Security

Optimizely meets high standards regarding security features within a wide range of scenarios. Login security in Optimizely Content Cloud (CMS) is based on the authentication and authorization system, and uses Introduction to Identity on ASP.NET Core, which provides an overview of security management in Optimizely.

Security management in CMS

The CMS platform handles the following common security concerns.

• Authentication and authorization. The authentication in CMS is based on the ASP.NET Core built-in framework for user and role. CMS uses a standard API that makes it easy to create your own provider for any type of user database, and third-party providers.

📘

Note

Where and how user credentials are stored, depends on the authentication provider used. The separation of authentication and authorization increases flexibility. Making a call to a provider lets you delegate security operations to a separate machine, thereby increasing scalability. CMS also supports single sign-on and federated claims-based authentication.

• Injection projection – CMS code uses parameterized APIs so that injection attacks cannot be carried out from untrusted input. There are no code paths in CMS that uses untrusted data in XML-related calls.
• Cross-site scripting (XSS) – In CMS, user input is filtered and validated to prevent XSS issues. Depending on the actual piece of information, CMS applies HTML encoding to the outgoing data stream to protect from XSS attacks. The editorial and administrative interfaces are areas where you can post HTML and scripts and use as-is on a web page. CMS relies on its authorization features to ensure that only trusted users can provide content.
• Broken authentication and session management – The CMS authentication and authorization system is based on the ASP.NET Core built-in framework for user/role. CMS does not rely on any session data, which increases security and improves scalability and performance because a browser session does not need server affinity from a security perspective.
• Insecure direct object references – In CMS, the references go through at least one layer of indirection with appropriate access controls in place.
• Cross-site request forgery (CSRF) – CMS has a CSRF prevention mechanism that automatically detects forged requests for system pages. The event validation mechanism in ASP.NET also is enabled for these pages. For the site pages, CMS supports and provides optional anti-forgery validation and the event validation.
• Security misconfiguration – Any configuration in CMS is designed with secure by default in mind. Strong security requires having a secure configuration defined and deployed for the application, frameworks, application server, Web server, database server, and platform. Each of these settings should be defined, implemented, and maintained because many are not shipped with secure enough defaults.
• Insecure cryptographic storage – CMS uses verified, strong algorithms. Only a small part of the CMS configuration information may contain sensitive information, such as the ConnectionStrings section. You can encrypt this information by the built-in .NET framework features. Optimizely stores other system assets in an SQL database with full support of the native encryption mechanisms of the database.
• Failure to restrict URL access – Sensitive areas of CMS, such as the edit and admin user interfaces, are protected by default with the standard configuration. Information presented on public-facing web pages are subject to authorization based on the content that is displayed. CMS never relies on security through a secret URL.
• Transport layer protection – The single-most common piece of sensitive information that is transmitted on the network are the user credentials (username and password). CMS fully supports the use of SSL (HTTPS protocol), and the use of SSL is strongly recommended.
• Unvalidated redirects and forwards – There is an absolute minimum of redirects in CMS because they are undesirable for security and performance. Existing redirects are based on internal data or sanitized information.
• Virus protection – CMS relies on third-party products for virus protection. CMS never executes files that are uploaded to the asset manager, preventing potential viruses inside files to spread to CMS.

ADFS/SSO and OWIN support

The CMS platform provides support for ADFS/SSO, and the OWIN standard interface between .NET web servers and applications. The following topics provide more information.

• Federated security
• Forms authentication
• OWIN authentication
• Configure mixed-mode OWIN authentication