English (English)

Securing your IIS server

When ABBYY FlexiCapture 12 is deployed, the default IIS security configuration settings are used. You can also set up additional rules for specific requests to make your web server more secure.

Important! If you encounter the "Due to browser policy restrictions, this URL cannot be opened using the insecure HTTP protocol. Please use the secure HTTPS protocol or change your browser policy." error while working with a web station, it means that you are using the product in iFrame over the unsecured HTTP protocol. For more information about the causes of the error and possible workarounds, see iFrame restrictions.

The Content-Security-Policy Header

The HTTP Strict-Transport-Security Header

The X-Powered-By and X-AspNet-Version Headers

The X-XSS-Protection Header

The X-Content-Type-Options Header

The Server Header

The X-Frame-Options header

Slow HTTP POST vulnerability

Using HTTPS instead of HTTP

Using up-to-date TLS version and strong ciphers

Protection Against Distributed Denial-of-Service Attacks

Distributed denial-of-service (DDoS) attacks involve overloading an application with HTTP requests, causing a significant increase in the amount of traffic and making the application inaccessible to legitimate users. It may not be easy to detect such attacks, as it is often difficult to distinguish between legitimate and malicious traffic.

To protect your web server from DDoS attacks, we recommend that you set up your IIS server to block access to your application if someone exceeds either the allowed number of requests over a certain period of time or the allowed number of concurrent requests.

To set up DDoS protection in IIS as described above, do the following:

Launch IIS Manager.
Select your website in the treeview and double-click the IP Address and Domain Restrictions icon on the site home page.
In the Actions pane, click Edit Dynamic Restriction Settings.
In the dialog box that opens, select the preferred method: Deny IP Address based on the number of concurrent requests or Deny IP Address based on the number of requests over a period of time.
Click OK.

In the IIS server settings, you can also restrict access to your application from specific IP addresses and specify the type of action that the server should perform when attempts are made to access your application from restricted IP addresses:

Launch IIS Manager.
Select your website in the treeview and double-click the IP Address and Domain Restrictions icon on the site home page.
In the Actions pane, click Edit Dynamic Restriction Settings.
In the dialog box that opens, select the desired type of action from the Deny Action Type drop-down list.
Click OK.

For cases where multiple HTTP requests are sent by multiple users from a single IP address, enable proxy mode in the IIS server settings. Doing so will let the proxy server pass the x-forwarded-for header to the web server to help identify the user.

To enable proxy mode, do the following:

Launch IIS Manager.
Select your website in the treeview and double-click the IP Address and Domain Restrictions icon on the site home page.
In the Actions pane, click Edit Feature Settings.
In the Edit IP and Domain Restriction Settings dialog box, select Enable Proxy Mode.
Click OK.

For more information about using IIS to restrict access to your application from certain IP addresses, please see the Microsoft documentation.

Note: Using the proxy mode for handling large amounts of traffic may affect system performance and make it harder for legitimate users to access your application.

4/12/2024 6:16:01 PM

Please leave your feedback about this article

Name

E-mail

Comment

Your use of this site is conditioned on Your continued compliance with the Terms of Use.

Terms of Use

Disclaimer of Warranty

Limitation of Liability

Transmission and Submission of Information

Downloads

Use of Content

Trademarks

Links to Third-Party Sites

Foreign Legislation

Subscription Terms

Partner Subscription Terms