Improving Web Application Security: Threats and - CGISecurity

204 Part III: Building Secure Web ApplicationsUse the Demand / Assert PatternDemanding a specific permission before calling Assert is an effective way toauthorize upstream code. Sometimes you might be able to demand a built-inpermission type to authorize calling code.Often, if your assembly is exposing functionality that is not provided by the .NETFramework class library, such as calling the Data Protection API (DPAPI), you need todevelop a custom permission and demand the custom permission to authorizecallers. For example, you might develop a custom Encryption permission toauthorize callers to a managed DPAPI wrapper assembly. Demanding this permissionand then asserting the unmanaged code permission is an effective way to authorizecalling code.For more information about this approach and about developing custom permissions,see “How To: Create a Custom Encryption Permission” in the “How To” section ofthis guide.Reduce the Assert DurationIf you only need to call Assert to satisfy the demands of a single downstream methodthat your code calls, then place the Assert immediately prior to the downstreammethod call. Then immediately call RevertAssert to keep the assertion window assmall as possible, and to ensure that any subsequent code your method calls does notinadvertently succeed because the Assert is still in effect.A common practice is to place the call to RevertAssert in a finally block to ensurethat it always gets called even in the event of an exception.Constraining CodeConstraining code and building least privileged code is analogous to using theprinciple of least privilege when you configure user or service accounts. Byrestricting the code access security permissions available to your code, you minimizescope for the malicious use of your code.There are two ways to constrain code to restrict which resources it can access andrestrict which other privileged operations it can perform:● Using policy permission grants● Using stack walk modifiers