Security

Optimizely meets high standards regarding security features within a wide range of scenarios. Login security in Optimizely CMS is based on the authentication and authorization system, and uses Introduction to Identity on ASP.NET Core, which provides an overview of security management in Optimizely. 

Security management in Optimizely CMS

The Optimizely platform handles the following common security concerns.

• Authentication and authorization. The authentication in Optimizely CMS is based on the ASP.NET Core built-in framework for user and role. Optimizely CMS uses a standard API that makes it easy to create your own provider for any type of user database, and third-party providers.

  Note: Where and how user credentials are stored, depends on the authentication provider used. The separation of authentication and authorization increases flexibility. Making a call to a provider lets you delegate security operations to a separate machine, thereby increasing scalability. Optimizely CMS also supports single sign-on and federated claims-based authentication.

• Injection projection. Optimizely CMS code uses parameterized APIs so that injection attacks cannot be carried out from untrusted input. There are no code paths in Optimizely CMS that uses untrusted data in XML-related calls.
• Cross-site scripting (XSS). In Optimizely CMS, user input is filtered and validated to prevent XSS issues. Depending on the actual piece of information, Optimizely applies HTML encoding to the outgoing data stream to protect from XSS attacks. The editorial and administrative interfaces are areas where you can post HTML and scripts and use as-is on a web page. Optimizely CMS relies on its authorization features to ensure that only trusted users can provide content.
• Broken authentication and session management. The Optimizely CMS authentication and authorization system is based on the ASP.NET Core built-in framework for user/role. Optimizely CMS does not rely on any session data, which increases security and improves scalability and performance because a browser session does not need server affinity from a security perspective. 
• Insecure direct object references. In Optimizely CMS, the references go through at least one layer of indirection with appropriate access controls in place.
• Cross-site request forgery (CSRF). Optimizely CMS has a CSRF prevention mechanism that automatically detects forged requests for system pages. The event validation mechanism in ASP.NET also is enabled for these pages. For the site pages, Optimizely supports and provides optional anti-forgery validation and the event validation.
• Security misconfiguration. Any configuration in Optimizely CMS is designed with secure by default in mind. Strong security requires having a secure configuration defined and deployed for the application, frameworks, application server, Web server, database server, and platform. Each of these settings should be defined, implemented, and maintained because many are not shipped with secure enough defaults.
• Insecure cryptographic storage. Optimizely CMS uses verified, strong algorithms. Only a small part of the Optimizely CMS configuration information may contain sensitive information, such as the ConnectionStrings section. You can encrypt this information by the built-in .NET framework features. Optimizely stores other system assets in an SQL database with full support of the native encryption mechanisms of the database.
• Failure to restrict URL access. Sensitive areas of Optimizely CMS, such as the edit and admin user interfaces, are protected by default with the standard configuration. Information presented on public-facing web pages are subject to authorization based on the content that is displayed. Optimizely CMS never relies on security through a secret URL.
• Transport layer protection. The single-most common piece of sensitive information that is transmitted on the network are the user credentials (username and password). Optimizely CMS fully supports the use of SSL (HTTPS protocol), and the use of SSL is strongly recommended.
• Unvalidated redirects and forwards. There is an absolute minimum of redirects in Optimizely CMS because they are undesirable for security and performance. Existing redirects are based on internal data or sanitized information.
• Virus protection. Optimizely CMS relies on third-party products for virus protection. Optimizely never executes files that are uploaded to the asset manager, preventing potential viruses inside files to spread to Optimizely.

Last updated: Jul 02, 2021