Improving Web Application Security: Threats and - CGISecurity

xviImproving Web Application Security: Threats and CountermeasuresEnvironment Variables ............................................................................................. 211Constraining Environment Variable Access ............................................................ 211Requesting EnvironmentPermission...................................................................... 211Web Services ......................................................................................................... 212Constraining Web Service Connections ................................................................. 212Sockets and DNS.................................................................................................... 213Constraining Socket Access................................................................................. 213Requesting SocketPermission and DnsPermission................................................. 214Unmanaged Code ................................................................................................... 214Use Naming Conventions to Indicate Risk ............................................................. 214Request the Unmanaged Code Permission............................................................ 215Sandbox Unmanaged API Calls............................................................................. 215Use SuppressUnmanagedCodeSecurity with Caution ............................................. 216Delegates............................................................................................................... 217Serialization ........................................................................................................... 218Restricting Serialization....................................................................................... 218Summary ............................................................................................................... 219Additional Resources .............................................................................................. 219Chapter 9Using Code Access Security with ASP.NET 221In This Chapter ....................................................................................................... 221Overview ................................................................................................................ 221How to Use This Chapter ......................................................................................... 223Resource Access .................................................................................................... 223Full Trust and Partial Trust ....................................................................................... 224Configuring Code Access Security in ASP.NET ........................................................... 225Configuring Trust Levels....................................................................................... 225Locking the Trust Level ........................................................................................ 226ASP.NET Policy Files................................................................................................ 227ASP.NET Policy ....................................................................................................... 227Inside an ASP.NET Policy File ............................................................................... 228Permission State and Unrestricted Permissions .................................................... 229The ASP.NET Named Permission Set .................................................................... 229Substitution Parameters...................................................................................... 230Developing Partial Trust Web Applications ................................................................. 231Why Partial Trust? ............................................................................................... 231Problems You Might Encounter............................................................................. 231Trust Levels............................................................................................................ 232Approaches for Partial Trust Web Applications ........................................................... 234Customize Policy..................................................................................................... 235Sandbox Privileged Code ......................................................................................... 236A Sandboxing Pattern .......................................................................................... 236