Improving Web Application Security: Threats and - CGISecurity

344 Part III: Building Secure Web ApplicationsAs an alternate option for use with an extranet, you can use IIS client certificateauthentication instead of passing explicit credentials. In this case, the callingapplication must present a valid certificate with the call. The Web service usesthe certificate to authenticate the caller and authorize the operation. For moreinformation, see the “Extranet Security” section in MSDN article, “Building SecureASP.NET Applications” at http://msdn.microsoft.com/library/en-us/dnnetsec/html/SecNetch06.asp.Internet DeploymentIf you expose your Web service to a large number of Internet consumers and requireauthentication, the options available to you are substantially constrained. Any formof platform level authentication is unikely to be suitable, since the consumers will nothave proper domain accounts to which they can map their credentials. The use of IISclient certicate authentication and the transport (SSL) level is also problematic when alarge number of client certificates must be made known to the target IIS Web server(or the ISA Server in front of it). This leaves message and application-levelauthentication and authorization the most likely choice. Credentials passed by theconsumer of the service in the form of user name, password, certicate, Kerberosticket, or custom token) can be validated transparently by the Web servicesinfrastructure (WSE) or programmatically inside the target service. client certificatesare difficult to manage scale. Key management (issuing and revoking) becomes anissue. Also, certificate-based authentication is resource intensive and therefore issubject to scalability issues with large number of clients.SSL usually provides encryption of the network traffic (server-side certicate only),but can also be supplemented by message-level encryption.Using client certicates, while advantageous from a seucrity point of view, oftenbecomes problematic for large numbers of users. You must carefully manage thecerticates and consider how they should be delivered to clients, renewed, revoked,and so on. Another pottential issue in Internet situaions Is the oveall scalability of thesolution due to processing overhead or the encryption/decryption and certificatevalidation for a large-scale Web service with significant workload.