Sholo.Web.Security/EnhancedSecurityModule.cs
/// <summary>
/// Detects a CryptographicException and delays the response to reduce the likelihood
/// of a successful padding oracle exploit attack.
/// </summary>
/// <param name="sender">The HttpApplication that sent the request</param>
/// <param name="e">Not used</param>
Detects a CryptographicException and delays the response to reduce the likelihood
of a successful padding oracle exploit attack.
Detects a CryptographicException and delays the response to reduce the likelihood of a successful padding oracle exploit attack .
private static void OnError(object sender, EventArgs e)
        {
            HttpContext context = HttpContext.Current;
            HttpRequest request = context.Request;
            HttpResponse response = context.Response;
            HttpServerUtility server = context.Server;
            Exception exception = server.GetLastError();
            if (exception is CryptographicException)
            {
                if (context.Items["BewareOfCryptographicException"] != null && context.Items["BewareOfCryptographicException"].ToString() == "true")
                {
                    EnhancedSecurity.DelayCryptographicExceptionResponse();
                    response.Clear();
                    response.ContentType = "text/html";
                    response.Output.WriteLine("<html><head><title>No</title></head><body>This isn't the oracle you're looking for.</body></html>");
                    response.End();
                }
                else
                {
                    EnhancedSecurity.DelaySuspiciousResponse();
                }
            }
            else
            {
                if (request.RawUrl.Contains(".axd"))
                {
                    context.ClearError();
                    response.StatusCode = 404;
                    throw new HttpException(404, "The resource you are looking for has been removed.");
                }
            }
        }
private static void OnError ( object sender , EventArgs e ) { HttpContext context = HttpContext . Current ; HttpRequest request = context . Request ; HttpResponse response = context . Response ; HttpServerUtility server = context . Server ; Exception exception = server . GetLastError ( ) ; if ( exception is CryptographicException ) { if ( context . Items [ " " ] != null && context . Items [ " " ] . ToString ( ) == " " ) { EnhancedSecurity . DelayCryptographicExceptionResponse ( ) ; response . Clear ( ) ; response . ContentType = " " ; response . Output . WriteLine ( " " ) ; response . End ( ) ; } else { EnhancedSecurity . DelaySuspiciousResponse ( ) ; } } else { if ( request . RawUrl . Contains ( " " ) ) { context . ClearError ( ) ; response . StatusCode = 404 ; throw new HttpException ( 404 , " " ) ; } } }
Detects a CryptographicException and delays the response to reduce the likelihood
of a successful padding oracle exploit attack.
Detects a CryptographicException and delays the response to reduce the likelihood of a successful padding oracle exploit attack .
sender
object
The HttpApplication that sent the request
The HttpApplication that sent the request
e
EventArgs
None