Security

Optimizely meets high standards regarding security features within a wide range of scenarios. Login security in Optimizely Content Management System (CMS) is based on the authentication and authorization system. It uses Introduction to Identity on ASP.NET Core, which provides an overview of security management in Optimizely.

Security management in CMS

The Optimizely platform handles the following common security concerns.

• Authentication and authorization. The authentication in CMS is based on the ASP.NET Core built-in framework for user and role. CMS uses a standard API, making creating your provider for any user database and third-party providers easy.

  📘

  Note

  Where and how user credentials are stored, depends on the authentication provider used. The separation of authentication and authorization increases flexibility. Making a call to a provider lets you delegate security operations to a separate machine, thereby increasing scalability. CMS also supports single sign-on and federated claims-based authentication.

• Injection projection – CMS code uses parameterized APIs so that injection attacks cannot be carried out from untrusted input. No code paths in CMS use untrusted data in XML-related calls.
• Cross-site scripting (XSS) – In CMS, user input is filtered and validated to prevent XSS issues. Depending on the actual piece of information, Optimizely applies HTML encoding to the outgoing data stream to protect it from XSS attacks. The editorial and administrative interfaces are areas where you can post HTML and scripts and use them as-is on a web page. CMS relies on its authorization features to ensure that only trusted users can provide content.
• Broken authentication and session management – The CMS authentication and authorization system is based on the ASP.NET Core built-in framework for user and role. CMS does not rely on any session data, which increases security and improves scalability and performance because a browser session does not need server affinity from a security perspective.
• Insecure direct object references – In CMS, the references go through at least one layer of indirection with appropriate access controls in place.
• Cross-site request forgery (CSRF) – CMS has a CSRF prevention mechanism that automatically detects forged requests for system pages. The event validation mechanism in ASP.NET also is enabled for these pages. Optimizely supports and provides optional anti-forgery and event validation for the site pages.
• Security misconfiguration – Any configuration in CMS is designed with secure by default in mind. Strong security requires having a secure configuration defined and deployed for the application, frameworks, application server, Web server, database server, and platform. These settings should be defined, implemented, and maintained because many are not shipped with secure enough defaults.
• Insecure cryptographic storage – CMS uses verified, strong algorithms. Only a small part of the CMS configuration information may contain sensitive information, such as the ConnectionStrings section. You can encrypt this information with the built-in .NET framework features. Optimizely stores other system assets in an SQL database with the full support of the database's native encryption mechanisms.
• Failure to restrict URL access – Sensitive areas of CMS, such as the edit and admin user interfaces, are protected by default with the standard configuration. Information presented on public-facing web pages is subject to authorization based on the displayed content. CMS never relies on security through a secret URL.
• Transport layer protection – The most common sensitive information transmitted on the network is the user credentials (username and password). CMS fully supports SSL (HTTPS protocol) and strongly recommends SSL.
• Unvalidated redirects and forwards – There is an absolute minimum of redirects in CMS because they are undesirable for security and performance. Existing redirects are based on internal data or sanitized information.
• Virus protection – CMS relies on third-party products for virus protection. Optimizely never executes files uploaded to the asset manager, preventing potential viruses inside files from spreading to Optimizely.

📘

Looking for CMS 11 Security information?

• OWIN authentication
• Configure mixed-mode OWIN authentication
• Forms authentication
• Recommendations for ASP.NET security settings
• Federated security
• Cookie usage
• Protect users from session hijacking
• Secure edit and admin user interfaces
• Configure Active Directory membership provider
• Authentication and authorization