Improving Web Application Security: Threats and - CGISecurity

136 Part III: Building Secure Web ApplicationsThe following example shows imperative security syntax using aPrincipalPermission object.PrincipalPermission permCheck = new PrincipalPermission(null, @"DomainName\WindowsGroup");permCheck.Demand();To avoid a local variable, the code above can also be written as:(new PrincipalPermission(null, @"DomainName\WindowsGroup")).Demand();The code creates a PrincipalPermission object with a blank user name and a specifiedrole name, and then calls the Demand method. This causes the common languageruntime to interrogate the current Principal object that is attached to the currentthread and check whether the associated identity is a member of the specified role.Because Windows authentication is used in this example, the role check uses aWindows group. If the current identity is not a member of the specified role, aSecurityException is thrown.The following example shows how to restrict access to an individual user.(new PrincipalPermission(@"DOMAINNAME\James", null)).Demand();Declarative vs. Imperative SecurityYou can use role-based security (and code access security) either declaratively usingattributes or imperatively in code. Generally, declarative security offers the mostbenefits, although sometimes you must use imperative security (for example, whenyou need to use variables that are only available at runtime) to help make a securitydecision.Advantages of Declarative SecurityThe main advantages of declarative security are the following:● It allows the administrator or assembly consumer to see precisely which securitypermissions that particular classes and methods must run. Tools such aspermview.exe provide this information. Knowing this information at deploymenttime can help resolve security issues and it helps the administrator configure codeaccess security policy.● It offers increased performance. Declarative demands are evaluated only once atload time. Imperative demands inside methods are evaluated each time themethod that contains the demand is called.