Improving Web Application Security: Threats and - CGISecurity

Chapter 5: Architecture and Design Review for Security 109How Do You Authenticate the Caller?Review the following aspects of authenticating a caller. The aspects you use dependon the type of authentication your design uses.●●●Do you pass clear text credentials over the wire?If you use Forms or Basic authentication, or if you use Web services and passcredentials in SOAP headers, make sure that you use SSL to protect the credentialsin transit.Do you implement your own user store?If so, check where and how the user credentials will be stored. A common mistakeis to store plaintext or encrypted passwords in the user store. Instead, you shouldstore a password hash for verification.If you validate credentials against a SQL Server user store, pay close attention tothe input user names and passwords. Check for the malicious injection of SQLcharacters.Do you use Forms authentication?If so, in addition to using SSL to protect the credentials, you should use SSL toprotect the authentication cookie. Also check that your design uses a limitedsession lifetime to counter the threat of cookie replay attacks and check that thecookie is encrypted.For more information about Forms authentication, see Chapter 10, “Building SecureASP.NET Web Pages and Controls” and Chapter 19, “Securing Your ASP.NETApplication and Web Services.”How Do You Authenticate with the Database?When your application connects to the database, examine what authenticationmechanism you will use, what account or accounts you plan to use, and how youplan to authorize the application in the database.The following questions help review your approach to database authentication:●Do you use SQL authentication?Ideally, your design uses Windows authentication to connect to SQL Serverbecause this is an inherently more secure approach. If you use SQL authentication,examine how you plan to secure credentials over the network and in databaseconnection strings.If your network infrastructure does not provide IPSec encrypted channels, makesure a server certificate is installed on the database to provide automatic SQLcredential encryption. Also examine how you plan to secure database connectionstrings because these strings contain SQL account user names and passwords.