Ensure 'forms authentication' is set to use cookies

NiskaNivo 2Automatskaiis

Opis

Forms Authentication can be configured to maintain the site visitor's session identifier in either a URI or cookie. It is recommended that Forms Authentication be set to use cookies. Wherever forms authentication is used, forms cookieless must be UseCookies. Compliant when forms authentication is not used. PowerShell 5.1 with the WebAdministration module; run elevated.

Kako se proverava

Metod provere: Komanda ljuske

shell

Import-Module WebAdministration -ErrorAction Stop; $paths = @('MACHINE/WEBROOT') + @(Get-Website | ForEach-Object { "IIS:\Sites\$($_.Name)" }); $bad = @($paths | Where-Object { $a = Get-WebConfiguration -Filter 'system.web/authentication' -PSPath $_; $f = Get-WebConfiguration -Filter 'system.web/authentication/forms' -PSPath $_; [string]$a.mode -eq 'Forms' -and ([string]$f.cookieless -ne 'UseCookies') }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST/<site>' -Filter system.web/authentication/forms -Name cookieless -Value UseCookies

Svojstva

Operativni sistemi: Bilo koji
Oznake: iisauthentication
Referenca: CIS Microsoft IIS 10 Benchmark v1.2.1 - 2.4 Ensure 'forms authentication' is set to use cookies

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target iis --level 2