Secure your IIS server - ABBYY Documentation

When ABBYY FlexiCapture 12 is deployed, the default IIS security configuration settings are used. You can also set up additional rules for specific requests to make your web server more secure.

Content-Security-Policy header

Content Security Policy (CSP) is a security standard used by modern browsers to protect against data injection attacks, such as cross-site scripting (XSS). CSP uses a whitelist to determine which resources are safe to load and ignores unverified sources. It also logs any attempts to bypass the security policy. To use this policy, give the server a Content-Security-Policy HTTP header with one or more directives. Each directive covers a specific resource type. Directives set out a security policy by declaring rules for resources. To set up CSP for your browser, add the following code into your web.config file:

<system.webServer> 
<httpProtocol> 
<customHeaders> 
<add name="Content-Security-Policy" value="default-src https: data: 'unsafe-inline' 'unsafe-eval'" /> 
</customHeaders> 
</httpProtocol> 
</system.webServer>

To integrate ABBYY FlexiCapture with third-party systems that need access to other hosts, specify those hosts in the web.config file.

Check that the software still operates correctly each time you change a security configuration setting.

For more information about the Content-Security-Policy header, see this website.

HTTP Strict-Transport-Security header

HTTP Strict-Transport-Security (HSTS) restricts every interaction between the browser and the website to a secure SSL connection. A web server that has HSTS set up contains an instruction for the browser to exclusively use HTTPS and forbids it from using HTTP. HSTS is primarily used to fend off interception attacks involving queries and responses, for example, MITM (Man-In-The-Middle) attacks. To be able to use this security policy, you need to use URL address rewrite rules to add a Strict-Transport-Security (STS) header to HTTP responses. This is necessary to prevent unwanted HTTP queries and redirect all HTTP traffic to HTTPS (based on the logic set out in the rules). To set up the rules, you need to install the URL Rewrite module. For more information, see the Microsoft website. To set up HSTS for your browser, add the following code into your web.config file:

<rule name="Add the STS header in HTTPS responses">
<match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />
<conditions>
<add input="{HTTPS}" pattern="on" />
</conditions>
<action type="Rewrite" value="max-age=31536000" />
</rule>

The max-age directive sets how long, in seconds, the rule applies. The value 31536000 is one year. For more information, see HSTS in IIS 10 version 1709 in the Microsoft documentation.

X-Powered-By and X-AspNet-Version headers

Apart from HTTP headers that are essential for improving the security of your web server, there are also headers that are optional. Optional headers are often governed by no standard at all. They also add traffic to every HTTP query, which makes malicious attacks easier. The following are two such optional headers:

X-Powered-By is an HTTP header that contains information about various technologies used by the web server.
X-AspNet-Version is an HTTP header that contains information about the ASP.NET version that is used to deploy applications on the web server.

By default, server responses include both X-Powered-By and X-AspNet-Version. Disable them. Identifying information about the server is a security threat. To remove the X-Powered-By header from the IIS configuration, paste the following code into your web.config file:

<httpProtocol> 
<customHeaders> 
<remove name="X-Powered-By" />   
</customHeaders></httpProtocol>

To remove the X-AspNet-Version header from your IIS configuration, paste the following code into your web.config file:

<httpRuntime enableVersionHeader="false" />

X-XSS-Protection header

X-XSS-Protection is an HTTP header that is used by browsers to prevent Cross-Site Scripting attacks. The header works by enabling an XSS filter, which intercepts unwanted attempts to insert malicious third-party code into web pages opened on a browser. X-XSS-Protection is compatible with the following browsers: Internet Explorer 8+, Chrome, and Safari. Most modern browsers apply a stricter security policy, such as Content-Security-Policy. This header is therefore only necessary on an older browser with no CSP support. To enable the X-XSS-Protection header for your browser, copy the following code to your web.config file:

<system.webServer> 
<httpProtocol> 
<customHeaders> 
<add name="X-XSS-Protection" value="1; mode=block" /> 
</customHeaders> 
</httpProtocol> 
</system.webServer>

X-Content-Type-Options header

X-Content-Type-Options is an HTTP header that browsers use to block attacks exploiting MIME (Multipurpose Internet Mail Extensions) vulnerabilities. MIME is an Internet standard for content sent over an internet connection. Browsers process each file the web server delivers according to its MIME type. They determine the resource type from the Content-Type response, or by inspecting the resource contents. That second route lets attackers mask HTML files as another type. The only directive available for this header is the nosniff directive. It instructs browsers to use only the MIME type that was specified by the web server. To enable the X-Content-Type-Options header for your browser, paste the following code into your web.config file:

<system.webServer> 
<httpProtocol> 
<customHeaders> 
<add name="X-Content-Type-Options" value="nosniff" /> 
</customHeaders> 
</httpProtocol> 
</system.webServer>

Server header

Server Header is a response header describing the application the source server used to process a request, including its version number. Exposing that information to third parties is a security threat, so delete the contents of the Server Header. To delete the contents of the Server Header, add the following code into your web.config file:

<rewrite>  
     <outboundRules rewriteBeforeCache="true"> 
    <rule name="Remove Server header"> 
      <match serverVariable="RESPONSE_Server" pattern=".+" /> 
      <action type="Rewrite" value="" /> 
    </rule>   
</outboundRules> 
</rewrite>

If you are using IIS 10.0, Windows Server 2016 or later, use the following code instead:

Set-WebConfigurationProperty  
-pspath 'MACHINE/WEBROOT/APPHOST'   
-filter "system.webServer/security/requestFiltering"  
-name "removeServerHeader"  
-value "True"

These settings require the URL Rewrite module.

For more information, see using the URL Rewrite module in the Microsoft documentation.

