Forum Discussion
R__Winters_7757
Nimbostratus
NimbostratusAllowing default-disallowed characters
We are having an issue where users are getting blocked when they try and create or use a password that contains % or @. As these characters are disallowed by default, we are considering allowing them for this parameter.
My question is what security risks are we facing by allowing these characters? The application is ASP.NET and the parameter is never echoed back to the user.
hooleylistCirrostratus
If the characters legitimately need to be used in the app, I wouldn't hesitate to relax the policy. Password fields are generally one parameter where you allow all standard ascii metacharacters assuming the application allows them. You can still use the attack sigs to provide protection.
Aaron