A recent audit says we need to define default documents in virtual directors to avoidURL parameter manipulation attacks. Browsing the virtual directories now shows only a blank page. Is the auditor correct? I'd rather not go messing with a working web site. I'm using IIS v10.
↧