In some cases, you may need to use super-secure configuration where any non-standard GET or POST parameter sent to your website results in an error. This allows you to avoid some of the possible vulnerabilities, including cross-site scripting and SQL injection.

 

This functionality is only used for the website, not for the administration interface.

 

How to configure the allowed parameters

 

First, you need to enable allowed parameter checking in the web.config file by setting the value CMSCheckParameters to true:

 

 

If you're not sure which parameters cause the problem, you can turn on reporting using the following web.config key:

 

 

All parameters are defined in the ~/parameters.config file. The schema of the file is described in the file itself and it's rather simple. For every page or site section, you need to define a new <location> section with path specifying the page and allowed form (POST) and query (GET) parameters. The following example allows URL parameter pagenumber in the whole products section of the website:

 

 

The path location specifies the path of the pages based on their alias path in Kentico CMS, while the page location is used for single pages that are not part of the Kentico CMS content (custom applications, etc.). The page location starts at the root of the web application and is used without slash (/) at the beginning.

 

Default allowed parameters

 

The common parameters of ASP.NET web forms and URL parameters aliaspath and lang are allowed by default.