocol>
            <customHeader>
                <add name="X-FRAME-OPTIONS" value="SAMEORIGIN"/>
            </customHeaders>
        </httpProtocol>
    </system.webServer>

确保已在 ASP.NET Web 应用程序中启用 CORS 的情况下只允许受信任的来源Ensure that only trusted origins are allowed if CORS is enabled on ASP.NET Web Applications

示例Example

如果可以访问 Web.config，则可通过以下代码添加 CORS：If access to Web.config is available, then CORS can be added through the following code:

<system.webServer>
    <httpProtocol>
      <customHeaders>
        <clear />
        <add name="Access-Control-Allow-Origin" value="https://example.com" />
      </customHeaders>
    </httpProtocol>

示例Example

如果无法访问 Web.config，则可通过添加以下 CSharp 代码来配置 CORS：If access to web.config is not available, then CORS can be configured by adding the following CSharp code:

HttpContext.Response.AppendHeader("Access-Control-Allow-Origin", "https://example.com")

请注意，务必将“Access-Control-Allow-Origin”属性中的来源列表设置为一组有限的受信任来源。Please note that it is critical to ensure that the list of origins in "Access-Control-Allow-Origin" attribute is set to a finite and trusted set of origins. 不当地配置此列表（例如，将值设置为“*”）会使得恶意站点能够毫无限制地向 Web 应用程序触发跨域请求，从而使应用程序易于遭受 CSRF 攻击。Failing to configure this inappropriately (e.g., setting the value as '*') will allow malicious sites to trigger cross origin requests to the web application >without any restrictions, thereby making the application vulnerable to CSRF attacks.

在 ASP.NET 页面中启用 ValidateRequest 属性Enable ValidateRequest attribute on ASP.NET Pages

示例Example

但是，可在页面级别禁用此功能：However, this feature can be disabled at page level:

<%@ Page validateRequest="false" %> 

或者在应用程序级别or, at application level

<configuration>
   <system.web>
      <pages validateRequest="false" />
   </system.web>
</configuration>

请注意，MVC6 管道不支持且不包括请求验证功能。Please note that Request Validation feature is not supported, and is not part of MVC6 pipeline.

使用本地托管的最新版本的 JavaScript 库Use locally-hosted latest versions of JavaScript libraries

禁用自动 MIME 探查Disable automatic MIME sniffing

示例Example

如果应用程序由 Internet Information Services (IIS) 7 及更高版本托管，请在 web.config 文件中添加该标头。Add the header in the web.config file if the application is hosted by Internet Information Services (IIS) 7 onwards.

<system.webServer>
<httpProtocol>
<customHeaders>
<add name="X-Content-Type-Options" value="nosniff"/>
</customHeaders>
</httpProtocol>
</system.webServer>

示例Example

通过全局 Application_BeginRequest 添加该标头Add the header through the global Application_BeginRequest

void Application_BeginRequest(object sender, EventArgs e)
{
this.Response.Headers["X-Content-Type-Options"] = "nosniff";
}

示例Example

实现自定义的 HTTP 模块Implement custom HTTP module

public class XContentTypeOptionsModule : IHttpModule
{
#region IHttpModule Members
public void Dispose()
{
}
public void Init(HttpApplication context)
{
context.PreSendRequestHeaders += newEventHandler(context_PreSendRequestHeaders);
}
#endregion
void context_PreSendRequestHeaders(object sender, EventArgs e)
{
HttpApplication application = sender as HttpApplication;
if (application == null)
  return;
if (application.Response.Headers["X-Content-Type-Options "] != null)
  return;
application.Response.Headers.Add("X-Content-Type-Options ", "nosniff");
}
}

示例Example

对于特定的页面，只能通过将所需的标头添加到单个响应来启用该标头：You can enable the required header only for specific pages by adding it to individual responses:

this.Response.Headers["X-Content-Type-Options"] = "nosniff";

在 Windows Azure 网站中删除标准服务器标头避免留下指纹Remove standard server headers on Windows Azure Web Sites to avoid fingerprinting

为数据库引擎访问配置 Windows 防火墙Configure a Windows Firewall for Database Engine Access

确保已在 ASP.NET Web API 中启用 CORS 的情况下只允许受信任的来源Ensure that only trusted origins are allowed if CORS is enabled on ASP.NET Web API

示例Example

在 App_Start/WebApiConfig.cs 中，将以下代码添加到 WebApiConfig.Register 方法In the App_Start/WebApiConfig.cs, add the following code to the WebApiConfig.Register method

using System.Web.Http;
namespace WebService
{
    public static class WebApiConfig
    {
        public static void Register(HttpConfiguration config)
        {
            // New code
            config.EnableCors();

            config.Routes.MapHttpRoute(
                name: "DefaultApi",
                routeTemplate: "api/{controller}/{id}",
                defaults: new { id = RouteParameter.Optional }
            );
        }
    }
}

