Improving Web Application Security: Threats and - CGISecurity

13Building Secure RemotedComponentsIn This Chapter●●●●OverviewAuthenticating and authorizing callersPreventing denial of service attacks against remote componentsImplementing secure serializationProtecting sensitive dataThe Microsoft .NET Framework Remoting infrastructure has no defaultauthentication or authorization mechanisms. However, if you host remotecomponents with ASP.NET and use the HttpChannel for communication, you canuse ASP.NET and IIS authentication and authorization services.If performance is an issue, you might decide to use a custom host with theTcpChannel. You should only do so in trusted subsystem scenarios, where the rangeof possible callers is carefully controlled through out-of-band techniques such as theuse of IPSec policies, which only allow communication from specified Web servers.With the TcpChannel, you must build your own authentication and authorizationmechanisms. This is contrary to the principle of using tried and tested platform levelsecurity services, and requires significant development effort.