Improving Web Application Security: Threats and - CGISecurity

144 Part III: Building Secure Web ApplicationsSummaryThis chapter has introduced you to the .NET Framework security landscape bycontrasting user security and code security and by examining the securitynamespaces. The .NET Framework refers to these two types of security as role-basedsecurity and code access security, respectively. Both forms of security are layered ontop of Windows security.Role-based security is concerned with authorizing user access to applicationmanagedresources (such as Web pages) and operations (such as business and dataaccess logic). Code access security is concerned with constraining privileged codeand controlling precisely which code can access resources and perform otherprivileged operations. This is a powerful additional security mechanism for Webapplications because it restricts what an attacker is able to do, even if the attackermanages to compromise the Web application process. It is also an extremely powerfulfeature for providing application isolation. This is particularly true for hostingcompanies or any organization that hosts multiple Web applications on the sameWeb server.Additional ResourcesFor more information, see the following resources:●●For more information about code access security, see Chapter 8, “Code AccessSecurity in Practice,” and Chapter 9, “Using Code Access Security with ASP.NET.”For information about code access security and role-based security, see theMSDN article, “.NET Framework Security,” at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconnetframeworksecurity.asp.