Improving Web Application Security: Threats and - CGISecurity

Chapter 6: .NET Security Overview 139●●When you have , you authorize againstthe Passport User ID (PUID) or roles retrieved from a store. For example, youcan map a PUID to a particular account and set of roles stored in a MicrosoftSQL Server database or Active Directory.When you have , you may not beperforming authorization. “None” specifies that you do not want to performany authentication or that you do not want to use any of the ASP.NETauthentication modules, but you do want to use your own custom mechanism.However, if you use custom authentication, you should create an IPrincipalobject with roles and store it in the HttpContext.Current.User property Whenyou subsequently perform URL authorization, it is performed against the userand roles (no matter how they were retrieved) maintained in the IPrincipalobject.Configuring Access to a Specific FileTo configure access to a specific file, place the element inside a element as shown below.You can also point the path attribute at a specific folder to apply access control to allthe files in that particular folder. For more information about the element,see Chapter 19, “Securing Your ASP.NET Application.”.NET Framework Security NamespacesTo program .NET Framework security, you use the types in the .NET Frameworksecurity namespaces. This section introduces these namespaces and the types thatyou are likely to use when you develop secure Web applications. For a full list oftypes, see the .NET Framework documentation. The security namespaces are listedbelow and are shown in Figure 6.3.● System.Security● System.Web.Security● System.Security.Cryptography● System.Security.Principal● System.Security.Policy● System.Security.Permissions