Improving Web Application Security: Threats and - CGISecurity

160 Part III: Building Secure Web ApplicationsTable 7.1 compares the features of strong names and Authenticode signatures.Table 7.1 A Comparison of Strong Names and Authenticode SignaturesFeature Strong Name AuthenticodeUnique identification ofassemblyYesNoUnique identification ofpublisherThe public key of the publishercan be revokedNot necessarily.Depends on assembly developer usinga public key to represent the publisherNoYesYesVersioning Yes NoNamespace and type nameuniquenessIntegrity (checks assembly hasnot been tampered with)Evidence used as input to CASpolicyUser input required for trustdecisionYesYesYesNoNoYesIE host — YesASP.NET host — NoYes (pop-up dialog box)AuthorizationThere are two types of authorization that you can use in your assemblies to controlaccess to classes and class members:● Role-based authorization to authorize access based on user identity androle-membership. When you use role-based authorization in assemblies that arepart of an ASP.NET Web application or Web service, you authorize the identitythat is represented by an IPrincipal object attached to the current Web request andavailable through Thread.CurrentPrincipal and HttpContext.Current.User. Thisidentity is either the authenticated end user identity or the anonymous Internetuser identity. For more information about using principal-based authorization inWeb applications, see “Authorization” in Chapter 10, “Building Secure ASP.NETPages and Controls.”● Code access security to authorize calling code, based on evidence, such asan assembly’s strong name or location. For more information, see the“Authorization” section in Chapter 8, “Code Access Security in Practice.”