.NET 환경에서 웹 어플리케이션 보안 개발시 참고할만한 사이트 들입니다. 대부분 MSDN에서 제공하고 있으며, 관련된 상황에 맞게 적용하시면 될거 같습니다.
Validate all untrusted input
http://msdn.microsoft.com/en-us/library/ms972961.aspx
Encode any Web response data that could contain user or other untrusted input
http://msdn.microsoft.com/en-us/library/ms998274.aspx
Use built-in ASP.NET protection via the ValidateRequest option
http://msdn.microsoft.com/en-us/library/system.web.configuration.pagessection.validaterequest.aspx
Use the System.Web.HttpCookie.HttpOnly property
http://msdn.microsoft.com/en-us/library/system.web.httpcookie.httponly.aspx
Use the <frame>, <iframe> IE6 and above security attribute
http://msdn.microsoft.com/en-us/library/ms534622.aspx
Use the Microsoft Anti-Cross Site Scripting Library (AntiXSS)
http://www.codeplex.com/antixss
Developer Encoding Libraries:
.NET System.Web.HttpUtility
http://msdn.microsoft.com/en-us/library/system.web.httputility.aspx
Microsoft Anti-Cross Site Scripting Library
http://msdn.microsoft.com/en-us/library/aa973813.aspx
Reducing Exposure to Cross-Site Scripting Attacks using ASP.NET
http://msdn.microsoft.com/en-us/library/ms998274.aspx
참고 사이트)
http://www.microsoft.com/downloads/details.aspx?FamilyID=0fcba3c7-bc30-47b0-a2f8-2e702720998a&DisplayLang=en
