3

For a webforms website, running on a few content deliveries and a content management server, we got a request from a security audit. The request is to encrypt the viewstate (adding <machineKey validation="AES"/> in the config). We have already done this on the content delivery servers and that is running fine, but I was hoping anyone had experience with this on a Sitecore content management server... Would it give any issues?

Also, the content management server already has some network security (don't know the exact details - only accessible on the local network and tunnel I think) so we are actually wondering if it is worth the trouble...

Improve this question

1 Answer 1

Reset to default
7

You shouldn't need to encrypt the ViewState on your CM servers, as the only people using it should be users you are aware of and are authorized to use it. If unauthorized users have access to it, you have other bigger security concerns that you need to look at.

That said, as far as I'm aware it won't create any issues, as it should be transparent to Sitecore. I don't believe the Sitecore client does any direct reading of the ViewState that bypasses ASP.NET's API for it (and if it did, that would be asking for problems to occur).

You've mentioned you're running multiple Content Delivery servers. I assume these are load balanced, are they sharing the same machineKey? If one isn't specified, then ASP.NET will generate one unique to just that machine and you will have problems if a request is served by one server, but the postback is handled by another. To fix this, you can generate a key and specify it in the machineKey element, making sure it is the same on each of your CD servers.

Improve this answer
2
  • 2
    I agree on the technical part of your answer, but I don't agree to treat CM servers different than CD servers. 80% of attacks do come from the internal network, so I would advise to "just" enable it on your CM's as well. Not too much of a hassle and better safe then sorry. and one other remark, although you are right on the loadbalancing issues, I remember that there might be issues when not having sticky sessions at the CM (but that's a whole other discussion)
    – Bas Lijten
    Commented Oct 6, 2016 at 12:46
  • 1
    That's a fair comment, there is very little effort required to ensure it is protected, even if it is low risk (Not due to the % of internal attacks, but more to the opportunity it may create).
    – Kasaku
    Commented Oct 6, 2016 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.