Improving Web Application Security: Threats and - CGISecurity

Chapter 12: Building Secure Web Services 343Deployment ConsiderationsThe range of security options available to you depends greatly on the specificdeployment scenarios your Web services attempt to cover. If you build applicationsthat consume Web services in an intranet, then you have the widest range of securityoptions and techniques at your disposal. If, however, your Web service is publiclyaccessible over the Internet, your options are far more lijmited. This section describesthe implications of different deployment scenarios on the applicability of theapproaches to securing Web services discussed previously in this chapter.Intranet DeploymentBecause you control the consumer application, the service, and the platform, intranetsusually provide the widest range of available options for securing Web services.With an intranet scenario, you can usually choose from the full range ofauthentication and secure communication options. For example, you mgiht decide touse Windows authentication if the consumer and service are in the same or trustingdomains. You can specify that client application developers set the credentialsproperty on the client proxy to flow the user’s Windows credentials to the Webservice.Intranet communication is often over a private network, with some degree ofsecurity. If this is insufficient, you might decide to encrypt traffic by using SSL. Youcan also use message level security and install WSE on both the client and server tohandle security at both ends transparently to the application. WSE supportsauthentication, digital signatures, and encryption.Extranet DeploymentIn an extranet scenario, you may need to expose your Web service over the Internet toa limited number of partners. The user community is still known, predictable, andpossibly uses managed client applications, although they come from separate,independent environments. In this situation, you need an authentication mechanismthat is suitable for both parties and does not rely on trusted domains.You can use Basic authentication if you make account information available to bothparties. If you use Basic authentication, make sure that you secure the credentials byusing SSL.Note SSL only protects credentials over the network. It does not protect them in situations wherea malicious user successfully installs a proxy tool (such as sslproxy) local to the client machine tointercept the call before forwarding it to the Web service over SSL.