Improving Web Application Security: Threats and - CGISecurity

262 Part III: Building Secure Web ApplicationsConsider the Identity That Is Used for Resource AccessBy default, ASP.NET applications do not impersonate, and the least privilegedASPNET process account is used to run ASP.NET Web applications and for resourceaccess. The default is the recommended configuration. There are several situations inwhich you may want to use a different Windows security context for resource access.These include:● Hosting multiple applications on the same serverYou can use IIS to configure each application to use a separate anonymousInternet user account and then enable impersonation. Each application then hasa distinct identity for resource access. For more information about this approach,see Chapter 20, “Hosting Multiple Web Applications.”●Accessing a remote resource with specific authentication requirementsIf you need to access a specific remote resource (for example, a file share) and havebeen given a particular Windows account to use, you can use configure thisaccount as the anonymous Web user account for your application. Then you canuse programmatic impersonation prior to accessing the specific remote resource.For more information, see “Impersonation” later in this chapter.Protect Credentials and Authentication TicketsYour design should factor in how to protect credentials and authentication tickets.Credentials need to be secured if they are passed across the network and while theyare in persistent stores such as configuration files. Authentication tickets must besecured over the network because they are vulnerable to hijacking. Encryptionprovides a solution. SSL or IPSec can be used to protect credentials and tickets overthe network and DPAPI provides a good solution for encrypting credentials inconfiguration files.Fail SecurelyIf your application fails with an unrecoverable exception condition, make sure that itfails securely and does not leave the system wide open. Make sure the exceptiondetails that are valuable to a malicious user are not allowed to propagate to the clientand that generic error pages are returned instead. Plan to handle errors usingstructured exception handling, rather than relying on method error codes.