SharePoint Error: Error during decryption. Ensure the passphrase is correct

Sometimes, when you try to join another server to SP farm, you get this error:

Error during decryption. Ensure the passphrase is correct

To solve it, do the following:

1. Make sure the passphrase is correct.

2. Stop SharePoint timer job in all nodes.

3. Go to the bath: C:\ProgramData\Microsoft\SharePoint\Config\ 

4. Delete all files.

5. Repeat step 3 and 4 in all nodes.

6. Run the SharePoint timer job in all nodes.

7. Run the configuration wizard again and it will work 

Service Security Tips (2)

In this article, I going to continue talking about service security.

QueryString

Most of services are using QueryString to pass variables throw pages. Those variables maybe encrypted, which gives more security about values, and it maybe passed without encryption.
The best practice when you pass query string to check the following points in the landing page:

1. Make sure you encrypt the value passed. especially when you pass string values.
2. If you pass an ID, for example, check if the current logged in user has permission to see the passed ID or not. Because this ID maybe incremental ID and the user maybe play in the value which, for sure, affect the values to be display in the page.

for example, when user register, the system will redirect him to details page and pass QueryString ID, http://mySite/Details.aspx?UserID=1,  and the details page will load the information related to passed ID. You should prevent user to display information about another user, http://mySite/Details,aspx?UserID=2.

Disable Sensitive Information for Error Messages

Some services has missing configuration, which leads to display sensitive information in error message page like the following:

The above page shows that the service is used Xceed.Chart.GrphicsGL.V4.3.dll which is component should be embedded inside the service and the end user should not know about it,
To fix this issue, you should create custom error page and redirect user to this page if any issue happened.

Directory Browsing

When you create a service and deploy it on server, the service may contains different folder, files, images, styles, scripts ... etc. Some of those files should NOT be brows-able from end user side.
for example, the log file in logs folder which deployed in the root, should not be appeared for end users and if the user type: http://mySite/logs/log.txt the log should not be appeared.
To prevent user to browse the file, you should put web.config file inside the folder, logs for example, and describe which roles are allowed to  browse this file.

To be contiue...

Service Security Tips (1)

The most important part when you provide a service to your client to make this service secure enough.
It is not related to firewall or access privileges or other network-related issues, it is related to service it self.
In this article, I will provide, based on my SOA study and my development background, some tips to make your service secure enough..

HTML data

Some developer write sensitive information in HTML. For example there maybe shared control between different role, and if the current logged in user in role X, appear the dev X and hide dev Y which is related to role Y.

From the example above, the 'divAdmin' data should appeared for admins only, otherwise hide it.
But we can see the data of 'divAdmin' even if user logged in as 'EndUser' role or any other role by browsing the HTML in browser:

ClickJacking

ClickJacking means providing additional and embedded transportation layer which may transport sensitive information, like username and password or credit card information, to attacker.
This is usually happened when someone access your site through <iframe src="URL"></iframe> in HTML.
To prevent this lack of security, you should add custom header in your HTTP request by following the following steps:
1. Open web.config
2. Go to <system.webserver> tag
3. Put the following lines:

<httpProtocol>

    <customHeaders>

      <add name="X-Frame-Options" value="SAMEORIGIN" />

    </customHeaders>

  </httpProtocol>

To be continue ...