Improving Web Application Security: Threats and - CGISecurity

332 Part III: Building Secure Web ApplicationsAuthenticationIf your Web service outputs sensitive, restricted data or if it provides restrictedservices, it needs to authenticate callers. A number of authentication schemes areavailable and these can be broadly divided into three categories:● Platform level authentication● Message level authentication● Application level authenticationPlatform Level AuthenticationIf you are in control of both endpoints and both endpoints are in the same or trustingdomains, you can use Windows authentication to authenticate callers.Basic AuthenticationYou can use IIS to configure your Web service’s virtual directory for Basicauthentication. With this approach, the consumer must configure the proxy andprovide credentials in the form of a user name and password. The proxy thentransmits them with each Web service request through that proxy. The credentials aretransmitted in plaintext and therefore you should only use Basic authentication withSSL.The following code fragment shows how a Web application can extract Basicauthentication credentials supplied by an end user and then use those to invoke adownstream Web service configured for Basic authentication in IIS.// Retrieve client's credentials (available with Basic authentication)string pwd = Request.ServerVariables["AUTH_PASSWORD"];string uid = Request.ServerVariables["AUTH_USER"];// Set the credentialsCredentialCache cache = new CredentialCache();cache.Add( new Uri(proxy.Url), // Web service URL"Basic",new NetworkCredential(uid, pwd, domain) );proxy.Credentials = cache;Integrated Windows AuthenticationYou can use IIS to configure your Web service’s virtual directory for IntegratedWindows authentication, which results either in Kerberos or NTLM authenticationdepending on the client and server environment. The advantage of this approach incomparison to Basic authentication is that credentials are not sent over the network,which eliminates the network eavesdropping threat.