Improving Web Application Security: Threats and - CGISecurity

248 Part III: Building Secure Web ApplicationsWeb ServicesBy default, medium-trust policy grants ASP.NET Web applications a restrictedWebPermission. To be able to call Web services from your Web application, you mustconfigure the originUrl attribute on your application’s element. To call a single Web service from a medium trust Web application1. Configure the application to run at medium trust.2. Set the originUrl to point to the Web service you want to be able to call, as follows:The originUrl value is used in the constructor for a System.Text.RegEx regularexpression class so that in can perform a match on the URLs that are accessible by theWeb service. This RegEx class is used in conjunction with a WebPermission class.The “.*” matches any URL beginning with “http://servername/”.The originUrl attribute is used when ASP.NET policy is evaluated. It gives a value forthe $OriginHost$ substitution parameter. Here is the WebPermission definition fromWeb_mediumtrust.config:If you do not specify the Web servers accessed by your application, any Web servicerequest will fail with a SecurityException. To call a Web service on the local Webserver, use the following configuration:If your application needs to access multiple Web services on different servers, youneed to customize ASP.NET policy because you can only specify one originUrl on the element in Web.config or Machine.config.