Improving Web Application Security: Threats and - CGISecurity

158 Part III: Building Secure Web Applications3. The delay signing process and the absence of an assembly signature means thatthe assembly will fail verification at load time. To work around this, use thefollowing commands on development and test computers.● To disable verification for a specific assembly, use the following command.sn -Vr assembly.dll●To disable verification for all assemblies with a particular public key, use thefollowing command.sn -Vr *,publickeytoken●To extract the public key and key token (a truncated hash of the public key),use the following command.sn -Tp assembly.dllNote Use a capital –T switch.4. To fully complete the signing process and create a digital signature to make theassembly tamper proof, execute the following command. This requires the privatekey and as a result the operation is normally performed as part of the formalbuild/release process.sn -r assembly.dll keypair.snkASP.NET and Strong NamesAt the time of this writing, it is not possible to use a strong name for an ASP.NET Webpage assembly because of the way it is dynamically compiled. Even if you use a codebehindfile to create a precompiled assembly that contains your page classimplementation code, ASP.NET dynamically creates and compiles a class thatcontains your page’s visual elements. This class derives from your page class, whichagain means that you cannot use strong names.Note You can strong name any other assembly that is called by your Web page code, for examplean assembly that contains resource access, data access or business logic code, although theassembly must be placed in the global assembly cache.