Improving Web Application Security: Threats and - CGISecurity

304 Part III: Building Secure Web ApplicationsAuthenticationEnterprise Services applications use Windows authentication. This is either NTLMor Kerberos authentication depending on the client and server operating system. InWindows 2000 or Windows Server 2003 environments, Kerberos authentication isused.The main issue for you to consider when building serviced components is to ensurethat all calls are authenticated to prevent anonymous users from accessing yourcomponent’s functionality.Use (At Least) Call Level AuthenticationTo reject anonymous callers, use at least call level authentication. Configure thissetting by adding the following attribute to your serviced component assembly:[assembly: ApplicationAccessControl(Authentication = AuthenticationOption.Call)]Note This is equivalent to setting Authentication level for calls to Call on the Security tab of theapplication’s Properties dialog box in Component Services.AuthorizationEnterprise Services uses COM+ roles for authorization. You can control thegranularity of authorization to applications, components, interfaces, and methods.To prevent users from performing restricted operations exposed by your application’sserviced components:● Enable role-based security.●●Enable component level access checks.Enforce component level access checks.Enable Role-Based SecurityRole-based security is disabled by default on Windows 2000. The reverse is true onWindows Server 2003. To ensure that role based security is automatically enabledwhen your component is registered (usually by using Regsvcs.exe), add the followingattribute to your serviced component assembly.[assembly: ApplicationAccessControl(true)]Note Using this attribute is equivalent to selecting Enforce access checks for this application onthe Security tab of the application’s Properties dialog box in Component Services.