.Net IIS 常用安全漏洞设置

安全选项	配置点
屏蔽 OPTIONS, TRACE Http响应	<system.webServer> <security>       <requestFiltering>         <verbsallowUnlisted="true">           <addverb="OPTIONS"allowed="false"/>           <addverb="TRACE"allowed="false"/>         </verbs>       </requestFiltering>     </security> </system.webServer>
添加安全头标识	<system.webServer> <httpProtocol>            <customHeaders>         <addname="X-Frame-Options"value="SAMEORIGIN" />         <addname="X-XSS-Protection"value="1; mode=block" />         <addname="X-Content-Type-Options"value="nosniff" />         <addname="Strict-Transport-Security"value="max-age=31536000; includeSubDomains" />         <removename="X-Powered-By" />         <addname="Cache-Control"value="no-cache, no-store" />         <addname="Pragma"value="no-cache" />       </customHeaders> </httpProtocol> </system.webServer>
关闭IIS Server版本 ； 需要安装IIS插件 URLRewrite才生效	<system.webServer> <rewrite>       <outboundRules>         <rulename="replace server header"patternSyntax="Wildcard">           <matchserverVariable="RESPONSE_SERVER"pattern="*"/>           <actiontype="Rewrite"value=""/>         </rule>       </outboundRules>     </rewrite>       </system.webServer>
将目录访问的无权403错误都转成 404 页面	<system.webServer> <handlers>       <addname="StopDirectoryBrowsing"path="*."resourceType="Directory"verb="*"            preCondition="integratedMode"type="System.Web.HttpNotFoundHandler" /> </handlers> </system.webServer> 或 <system.webServer>    <httpErrorserrorMode="Custom">         <removestatusCode="403" />         <errorstatusCode="403"path="ErrorPage.html"responseMode="ExecuteURL" />       </httpErrors>    </system.webServer>
关闭ASP.Net版本号	<system.web> <httpRuntime enableVersionHeader="false" > </system.web>
加密Viewstatus	<system.web> <machineKeyvalidation="AES" /> </system.web>
任何时候避免出现服务器错误，打开自定义的出错页面，所有出错跳转到一个自定义的错误	<customErrorsmode="On"defaultRedirect="customerErr.html"/>
Jquery-1.8.0.js 有安全问题	更新更高版本的jQuery 库
提交内容有明文传递	需要改为Https://才能解决
Weak SSL Cipher	关闭弱安全协议SSL2.0，SSL3.0 用工具IISCrypto.exe