Re: Prevent security bypass

IMHO the answer is quite simple ....

CAVEAT: 'converting' from HTML to ASP doesn't necessarily mean changing <p>text</p> to response.write("<p>text</p>").

convert (rename each 'html' page) to ASP and use a standard include file <!-- #include virtual="/scripts/secure.inc" --> which provides the authenticaiton routine.

I know I'm going to catch sh!t here cause I used .inc, but you can easily mitigate this by turning off read access in IIS to directories that only hold files included by other files (such as /scripts/)

hth,
sunzi

• Original Message ----- From: "Chris Neil" <Chris.Neil@abs-ltd.com> To: <webappsec@securityfocus.com> Sent: Tuesday, February 04, 2003 11:59 AM Subject: Prevent security bypass

> I am new to this mailing list and so hope this conforms to the guidelines
as
> I read them.
Received on Fri Feb 7 20:27:54 2003