Security

Episerver is designed to meet high standards regarding security features within a wide range of scenarios. Login security in Episerver CMS is based on the authentication and authorization system uses the built-in membership and role system in ASP.NET. This document provides an overview of security management in Episerver. The Episerver platform also supports ADFS/SSO and OWIN.

Security management in Episerver CMS

The Episerver platform handles the following common security concerns. 

• Authentication and authorization. The authentication in Episerver CMS is based on the ASP.NET built-in framework for role and membership providers. Episerver CMS uses a standard API that makes it easy to create your own provider for any type of user database, and third-party providers.

  Note: Where and how user credentials are stored, depends on the authentication provider used. The separation of authentication and authorization increases flexibility. Making a call to a provider lets you delegate security operations to a separate machine, thereby increasing scalability. For infomation, see  Authorization and Authentication. Episerver also supports single sign-on and federated claims based authenticaton.

• Injection projection. Episerver CMS code uses parameterized APIs so that injection attacks cannot be carried out from untrusted input. There are no code paths in Episerver CMS that uses untrusted data in XML-related calls.
    
• Cross-site scripting (XSS). In Episerver CMS, user input is filtered and validated to prevent XSS issues. Depending on the actual piece of information, Episerver applies HTML encoding to the outgoing data stream to protect from XSS attacks. The editorial and administrative interfaces are areas where you can post HTML and scripts and use as-is on a web page. Episerver CMS relies on its authorization features to ensure that only trusted users can provide content.
  
  
• Broken authentication and session management. The Episerver CMS authentication and authorization system is based on the ASP.NET built-in framework for role and membership. Episerver CMS does not rely on any session data, which increases security and improves scalability and performance because a browser session does not need server affinity from a security perspective. See also Protecting Users From Session Hijacking.
    
• Insecure direct object references. In Episerver CMS, the references always goes through at least one layer of indirection with appropriate access controls in place. 
   
• Cross-site request forgery (CSRF). Episerver CMS has a CSRF prevention mechanism that automatically detects forged requests for system pages. The event validation mechanism in ASP.NET also is enabled for these pages. For the site pages, Episerver supports and provides optional anti-forgery validation and the event validation.
    
• Security misconfiguration. Any configuration in Episerver CMS is designed with secure by default in mind. Strong security requires having a secure configuration defined and deployed for the application, frameworks, application server, web server, database server, and platform. Each of these settings should be defined, implemented, and maintained because many are not shipped with secure enough defaults.
    
• Insecure cryptographic storage. Episerver CMS uses verified, strong algorithms. Only a small part of the Episerver CMS configuration information may contain sensitive information, such as the ConnectionStrings section. You can encrypt this information by the built-in .NET framework features. Episerver stores other system assets in an SQL database with full support of the native encryption mechanisms of the database.
    
• Failure to restrict URL access. Sensitive areas of Episerver CMS, such as the edit and admin user interfaces, are protected by default with the standard configuration. Information presented on public-facing web pages are subject to authorization based on the content that is displayed. Episerver CMS never relies on security through a secret URL.
    
• Transport layer protection. The single-most common piece of sensitive information that is transmitted on the network are the user credentials (username and password). Episerver CMS fully supports the use of SSL (HTTPS protocol), and the use of SSL is strongly recommended.
    
• Unvalidated redirects and forwards. There is an absolute minimum of redirects in Episerver CMS because they are undesirable for security and performance.  Existing redirects are based on internal data or sanitized information.
    
• Virus protection. Episerver CMS relies on third-party products for virus protection. Episerver never executes files that are uploaded to the asset manager, preventing potential viruses inside files to spread to Episerver.

ADFS/SSO and OWIN support

The Episerver platform provides support for ADFS/SSO, and the OWIN standard interface between .NET web servers and applications. The following topics provide more information.

• Federated security
• Forms authentication
• OWIN authentication
• Mixed mode OWIN configuration

Related topics

• Authentication and authorization
• Configuring active directory membership provider
• Recommendations for ASP.NET security settings
• Securing edit and admin interfaces