Improving Web Application Security: Threats and - CGISecurity

xiiImproving Web Application Security: Threats and CountermeasuresCryptography .......................................................................................................... 119Why Do You Use Particular Algorithms?................................................................. 119How Do You Secure Encryption Keys?................................................................... 120Parameter Manipulation .......................................................................................... 120Do You Validate All Input Parameters? .................................................................. 121Do You Pass Sensitive Data in Parameters?.......................................................... 121Do You Use HTTP Header Data for Security? ......................................................... 121Exception Management ........................................................................................... 122Do You Use Structured Exception Handling?.......................................................... 122Do You Reveal Too Much Information to the Client? ............................................... 122Auditing and Logging ............................................................................................... 123Have You Identified Key Activities to Audit? ........................................................... 123Have You Considered How to Flow Original Caller Identity? ..................................... 124Have You Considered Secure Log File Management Policies? ................................. 124Summary ............................................................................................................... 124Additional Resources .............................................................................................. 125Part IIIBuilding Secure Web Applications 127Chapter 6.NET Security Overview 129In This Chapter ....................................................................................................... 129Overview ................................................................................................................ 129How to Use This Chapter ......................................................................................... 130Managed Code Benefits .......................................................................................... 130User vs. Code Security ............................................................................................ 131Role-Based Security ............................................................................................ 131Code Access Security.......................................................................................... 132.NET Framework Role-Based Security........................................................................ 133Principals and Identities ...................................................................................... 134PrincipalPermission Objects................................................................................. 134Role-Based Security Checks................................................................................. 137URL Authorization ............................................................................................... 138.NET Framework Security Namespaces ..................................................................... 139System.Security.................................................................................................. 140System.Web.Security........................................................................................... 141System.Security.Cryptography .............................................................................. 141System.Security.Principal..................................................................................... 141System.Security.Policy......................................................................................... 142System.Security.Permissions ............................................................................... 142Summary ............................................................................................................... 144Additional Resources .............................................................................................. 144