Improving Web Application Security: Threats and - CGISecurity

Chapter 10: Building Secure ASP.NET Pages and Controls 279Secure Restricted Pages with SSLTo ensure that SSL is used to protect the logon credentials that are posted from thelogin form, and that the authentication cookie passed on subsequent requests torestricted pages, configure the secure folders in IIS to require SSL. This sets theAccessSSL=true attribute for the folder in the IIS metabase. Requests for pages in thesecured folders will only be successful if https is used on the request URL.For SSL, you must have a server certificate installed on the Web server. For moreinformation, see “How To: Setup SSL on a Web Server” in the “How To” sectionof “Microsoft patterns & practices Volume I, Building Secure ASP.NETApplications: Authentication, Authorization, and Secure Communication” athttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/secnetlpMSDN.asp.Use URL AuthorizationTo allow anonymous access to public pages, use the following element.Use the following element inside a element inWeb.config to deny access to unauthenticated users and force a redirect to the loginpage that is specified on the element: