Improving Web Application Security: Threats and - CGISecurity

340 Part III: Building Secure Web ApplicationsRegardless of the exception type, the exception details are propagated to the clientusing the standard SOAP element. Clients and Web services built withASP.NET do not parse the element directly but instead deal consistently withSoapException objects. This allows the client to set up try blocks that catchSoapException objects.Note If you throw a SoapException from a custom HTTP module, it is not automatically serializedas a SOAP . In this case, you have to create the SOAP manually.Using SoapExceptionsThe following code shows a simple WebMethod, where the validation of applicationlogic fails and, as a result, an exception is generated. The error information sent to theclient is minimal. In this sample, the client is provided with a help desk reference thatcan be used to call support. At the Web server, a detailed error description for thehelp desk reference is logged to aid problem diagnosis.using System.Xml;using System.Security.Principal;[WebMethod]public void GiveBonus(int empID, int percentage){// Only managers can give bonuses// This example uses Windows authenticationWindowsPrincipal wp = (HttpContext.Current.User as WindowsPrincipal);if( wp.IsInRole(@"Domain\Managers")){// User is authorized to give bonus. . .}else{// Log error details on the server. For example:// "DOMAIN\Bob tried to give bonus to Employee Id 345667;// Access denied because DOMAIN\Bob is not a manager."// Note: User name is available from wp.Identity.Name}}// Return minimal error information to client using a SoapExceptionXmlDocument doc = new XmlDocument();XmlNode detail = doc.CreateNode(XmlNodeType.Element,SoapException.DetailElementName.Name,SoapException.DetailElementName.Namespace);// This is the detail part of the exceptiondetail.InnerText = "User not authorized to perform requested operation";throw new SoapException("Message string from your Web service",SoapException.ServerFaultCode,Context.Request.Url.AbsoluteUri, detail, null );