I have a web app that is nearing completion, and before it is deployed to the public, want to make sure that I have all my ducks in a row with regard to securtiy. It is written in asp.net, vb, ASPNET 3.5, AJAX, VS 2008 using Microsft SQL Server 2005.
Some things that I have done to be careful are:
I use Stored Procedures for all calls to the Database.
I make no calls to the databse with AJAX extensions or Java Script functions.
I use Forms Authentication for user security.
Also, I am considering using an old development machine running Windows XP , Service Pack 3 with IIS as a test server on the web. I am only running one web app on it. Are there security concerns that I should have over using a server running Windows Server 2008.
...
Go to the complete details ...