Improving Web Application Security: Threats and - CGISecurity

Chapter 6: .NET Security Overview 133What is the code? What can the code do?(Evidence-based authentication) (Permission-basedAuthorization)CASPolicyUserCodeEvidenceCode Access SecuritySecure ResourcesPrivilegedOperationsWeb ApplicationFigure 6.2Logical view of code-based securityThe authentication (identification) of code is based on evidence about the code, forexample, its strong name, publisher, or installation directory. Authorization is basedon the code access permissions granted to code by security policy. For moreinformation about .NET Framework code access security, see Chapter 8, “CodeAccess Security in Practice.”.NET Framework Role-Based Security.NET Framework role-based security is a key technology that is used to authorize auser’s actions in an application. Roles are often used to enforce business rules. Forexample, a financial application might allow only managers to perform monetarytransfers that exceed a particular threshold.Role-based security consists of the following elements:●●●●Principals and identitiesPrincipalPermission objectsRole-based security checksURL authorization