We are hosting our sites in azure web apps and in process of applying security hardening.
Wondering if anyone has already written a patch/transform file for below:
1. Deny anonymous users access to key folders
2. Disable client RSS feeds
3. Secure the file upload functionality
4. Improve the security of the website folder
5. Limit access to certain file types
7. Protect PhantomJS
8. Protect media requests
with the release of Sitecore 8.2, Sitecore added a lot of hardening in their packages. after downloading the the toolkit, you can find all hardenings in the cargopayload folder: all the enabled/disabled patchfiles and the transformations.
Download the toolkit at: https://dev.sitecore.net/Downloads/Sitecore_Azure_Toolkit/1x/Sitecore_Azure_Toolkit_100.aspx
In Azure App Service there is not much you can do about some of these recommendations, it being a fully hosted service.
You might find Grant Killian's Unified Security Hardening script handy but most of it, as I said, may not work in App Service: https://grantkillian.wordpress.com/2016/08/15/unified-security-hardening-script-for-sitecore/
