Securing the Web Application - Installation Guide - Micetro - 25.2.0

Micetro Installation Guide
ft:locale
en-US
Product name
Micetro
Version
25.2.0

These are some security issues that are commonly addressed, but may differ based on your organization and changing security requirements. The following security considerations are just a few that you may want to implement, but this is not a comprehensive list. We recommend following the best practices for your web server to ensure that your environment is secure.

Recommended measures to ensure the security of your environment include setting up a reverse proxy and implementing the Content-Security-Policy HTTP header, among others.

Additionally, the web service exposes several documentation endpoints that are accessible without authentication. You may want to restrict access to these endpoints in production environments to improve security.

Setting up a reverse proxy

Set up a reverse proxy to bolster the security of your Web Application. This ensures that any data received from users will be subject to client-side input validation, even if the user disables any client-side controls. You can use Application Request Routing (ARR) as your reverse proxy.

To use ARR for Microsoft IIS:

  1. Enable ARR as a proxy:
    1. Open IIS Manager.
    2. Select the server node.
    3. Double-click Application Request Routing Cache.
    4. In the right-side panel, select Server Proxy Settings.
    5. Check the Enable proxy checkbox.
    6. Select Apply.
  2. Enable forwarding of the original client IP:
    1. In the Custom Header section of the Server Proxy Settings, make sure that X-Forwarded-For is entered in the Preserve client IP in the following header input field.

      This automatically adds or appends the X-Forwarded-For header to requests forwarded by ARR.

Implementing the Content-Security-Policy HTTP header

We recommend implementing the Content-Security-Policy (CPS) HTTP header, which provides additional security from client-side attacks, e.g., cross-site scripting. The specific implementation of the CSP header depends on your application configuration, but OWASP provides general instructions.

At a minimum, you should use the CPS header with the directive default-src, as well as:

  • script-src to restrict script execution
  • frame-ancestors to prevent framing attacks

To implement the CPS HTTP header:

  1. Open IIS Manager.
  2. Select your site from the tree on the left.
  3. Double-click HTTP Response Headers.
  4. In the pane on the right, select Add.
  5. Enter the following values:
    • Name: Content-Security-Policy
    • Value: default-src 'self'; script-src 'self'; frame-ancestors 'self';
  6. Select OK.
  7. Restart the site, if needed.