Improving Web Application Security: Threats and - CGISecurity

326 Part III: Building Secure Web ApplicationsFor more information about using the ASP.NET process account for remote databaseaccess, see the “Data Access” section in Chapter 19, “Securing Your ASP.NETApplication and Web Services.”If you use impersonation, the issues and considerations that apply to Webapplications also apply to Web services. For more information, see the“Impersonation” sections in Chapter 10, “Building Secure ASP.NET Web Pages andControls” and Chapter 19, “Securing Your ASP.NET Application and Web Services.”Code Access SecurityConsider the trust level defined by security policy in your target deploymentenvironment. Your Web service’s trust level, defined by its elementconfiguration, affects the types of resources that it can access and the other privilegedoperations it can perform.Also, if you call a Web service from an ASP.NET Web application, the Webapplication’s trust level determines the range of Web services it can call. For example,a Web application configured for Medium trust, by default, can only call Web serviceson the local computer.For more information about calling Web services from Medium and other partialtrust Web applications, see Chapter 9, “Using Code Access Security with ASP.NET.”Input ValidationLike any application that accepts input data, Web services must validate the data thatis passed to them to enforce business rules and to prevent potential security issues.Web methods marked with the WebMethod attribute are the Web service entrypoints. Web methods can accept strongly typed input parameters or loosely typedparameters that are often passed as string data. This is usually determined by therange and type of consumers for which the Web service is designed.Strongly Typed ParametersIf you use strongly typed parameters that are described by the .NET Framework typesystem, for example integers, doubles, dates, or other custom object types such asAddress or Employee, the auto-generated XML Schema Definition (XSD) schemacontains a typed description of the data. Consumers can use this typed description toconstruct appropriately formatted XML within the SOAP requests that are sent toWeb methods. ASP.NET then uses the System.Xml.Serialization.XmlSerializer classto deserialize the incoming SOAP message into common language runtime (CLR)objects. The following example shows a Web method that accepts strongly typedinput consisting of built-in data types.[WebMethod]public void CreateEmployee(string name, int age, decimal salary) {...}