Improving Web Application Security: Threats and - CGISecurity

xliiImproving Web Application Security: Threats and CountermeasuresHow ToUse URLScan 801Applies To .............................................................................................................. 801Summary ............................................................................................................... 801Contents ................................................................................................................ 801Installing URLScan.................................................................................................. 801Log Files ................................................................................................................ 802Removing URLScan ................................................................................................. 802Configuring URLScan............................................................................................... 802Throttling Request Sizes with URLScan..................................................................... 803Debugging VS .NET with URLScan Installed............................................................... 803Masking Content Headers (Banners) ........................................................................ 804Pitfalls ................................................................................................................... 804References............................................................................................................. 804How ToCreate a Custom Encryption Permission 805Applies To .............................................................................................................. 805Summary ............................................................................................................... 805Before You Begin .................................................................................................... 805Summary of Steps .................................................................................................. 806Step 1. Create the EncryptionPermission Class..................................................... 807Step 2. Create the EncryptionPermissionAttribute Class ........................................ 815Step 3. Install the Permission Assembly in the GAC............................................... 817Step 4. Update the DPAPI Managed Wrapper Code ................................................ 817Step 5. Call DPAPI from a Medium Trust Web Application ....................................... 819How ToUse Code Access Security Policy to Constrain an Assembly 823Applies To .............................................................................................................. 823Summary ............................................................................................................... 823Before You Begin .................................................................................................... 824Summary of Steps .................................................................................................. 825Step 1. Create an Assembly That Performs File I/O ................................................... 825Step 2. Create a Web Application ............................................................................. 827Step 3. Test File I/O with No Code Access Security Constraints.................................. 827Step 4. Configure Code Access Security Policy to Constrain File I/O ........................... 828Step 5. Test File I/O With Code Access Security Constraints ...................................... 830Additional Resources 833