Improving Web Application Security: Threats and - CGISecurity

138 Part III: Building Secure Web ApplicationsURL AuthorizationAdministrators can configure role-based security by using the element in Machine.config or Web.config. This element configures the ASP.NETUrlAuthorizationModule, which uses the principal object attached to the currentWeb request in order to make authorization decisions.The authorization element contains child and elements, which areused to determine which users or groups are allowed or denied access to specificdirectories or pages. Unless the element is contained within a element, the element in Web.config controls access to thedirectory in which the Web.config file resides. This is normally the Web application’svirtual root directory.The following example from Web.config uses Windows authentication and allowsBob and Mary access but denies everyone else:The following syntax and semantics apply to the configuration of the element:●●●●“*” refers to all identities.“?” refers to unauthenticated identities (that is, the anonymous identity).You do not need to impersonate for URL authorization to work.Users and roles for URL authorization are determined by your authenticationsettings:● When you have , you are authorizingaccess to Windows user and group accounts.User names take the form “DomainName\WindowsUserName”.Role names take the form “DomainName\WindowsGroupName”.Note The local administrators group is referred to as “BUILTIN\Administrators”. The localusers group is referred to as “BUILTIN\Users”.●When you have , you are authorizingagainst the user and roles for the IPrincipal object that was stored in thecurrent HTTP context. For example, if you used Forms to authenticate usersagainst a database, you will be authorizing against the roles retrieved fromthe database.