Lessons in website security anti-patterns by Tesco

Re:Lessons in website security anti-patterns by Tesco by skue on Monday July 30, 2012 @08:41AM (#4312020)

Great analysis except I'm puzzled by his claim about trace.axd -- is it really a security risk that tracing is enabled, given that it can only be accessed from the local machine?

[ Parent | on HN ]

Re:Lessons in website security anti-patterns by Tesco by alastairpat on Monday July 30, 2012 @08:52AM (#4312055)

Depending on the configuration, it can be accessed from a remote computer. In this case, it was configured for localhost access, however it is entirely possible that it could be world-accessible.

[ Parent | on HN ]

Re:Lessons in website security anti-patterns by Tesco by skue on Monday July 30, 2012 @10:31AM (#4312465)

Right... that's like saying "The root password was strong, however it is entirely possible that it could be an empty string."

Fortunately, someone on the main article did respond that having trace.axd enabled could result in 500 errors dumping a stack trace. That's a much clearer argument for why having tracing enabled is a bad thing.

[ Parent | on HN ]

Re:Lessons in website security anti-patterns by Tesco by dt7 on Monday July 30, 2012 @09:33AM (#4312196)

I think the point is that it exposes information about the server, like the headers he mentions.

[ Parent | on HN ]