Improving Web Application Security: Threats and - CGISecurity

308 Part III: Building Secure Web ApplicationsFor more information about using IPSec to encrypt all of the data transmittedbetween two computers, see “How To: Use IPSec to Provide Secure CommunicationBetween Two Servers” in the “How To” section of “Microsoft patterns & practicesVolume I, Building Secure ASP.NET Applications: Authentication, Authorization, andSecure Communication” at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/SecNetHT00.asp.Auditing and LoggingAuditing and logging should be performed across the tiers of your application toavoid potential repudiation threats where users deny performing certain transactionsor key operations.Audit User TransactionsIf your Web application or Web service is configured for impersonation, the identityof the original caller automatically flows to an Enterprise Services application and isavailable using SecurityCallContext.OriginalCaller. This is useful for auditing in themiddle tier. The following code shows how to access this information:[ComponentAccessControl]public class YourServicedComponent : ServicedComponent{public void ShowCallers(){SecurityCallers callers = SecurityCallContext.CurrentCall.Callers;foreach(SecurityIdentity id in callers){LogEvent(id.AccountName);}}private void LogEvent(string message){try{if (!EventLog.SourceExists(appName)){EventLog.CreateEventSource(appName, eventLog);}EventLog.WriteEntry(appName, message, EventLogEntryType.Information );}catch (SecurityException secex){throw new SecurityException("Event source does not exist and cannot be created.", secex);}}}