Improving Web Application Security: Threats and - CGISecurity

250 Part III: Building Secure Web ApplicationsUsing Default CredentialsYou might need to call a Web service that uses Windows authentication and specifyauthentication credentials through the proxy credential cache. For example:proxy.Credentials = System.Net.CredentialCache.DefaultCredentials;In this case, the ASP.NET application requires the EnvironmentPermission with readaccess to the USERNAME environment variable. Default medium-trust policy grantsthis permission to Web applications.In an ASP.NET server-side scenario, the credentials are obtained from the ASP.NETapplication’s thread or process-level token. If DefaultCredentials are used from adesktop application, the current interactive user’s token is used. The demand forEnvironmentPermission is a risk mitigation strategy designed to ensure that codecannot use the local user’s credentials at will and expose them to the network.RegistryBy default, medium-trust Web applications are not granted the RegistryPermission.To configure your application to access the registry, you must either modify ASP.NETpolicy to grant this permission to your application or develop a sandboxed wrapperassembly that has the necessary permission.The sandboxing approach is the same as described earlier for OLE DB data sourcesand the event log.Customizing PolicyThe easiest way to customize policy is to create a custom policy file based on themedium-trust policy file and configure your application to use the custom policy.The custom policy grants RegistryPermission to the application.