SurePassID Identity Provider

Hardened web.config Guide

This document describes SurePassIdp/web.config.hardened, a security-hardened review copy of the application web.config. It explains every hardening change (the H# markers) and documents what each affected parameter means.

How to use this file: Review each change below in a staging environment, migrate the secrets to encrypted configuration or Azure Key Vault.

Summary of hardening changes

H1 — Remove secrets from clear text

Cryptographic material and credentials must never be committed in clear text. All exposed values should be rotated and stored encrypted (via aspnet_regiis / DPAPI / PKCS12) or in Azure Key Vault. See Documentation/Setup/WebConfig-Encryption-Guide.md for the full encryption workflow.

Affected settings (placeholder values indicate the secret must be supplied securely):

configProtectedData provider (commented template)

A Pkcs12Provider block is included (commented) so appSettings and the SMTP section can be encrypted using a certificate. PKCS12 works for both single servers and server farms; DPAPI (DataProtectionConfigurationProvider) is single-server only. Azure-hosted deployments should use the existing Azure Key Vault path.

H2 — Disable production tracing

H3 — Compilation settings

<compilation debug="false" targetFramework="4.8" />

• debug="false" — Required in production. Disables debug binaries, prevents detailed compiler-generated diagnostics, and improves performance.
• targetFramework="4.8" — Corrected to the actual target framework so runtime behavior/quirks match .NET Framework 4.8.

H4 — Custom errors

<customErrors mode="RemoteOnly" defaultRedirect="~/Error.aspx" />

• mode="RemoteOnly" — Detailed error pages are shown only to local (server) requests; remote clients never see stack traces.
• defaultRedirect="~/Error.aspx" — Generic error page shown to clients. Provide an Error.aspx.

H5 — httpRuntime hardening

<httpRuntime enableVersionHeader="false"
             targetFramework="4.8"
             maxRequestLength="4096"
             requestValidationMode="4.5"
             maxUrlLength="2048"
             maxQueryStringLength="2048" />

H6 — Secure cookies

<httpCookies httpOnlyCookies="true" requireSSL="true" sameSite="Strict" />

H7 — Session state hardening

<sessionState mode="InProc"
              timeout="20"
              cookieless="UseCookies"
              cookieSameSite="Strict"
              regenerateExpiredSessionId="true" />

Related commented guidance is included for enforcing requireSSL on Forms auth and for defining an explicit machineKey in web-farm scenarios.

H8 — IIS error handling

<httpErrors errorMode="DetailedLocalOnly" existingResponse="Auto" />
<asp scriptErrorSentToBrowser="false" />

• errorMode="DetailedLocalOnly" — Detailed IIS errors only for local requests; remote clients get generic errors.
• existingResponse="Auto" — Lets the app-provided error response pass through when present.
• scriptErrorSentToBrowser="false" — Classic ASP script errors are not leaked to the browser.

H9 — Security response headers

<security>
  <requestFiltering removeServerHeader="true">
    <requestLimits maxAllowedContentLength="4194304" />
  </requestFiltering>
</security>

<httpProtocol>
  <customHeaders>
    <remove name="X-Powered-By" />
    <add name="X-Content-Type-Options" value="nosniff" />
    <add name="X-Frame-Options" value="SAMEORIGIN" />
    <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
    <add name="X-XSS-Protection" value="0" />
    <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" />
  </customHeaders>
</httpProtocol>

A Content-Security-Policy header is provided but commented out; tune it to the app's assets before enabling site-wide. The defaultDocument list is also trimmed to remove unused default files.

H10 — Managed modules

<modules runAllManagedModulesForAllRequests="false">

• runAllManagedModulesForAllRequests="false" — Managed modules do not run for every request (including static files), reducing attack surface and improving performance.

H11 — Diagnostics trace switch

<source name="SSOTrace" switchValue="Warning">

• switchValue="Warning" — Lowered from All so only warnings and errors are logged, reducing the volume of potentially sensitive diagnostic output.

Non-hardening settings (unchanged, for reference)

These application settings are not part of the hardening changes but appear in the file:

• Connection. Connection.ConnectionType, Connection.Database, Connection.Server, Connection.Username, Connection.Options (now includes Encrypt=True;TrustServerCertificate=False for TLS to SQL), Connection.AuthenticationMethod (0=SQL auth, 1=Windows auth, recommended).
• System key management. System.KeyType, System.KeyEndPoint (plus optional Pkcs11.* HSM block).
• Support/Server/Authorization. Help site, product/company names, Server.AppId, push endpoints, Authorization.ServerURL, System.Login2FAMethods.
• FIDO. FIDO.PasswordlessEnabled, FIDO.SecondFactorEnabled.
• EAM (Entra External Authentication Method). Eam.* client, redirect, ACR, and discovery settings. Production redirect/discovery URLs should use HTTPS, not http/localhost.
• Caching. SamlCache.Provider (InMemory or SqlServer), SamlCache.RequestIdExpirationMinutes, SamlCache.SessionExpirationHours. See Documentation/Setup/SAML2-WebConfig-Settings-And-Caching.md.

Deployment checklist

1. Rotate every exposed secret (DB, SMTP, System.Key/IV/Salt, NameID salt).
2. Encrypt appSettings and system.net/mailSettings/smtp per WebConfig-Encryption-Guide.md, or move secrets to Key Vault.
3. Ensure the trace/log directory (Server.TracePath) exists and is writable only by the app pool identity.
4. Provide Error.aspx for customErrors.
5. Grant the app pool identity Read on the PKCS12 certificate private key (if used).
6. Validate in staging, then rename web.config.hardened to web.config.