Improving Web Application Security: Threats and - CGISecurity

Chapter 6: .NET Security Overview 141●SupressUnmanagedSecurityAttribute. Used to optimize performance andeliminate the demand for the unmanaged code permission issued by the PlatformInvocation Services (P/Invoke) and Component Object Model (COM)interoperability layers. This attribute must be used with caution because it exposesa potential security risk. If an attacker gains control of unmanaged code, he is nolonger restricted by code access security. For more information about using thisattribute safely, see “Unmanaged Code” in Chapter 8, “Code Access Security inPractice.”System.Web.SecurityThis namespace contains the classes used to manage Web application authenticationand authorization. This includes Windows, Forms, and Passport authentication andURL and File authorization, which are controlled by the UrlAuthorizationModuleand FileAuthorizationModule classes, respectively. The types you are most likely touse when you build secure Web applications are:● FormsAuthentication. Provides static methods to help with Forms authenticationand authentication ticket manipulation.● FormsIdentity. Used to encapsulate the user identity that is authenticated byForms authentication.● PassportIdentity. Used to encapsulate the user identity that is authenticated byPassport authentication.System.Security.CryptographyThis namespace contains types that are used to perform encryption and decryption,hashing, and random number generation. This is a large namespace that containsmany types. Many encryption algorithms are implemented in managed code,while others are exposed by types in this namespace that wrap the underlyingcryptographic functionality provided by the Microsoft Win32 ® -based CryptoAPI.System.Security.PrincipalThis namespace contains types that are used to support role-based security. They areused to restrict which users can access classes and class members. The namespaceincludes the IPrincipal and IIdentity interfaces. The types you are most likely to usewhen building secure Web applications are:● GenericPrincipal and GenericIdentity. Allow you to define your own roles anduser identities. These are typically used with custom authentication mechanisms.● WindowsPrincipal and WindowsIdentity. Represents a user who is authenticatedwith Windows authentication together with the user’s associated Windows group(role) list.