Improving Web Application Security: Threats and - CGISecurity

Chapter 11: Building Secure Serviced Components 303Audit RequirementsTo address the repudiation threat, sensitive transactions performed by EnterpriseService components should be logged. At design time, consider the type of operationsthat should be audited and the details that should be logged. At a minimum, thisshould include the identity that initiated the transaction and the identity used toperform the transaction, which may or may not be the same.Application Activation TypeAt design time, decide how your serviced component will be activated. You canactivate them using an instance of the Dllhost.exe process or you can run them insidethe client process. Server applications run out of process in an instance of Dllhost.exe.Library applications run in the client’s process address space. Library applications aremore efficient due to the lack of inter-process communication. However, they are lessconfigurable and are not protected with process level isolation. Many securitysettings, such as the authentication and impersonation levels, are inherited fromthe client process.TransactionsIf you plan to use distributed transactions, consider where the transaction is initiatedand consider the implications of running transactions between components andresource managers separated by firewalls. In this scenario, the firewall must beconfigured to support the Microsoft Distributed Transaction Coordinator (DTC)traffic.If your physical deployment architecture includes a middle-tier application server, itis generally preferable to initiate transactions from the Enterprise Services applicationon the application server and not from the front-end Web application.Code Access SecurityTypically, applications that use serviced components are fully trusted, and as a resultcode access security has limited use to authorize calling code. However, EnterpriseServices demands that the calling code has the necessary permission to callunmanaged code. The main implication of this is that you will not be able to directlycall into an Enterprise Services application from a partial trust Web application. TheASP.NET partial trust levels (High, Medium, Low, and Minimal) do not grant theunmanaged code permission. If you need to call a serviced component from a partialtrust application, the privileged code that calls your component must be sandboxed.For more information, see “Code Access Security Considerations” later in thischapter.