Building Secure ASP.NET Applications - People Search Directory

Chapter 11: .NET Remoting Security 263
●
●
●
HttpChannel. This channel is designed to be used when you host a remote object
in ASP.NET. This channel uses the HTTP protocol to send messages between the
client and the server.
TcpChannel. This channel is designed to be used when you host a remote object
in a Microsoft® Windows® operating system service or other executable. This
channel uses TCP sockets to send messages between the client and the server.
Custom channels. A custom transport channel can use any underlying transport
protocol to send messages between the client and server. For example, a custom
channel may use named pipes or mail slots.
Comparing Transport Channel Sinks
The following table provides a comparison of the two main transport channel sinks.
Table 11.1: Comparison of TcpChannel and HttpChannel
Feature TCP Channel HTTP Channel Comments
Authentication No Yes The HTTP channel uses the authentication
features provided by IIS and ASP.NET,
although Passport and Forms authentication
is not supported.
Authorization No Yes The HTTP channel supports the authorization
features provided by IIS and
ASP.NET. These include NTFS
permissions, URL authorization and File
authorization.
Secure Yes Yes Use IPSec with the TCP channel. Use
Communication
SSL and/or IPSec with the HTTP channel.
Custom Sinks
Custom channels sinks can be used at different locations within the channel sink
pipeline to modify the messages sent between the client and the server. A channel
sink that provides encryption and decryption is an example of a custom channel sink.
Formatter Sinks
Formatter sinks take method calls and serialize them into a stream capable of being
sent across the network. .NET supplies two formatter sinks:
● Binary Formatter. This uses the BinaryFormatter class to package method calls
into a serialized binary stream, which is subsequently posted (using an HTTP
POST) to send the data to the server. The binary formatter sets the content-type
in the HTTP request to “application/octet-stream.”