Improving Web Application Security: Threats and - CGISecurity

284 Part III: Building Secure Web ApplicationsFor more information about preventing SQL injection, see Chapter 14, “BuildingSecure Data Access.”AuthorizationYou can use authorization to control access to directories, individual Web pages, pageclasses, and methods. If required, you can also include authorization logic in yourmethod code. When you build authorization into your Web pages and controls,consider the following recommendations:● Use URL authorization for page and directory access control.●●●Use File authorization with Windows authentication.Use principal demands on classes and methods.Use explicit role checks for fine-grained authorization.Use URL Authorization for Page and Directory Access ControlFor page-level and directory-level access control, use URL authorization, which isconfigured by the element. To restrict access to specific files ordirectories, place the element inside a element.For more information, see “Authorization” in Chapter 19, “Securing Your ASP.NETApplication and Web Services.”Use File Authorization with Windows AuthenticationIf ASP.NET is configured for Windows authentication, the FileAuthorizationModulechecks all requests for ASP.NET file types. This includes ASP.NET page files (.aspx),user controls (.ascx), and any other file type mapped by IIS to the ASP.NET ISAPIfilter.To configure the FileAuthorizationModule, set the appropriate Windows accesscontrol lists (ACLs) on the ASP.NET files.Use Principal Demands on Classes and MethodsPrincipal permission demands allow you to make authorization decisions based onthe identity and role membership of the caller. The caller’s identity and rolemembership is maintained by the principal object that is associated with the currentWeb request (accessed through HttpContext.User). Use declarative security attributesto provide access controls on classes and methods, as follows:// Declarative syntax[PrincipalPermission(SecurityAction.Demand,Role=@"DomainName\WindowsGroup")]public void SomeRestrictedMethod(){}