示例Example

可按如下所示，将 EnableCors 特性应用到控制器中的操作方法：EnableCors attribute can be applied to action methods in a controller as follows:

public class ResourcesController : ApiController
{
  [EnableCors("http://localhost:55912", // Origin
              null,                     // Request headers
              "GET",                    // HTTP methods
              "bar",                    // Response headers
              SupportsCredentials=true  // Allow credentials
  )]
  public HttpResponseMessage Get(int id)
  {
    var resp = Request.CreateResponse(HttpStatusCode.NoContent);
    resp.Headers.Add("bar", "a bar value");
    return resp;
  }
  [EnableCors("http://localhost:55912",       // Origin
              "Accept, Origin, Content-Type", // Request headers
              "PUT",                          // HTTP methods
              PreflightMaxAge=600             // Preflight cache duration
  )]
  public HttpResponseMessage Put(Resource data)
  {
    return Request.CreateResponse(HttpStatusCode.OK, data);
  }
  [EnableCors("http://localhost:55912",       // Origin
              "Accept, Origin, Content-Type", // Request headers
              "POST",                         // HTTP methods
              PreflightMaxAge=600             // Preflight cache duration
  )]
  public HttpResponseMessage Post(Resource data)
  {
    return Request.CreateResponse(HttpStatusCode.OK, data);
  }
}

请注意，务必将 EnableCors 特性中的来源列表设置为一组有限的受信任来源。Please note that it is critical to ensure that the list of origins in EnableCors attribute is set to a finite and trusted set of origins. 不当地配置此列表（例如，将值设置为“*”）会使得恶意站点能够毫无限制地向 API 触发跨域请求，从而使 API 易于遭受 CSRF 攻击。Failing to configure this inappropriately (e.g., setting the value as '*') will allow malicious sites to trigger cross origin requests to the API without any restrictions, >thereby making the API vulnerable to CSRF attacks. 可在控制器级别修饰 EnableCors。EnableCors can be decorated at controller level.

示例Example

若要对类中的特定方法禁用 CORS，可按如下所示使用 DisableCors 特性：To disable CORS on a particular method in a class, the DisableCors attribute can be used as shown below:

[EnableCors("https://example.com", "Accept, Origin, Content-Type", "POST")]
public class ResourcesController : ApiController
{
  public HttpResponseMessage Put(Resource data)
  {
    return Request.CreateResponse(HttpStatusCode.OK, data);
  }
  public HttpResponseMessage Post(Resource data)
  {
    return Request.CreateResponse(HttpStatusCode.OK, data);
  }
  // CORS not allowed because of the [DisableCors] attribute
  [DisableCors]
  public HttpResponseMessage Delete(int id)
  {
    return Request.CreateResponse(HttpStatusCode.NoContent);
  }
}

方式 1 使用中间件启用 CORS：要为整个应用程序启用 CORS，请使用 UseCors 扩展方法将 CORS 中间件添加到请求管道。Approach-1 Enabling CORS with middleware: To enable CORS for the entire application add the CORS middleware to the request pipeline using the UseCors extension method. 使用 CorsPolicyBuilder 类添加 CORS 中间件时，可以指定跨域策略。A cross-origin policy can be specified when adding the CORS middleware using the CorsPolicyBuilder class. 可通过两种方式实现此目的：There are two ways to do this:

示例Example

第一种方式是使用 lambda 调用 UseCors。The first is to call UseCors with a lambda. lambda 使用一个 CorsPolicyBuilder 对象：The lambda takes a CorsPolicyBuilder object:

public void Configure(IApplicationBuilder app)
{
    app.UseCors(builder =>
        builder.WithOrigins("https://example.com")
        .WithMethods("GET", "POST", "HEAD")
        .WithHeaders("accept", "content-type", "origin", "x-custom-header"));
}

示例Example

第二种方式是定义一个或多个命名的 CORS 策略，并在运行时按名称选择策略。The second is to define one or more named CORS policies, and then select the policy by name at run time.

public void ConfigureServices(IServiceCollection services)
{
    services.AddCors(options =>
    {
        options.AddPolicy("AllowSpecificOrigin",
            builder => builder.WithOrigins("https://example.com"));
    });
}
public void Configure(IApplicationBuilder app)
{
    app.UseCors("AllowSpecificOrigin");
    app.Run(async (context) =>
    {
        await context.Response.WriteAsync("Hello World!");
    });
}

方式 2 在 MVC 中启用 CORS：开发人员也可以使用 MVC 按操作、按控制器或者针对所有控制器全局应用特定的 CORS。Approach-2 Enabling CORS in MVC: Developers can alternatively use MVC to apply specific CORS per action, per controller, or globally for all controllers.

示例Example

按操作：要为特定的操作指定 CORS 策略，请将 [EnableCors] 特性添加到该操作。Per action: To specify a CORS policy for a specific action add the [EnableCors] attribute to the action. 指定策略名称。Specify the policy name.

public class HomeController : Controller
{
    [EnableCors("AllowSpecificOrigin")] 
    public IActionResult Index()
    {
        return View();
    }

示例Example

按控制器：Per controller:

[EnableCors("AllowSpecificOrigin")]
public class HomeController : Controller
{

示例Example

全局：Globally:

public void ConfigureServices(IServiceCollection services)
{
    services.AddMvc();
    services.Configure<MvcOptions>(options =>
    {
        options.Filters.Add(new CorsAuthorizationFilterFactory("AllowSpecificOrigin"));
    });
}

请注意，务必将 EnableCors 特性中的来源列表设置为一组有限的受信任来源。Please note that it is critical to ensure that the list of origins in EnableCors attribute is set to a finite and trusted set of origins. 不当地配置此列表（例如，将值设置为“*”）会使得恶意站点能够毫无限制地向 API 触发跨域请求，从而使 API 易于遭受 CSRF 攻击。Failing to configure this inappropriately (e.g., setting the value as '*') will allow malicious sites to trigger cross origin requests to the API without any restrictions, >thereby making the API vulnerable to CSRF attacks.

示例Example

若要为控制器或操作禁用 CORS，请使用 [DisableCors] 特性。To disable CORS for a controller or action, use the [DisableCors] attribute.

[DisableCors]
    public IActionResult About()
    {
        return View();
    }

加密 Web API 配置文件中包含敏感数据的部分Encrypt sections of Web API's configuration files that contain sensitive data

确保使用强凭据保护所有管理界面Ensure that all admin interfaces are secured with strong credentials

确保未知的代码无法在设备上执行Ensure that unknown code cannot execute on devices

使用 bit-locker 加密 IoT 设备的 OS 和其他分区Encrypt OS and additional partitions of IoT Device with bit-locker

确保只在设备上启用少量的服务/功能Ensure that only the minimum services/features are enabled on devices

使用 bit-locker 加密 IoT 现场网关的 OS 和其他分区Encrypt OS and additional partitions of IoT Field Gateway with bit-locker

确保在安装期间更改现场网关的默认登录凭据Ensure that the default login credentials of the field gateway are changed during installation

确保云网关实施相应的过程来保持已连接设备固件的最新状态Ensure that the Cloud Gateway implements a process to keep the connected devices firmware up to date

确保根据组织的策略在设备上配置终结点安全控制Ensure that devices have end-point security controls configured as per organizational policies

确保对 Azure 存储访问密钥进行安全管理Ensure secure management of Azure storage access keys

确保已在 Azure 存储中启用 CORS 的情况下只允许受信任的来源Ensure that only trusted origins are allowed if CORS is enabled on Azure storage

启用 WCF 的服务限制功能Enable WCF's service throttling feature

示例Example

下面是启用了限制的示例配置：The following is an example configuration with throttling enabled:

<system.serviceModel> 
  <behaviors>
    <serviceBehaviors>
    <behavior name="Throttled">
    <serviceThrottling maxConcurrentCalls="[YOUR SERVICE VALUE]" maxConcurrentSessions="[YOUR SERVICE VALUE]" maxConcurrentInstances="[YOUR SERVICE VALUE]" /> 
  ...
</system.serviceModel> 

WCF - 通过元数据透露信息WCF-Information disclosure through metadata

示例Example

以下代码指示 WCF 广播服务的元数据The code below instructs WCF to broadcast a service's metadata

ServiceMetadataBehavior smb = new ServiceMetadataBehavior();
smb.HttpGetEnabled = true; 
smb.HttpGetUrl = new Uri(EndPointAddress); 
Host.Description.Behaviors.Add(smb); 

不要在生产环境中广播服务元数据。Do not broadcast service metadata in a production environment. 将 ServiceMetaData 类的 HttpGetEnabled/HttpsGetEnabled 属性设置为 false。Set the HttpGetEnabled / HttpsGetEnabled properties of the ServiceMetaData class to false.

示例Example

以下代码指示 WCF 不要广播服务的元数据。The code below instructs WCF to not broadcast a service's metadata.

ServiceMetadataBehavior smb = new ServiceMetadataBehavior(); 
smb.HttpGetEnabled = false; 
smb.HttpGetUrl = new Uri(EndPointAddress); 
Host.Description.Behaviors.Add(smb);