Improving Web Application Security: Threats and - CGISecurity

338 Part III: Building Secure Web ApplicationsFor Web services built using version 1.0 of the .NET Framework, the ASPNET userprofile is not loaded. In this scenario, you have two options.● Run your Web service using a custom least privileged account with which youhave previously interactively logged on to the Web server to create a user profile.● Store the key in the local machine store and grant access to your Web serviceprocess account. On Windows 2000, this is the ASPNET account by default. OnWindows Server 2003, it is the Network Service account by default.To grant access, use Windows Explorer to configure an ACL on the followingfolder that grants full control to the Web service process account.\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeysFor more information, see the “Managing X.509 Certificates,” “Encrypting a SOAPMessage Using an X.509 Certificate,” and “Decrypting a SOAP Message Using anX.509 Certificate” sections in the WSE documentation.Symmetric Encryption Using Shared KeysWith symmetric encryption, the Web service and its consumer share a secret key toencrypt and decrypt the SOAP message. This encryption is faster than asymmetricencryption although the consumer and the service provider must use some out-ofbandmechanism to share the key.For more information, see the “Encrypting a SOAP Message Using a Shared Key”and “Decrypting a SOAP Message Using a Shared Key” sections in the WSEdocumentation.Symmetric Encryption Using Custom Binary TokensYou can also use WSE to define a custom binary token to encapsulate the customsecurity credentials used to encrypt and decrypt messages. Your code needs twoclasses. The sender class must be derived from the BinarySecurityToken class toencapsulate the custom security credentials and encrypt the message. The recipientclass must be derived from DecryptionkeyProvider class to retrieve the key anddecrypt the message.For more information, see the “Encrypting a SOAP Message Using a Custom BinarySecurity Token” and “Decrypting a SOAP Message Using a Custom Binary SecurityToken” sections in the WSE documentation.Encrypting Parts of a MessageBy default, WSE encrypts the entire SOAP body and none of the SOAP headerinformation. However, you can also use WSE to programmatically encrypt anddecrypt portions of a message.