Improving Web Application Security: Threats and - CGISecurity

348 Part III: Building Secure Web ApplicationsThis chapter gives recommendations and guidance to help you build secure remotecomponents. This includes components that use ASP.NET and the HttpChannel, andthose that use custom executables and the TcpChannel. The typical deploymentpattern assumed by this chapter is shown in Figure 13.1, where remote objects arelocated on a middle-tier application server and process requests from ASP.NET Webapplication clients, and also Windows applications deployed inside the enterprise.PerimeterFirewallOptionalFirewallOptionalFirewallWeb ServerApplication ServerDatabase ServerHTTPASP. NETHostObjectSQLServerTcpChannelTcpChannelOptionalFirewallWindowsApplicationFigure 13.1Typical remoting deploymentIn this common scenario, the remote component services requests from front-endWeb applications. In this case, ASP.NET on the Web server handles the authenticationand authorization of callers. In addition, middle-tier remote components are oftenaccessed by Enterprise Windows applications.How to Use This ChapterThis chapter discusses various techniques to design and build secure componentsthat you communicate with using the .NET Framework remoting technology.To get the most from this chapter:● Use in conjunction with Chapter 17, “Securing Your Application Server.”Chapter 17 gives an administration perspective on securing a middle-tier remotingsolution.● See “Checklist: Securing Remoting” in the Checklists section of this guide. Thisgives a summary of the security measures required to build and configure secure.NET Framework remoting solutions.