Improving Web Application Security: Threats and - CGISecurity

306 Part III: Building Secure Web ApplicationsUse Least Privileged Run-As AccountsDuring development, run and test your service components using a least privilegedlocal account instead of the interactive user account. Configure the account as closelyas possible to match the run-as account that the administrator is likely to use in theproduction environment.Avoid Storing Secrets in Object Constructor StringsIf you store secrets such as database connection strings or passwords in objectconstructor strings in the COM+ catalog, any member of the local administratorsgroup can view this plaintext data. Try to avoid storing secrets. If you have to store asecret, then encrypt the data. DPAPI is a good implementation option because itallows you to avoid problems associated with key management.At runtime, retrieve the object construction string and use DPAPI to decrypt the data.For more information about using DPAPI from managed code, see “How to create aDPAPI library” in MSDN article, “Building Secure ASP.NET Applications,” athttp://msdn.microsoft.com/library/en-us/dnnetsec/html/secnetlpMSDN.asp.[ConstructionEnabled(Default="")]public class YourServicedComponent : ServicedComponent, ISomeInterface{// The object constructor is called first.public YourServicedComponent() {}// Then the object construction string is passed to Construct method.protected override void Construct(string constructString){// Use DPAPI to decrypt the configuration data.}}Avoid Unconstrained DelegationServiced component clients are authenticated with either NTLM or Kerberosauthentication, depending on the environment. Kerberos in Windows 2000 supportsdelegation that is unconstrained; this means that the number of network hops thatcan be made with the client’s credentials has no limit.If ASP.NET is the client then you can set the comImpersonation attribute on the element in Machine.config to configure the impersonation level:comImpersonationLevel="[Default|Anonymous|Identify|Impersonate|Delegate]"The impersonation level defined for an Enterprise Services server applicationdetermines the impersonation capabilities of any remote server that the servicedcomponents communicate with. In this case, the serviced components are the clients.