Improving Web Application Security: Threats and - CGISecurity

296 Part III: Building Secure Web Applications6. To confirm the successful generation of the event source, use a registry editor andnavigate to:HKLM\System\CurrentControlSet\Services\EventLog\Application\{source name}Confirm that the key exists and that it contains an EventMessageFile string valuethat points to the default .NET Framework event message file:\Windows\Microsoft.NET\Framework\{version}\EventLogMessages.dllSummaryIf you have an existing application and do not want to create an installer class, youmust grant the ASP.NET process identity the correct access rights on the event logregistry key. For registry key details and the precise access rights that are required,see “Event Log” in Chapter 19, “Securing Your ASP.NET Application and WebServices.”EventLogPermissionCode that writes to the event log must be granted the EventLogPermission by codeaccess security policy. This becomes an issue if your Web application is configured torun at a partial-trust level. For information about how to write to the event log from apartial trust Web application, see Chapter 9, “Using Code Access Security withASP.NET.”This chapter started by showing you the main threats that you need to address whenyou build Web pages and controls. Many application-level attacks rely onvulnerabilities in input validation. Take special care in this area to make sure thatyour validation strategy is sound and that all data that is processed from a nontrustedsource is properly validated. Another common vulnerability is the failure toprotect authentication cookies. The “Forms Authentication” section of this chaptershowed you effective countermeasures to apply to prevent unauthorized access,session hijacking, and cookie replay attacks.