Improving Web Application Security: Threats and - CGISecurity

Contents xxixStaying Secure (continued)Perform Security Assessments............................................................................. 538Use Security Notification Services........................................................................ 538Remote Administration ............................................................................................ 539Securing Terminal Services.................................................................................. 539Summary ............................................................................................................... 540Additional Resources .............................................................................................. 541Chapter 19Securing Your ASP.NET Application and Web Services 543In This Chapter ....................................................................................................... 543Overview ................................................................................................................ 543How to Use This Chapter ......................................................................................... 544Methodology........................................................................................................... 544What You Must Know .............................................................................................. 545ASP.NET Process Model ...................................................................................... 545ASP.NET Account ................................................................................................ 545Aspnet_setreg.exe and Process, Session, and Identity........................................... 546Impersonation is Not the Default.......................................................................... 546HttpForbiddenHandler, Urlscan, and the 404.dll..................................................... 547AppSettings........................................................................................................ 547Machine.Config and Web.Config Explained ................................................................ 548Hierarchical Policy Evaluation............................................................................... 550.......................................................................................................... 551Machine.Config and Web.Config Guidelines............................................................... 553ACLs and Permissions......................................................................................... 554Trust Levels in ASP.NET........................................................................................... 555 .............................................................................................................. 556Process Identity for ASP.NET.................................................................................... 556................................................................................................. 556Impersonation ........................................................................................................ 558........................................................................................................... 558Authentication ........................................................................................................ 560 ................................................................................................ 560Forms Authentication Guidelines .......................................................................... 560Authorization .......................................................................................................... 563File Authorization ................................................................................................ 563URL Authorization ............................................................................................... 564Session State......................................................................................................... 565 .................................................................................................. 565Securing a SQL Server Session State Store .......................................................... 565Securing the Out-of-Process State Service ............................................................ 568View State.............................................................................................................. 569 ............................................................................................................ 569