Improving Web Application Security: Threats and - CGISecurity

154 Part III: Building Secure Web ApplicationsFor base classes, you can restrict which other code is allowed to derive from yourclass by using code access security inheritance demands. For more information, see“Authorizing Code” in Chapter 8, “Code Access Security in Practice.”Restrict Which Users Can Call Your CodeAnnotate classes and methods with declarative principal permission demands tocontrol which users can call your classes and class members. In the followingexample, only members of the specified Windows group can access the Orders class.A class level attribute like this applies to all class members. Declarative principalpermission demands can also be used on individual methods. Method level attributesoverride class level attributes.[PrincipalPermission(SecurityAction.Demand,Role=@"DomainName\WindowsGroup")]public sealed class Orders(){}Expose Fields Using PropertiesMake all fields private. To make a field value accessible to external types, use a readonly or a read/write property. Properties allow you to add additional constraints,such as input validation or permission demands, as shown in the following codesample.public sealed class MyClass{private string field; // field is private// Only members of the specified group are able to// access this public property[PrincipalPermission(SecurityAction.Demand,Role=@"DomainName\WindowsGroup")]public string Field{get {return field;}}}