Improving Web Application Security: Threats and - CGISecurity

212 Part III: Building Secure Web ApplicationsWeb ServicesCode that calls Web services must be granted the WebPermission by code accesssecurity policy. The WebPermission actually constrains access to any HTTP Internetbasedresources.Constraining Web Service ConnectionsTo restrict the Web services to which your code can access, use theWebPermissionAttribute together with SecurityAction.PermitOnly. For example,the following code ensures that the PlaceOrder method and any methods it calls canonly invoke Web services on the http://somehost site.[WebPermissionAttribute(SecurityAction.PermitOnly,ConnectPattern=@"http://somehost/.*")][EnvironmentPermissionAttribute(SecurityAction.PermitOnly, Read="USERNAME")]public static void PlaceOrder(XmlDocument order){PurchaseService.Order svc = new PurchaseService.Order();// Web service uses Windows authenticationsvc.Credentials = System.Net.CredentialCache.DefaultCredentials;svc.PlaceOrder(order);}In the prior example, the ConnectPattern property of the WebPermissionAttributeclass is used. This allows you to supply a regular expression that matches the rangeof addresses to which a connection can be established. TheEnvironmentPermissionAttribute shown previously is required because the codeuses Windows authentication and default credentials.The following example shows how to use the Connect attribute to restrictconnections to a specific Web service.[WebPermissionAttribute(SecurityAction.PermitOnly,Connect=@"http://somehost/order.asmx")]