X-Frame-Options header

By default, other companies’ websites can embed ABBYY FlexiCapture Web Stations in an iFrame. If framesniffing is a concern, block cross-domain framing.

Prevent cross-domain framing

Select the site

In the Connections pane on the left side, expand the Sites folder and select the site that you want to protect.

Open HTTP Response Headers

Double-click the HTTP Response Headers icon in the feature list in the middle.

Add a header

In the Actions pane on the right side, click Add.

Set the X-Frame-Options value

In the dialog box that opens, type X-Frame-Options in the Name field and type SAMEORIGIN or DENY in the Value field.

For more information, see mitigating framesniffing with the X-Frame-Options header in the Microsoft documentation.

Slow HTTP POST vulnerability

Slow HTTP POST vulnerability is a variation of a slow HTTP Denial of Service attack (DoS), otherwise referred to as the Slowloris HTTP attack. In a slow HTTP POST attack, the attacker declares a large amount of data for an HTTP POST request and then sends it very slowly. To close the vulnerability, set up Web Limits in the IIS configs on every machine running the Application Server. Set limits for the following parameters:

ConnectionTimeout
MinFileBytesPerSec

For more information, see the weblimits element in the Microsoft documentation.

Use HTTPS instead of HTTP

HTTP has no mechanism for encrypting data. HTTPS adds an SSL or TLS Digital Certificate that secures communication between server and client. Force all traffic between the user’s browser and the web server over HTTPS. HTTP operates on port 80 by default, so close that port to prevent its use.

Use an up-to-date TLS version and strong ciphers

TLSv1.1 is a weak encryption protocol. An attacker can exploit it to read secure communications or modify messages. Always use the latest version of TLS you can, with strong ciphers only. For a list of appropriate ciphers, see server side TLS in the Mozilla wiki.

Configure the SSL cipher suite order via group policy

Open the Group Policy editor

At a command prompt, enter gpedit.msc. The Group Policy Object Editor appears.

Open the SSL configuration settings

Expand Computer Configuration, Administrative Templates, Network, and then click SSL Configuration Settings.

Open the cipher suite order

Under SSL Configuration Settings, click the SSL Cipher Suite Order setting.

Scroll to the instructions

In the SSL Cipher Suite Order pane, scroll to the bottom of the pane.

Modify the setting

Follow the instructions labeled How to modify this setting.

Restart the computer to apply the changes.

Protection against distributed denial-of-service attacks

A distributed denial-of-service (DDoS) attack overloads an application with HTTP requests. Traffic rises sharply and the application becomes unreachable for legitimate users. It may not be easy to detect such attacks, as it is often difficult to distinguish between legitimate and malicious traffic. Set IIS to block a client that exceeds either the allowed number of requests in a period or the allowed number of concurrent requests.

Block clients that exceed request limits

Open IP Address and Domain Restrictions

Launch IIS Manager, select your website in the tree view, and double-click the IP Address and Domain Restrictions icon on the site home page.

Edit the dynamic restriction settings

In the Actions pane, click Edit Dynamic Restriction Settings.

Choose a deny method

In the dialog box that opens, select one of two methods:

Deny IP Address based on the number of concurrent requests
Deny IP Address based on the number of requests over a period of time

Save the settings

Click OK.

Restrict access from specific IP addresses

IIS can also block specific IP addresses, and you choose what the server does when a restricted address tries to reach your application.

Open IP Address and Domain Restrictions

Launch IIS Manager, select your website in the tree view, and double-click the IP Address and Domain Restrictions icon on the site home page.

Edit the dynamic restriction settings

In the Actions pane, click Edit Dynamic Restriction Settings.

Choose a deny action

In the dialog box that opens, select the type of action from the Deny Action Type drop-down list.

Save the settings

Click OK.

Enable proxy mode for shared IP addresses

When several users send HTTP requests from one IP address, enable proxy mode in the IIS server settings. The proxy server then passes the x-forwarded-for header to the web server, which helps identify the individual user.

Open IP Address and Domain Restrictions

Launch IIS Manager, select your website in the tree view, and double-click the IP Address and Domain Restrictions icon on the site home page.

Edit the feature settings

In the Actions pane, click Edit Feature Settings.

Enable proxy mode

In the Edit IP and Domain Restriction Settings dialog box, select Enable Proxy Mode.

Save the settings

Click OK.

For more information about using IIS to restrict access to your application from certain IP addresses, see the Microsoft documentation.

Under heavy traffic, proxy mode can degrade system performance and block legitimate users from your application.

​Content-Security-Policy header

​HTTP Strict-Transport-Security header

​X-Powered-By and X-AspNet-Version headers

​X-XSS-Protection header

​X-Content-Type-Options header

​Server header

​X-Frame-Options header

​Prevent cross-domain framing

​Slow HTTP POST vulnerability

​Use HTTPS instead of HTTP

​Use an up-to-date TLS version and strong ciphers

​Configure the SSL cipher suite order via group policy

​Protection against distributed denial-of-service attacks

​Block clients that exceed request limits

​Restrict access from specific IP addresses

​Enable proxy mode for shared IP addresses

Content-Security-Policy header

HTTP Strict-Transport-Security header

X-Powered-By and X-AspNet-Version headers

X-XSS-Protection header

X-Content-Type-Options header

Server header

X-Frame-Options header

Prevent cross-domain framing

Slow HTTP POST vulnerability

Use HTTPS instead of HTTP

Use an up-to-date TLS version and strong ciphers

Configure the SSL cipher suite order via group policy

Protection against distributed denial-of-service attacks

Block clients that exceed request limits

Restrict access from specific IP addresses

Enable proxy mode for shared IP addresses