Improving Web Application Security: Threats and - CGISecurity

336 Part III: Building Secure Web ApplicationsWeb Service Endpoint AuthorizationIf your Web service is configured for Integrated Windows authentication you canconfigure NTFS permissions on your Web service (.asmx) files to control access, basedon the security context of the original caller. This authorization is performed by theASP.NET FileAuthorizationModule and impersonation is not required.Regardless of the authentication type, you can use the ASP.NETUrlAuthorizationModule to control access to Web service (.asmx) files. You configurethis by adding and elements to the element inMachine.config or Web.config.For more information about both forms of authorization, see the “Authorization”section in Chapter 19, “Securing Your ASP.NET Application and Web Services.”Web Method AuthorizationYou can use declarative principal permission demands to control access to individualWeb methods based on the identity or role membership of the caller. The caller’sidentity and role membership is maintained by the principal object associated withthe current Web request (accessed through HttpContext.User.)[PrincipalPermission(SecurityAction.Demand, Role=@"Manager")][WebMethod]public string QueryEmployeeDetails(string empID){}For more information about principal permission demands, see the “Authorization”section in Chapter 10, “Building Secure ASP.NET Pages and Controls.”Programmatic AuthorizationYou can use imperative permission checks or explicit role checks by callingIPrincipal.IsInRole inside your Web methods for fine-grained authorization logic asfollows.// This assumes non-Windows authentication. With Windows authentication// cast the User object to a WindowsPrincipal and use Windows groups as// role namesGenericPrincipal user = User as GenericPrincipal;if (null != user){if ( user.IsInRole(@"Manager") ){// User is authorized to perform manager functionality}}