Improving Web Application Security: Threats and - CGISecurity

352 Part III: Building Secure Web ApplicationsDesign ConsiderationsBefore you begin to develop remote components, there are a number of issues toconsider at design time. The key security considerations are:● Do not expose remoted objects to the Internet.●●Use the HttpChannel to take advantage of ASP.NET security.Use the TcpChannel only in trusted server scenarios.Do Not Expose Remoted Objects to the InternetYou should only host remoted objects on middle-tier application servers that are notdirectly accessible from the Internet, and that are only accessible from front-end Webapplications and Web services. If you need to expose functionality provided by aremoted object to Internet clients, use a Web service to wrap the middle-tier objectand expose the Web service to the Internet.Use the HttpChannel to Take Advantage of ASP.NET SecurityIf security is your primary concern, use ASP.NET to host remoted objects. This allowsyou to take advantage of the authentication, authorization, and securecommunication features provided by ASP.NET and IIS. For example, you can useWindows authentication and use SSL to provide privacy and for the integrity ofrequests and responses sent over the network.Use the TcpChannel Only in Trusted Server ScenariosIf you use the TcpChannel with a custom host process for performance reasons,remember that no built-in authentication services exist.For this reason, you should only use the TcpChannel in trusted server scenarios,where the upstream Web application or Web service authenticates and authorizesthe original callers before it calls your middle-tier remoted components. To securethis scenario, use IPSec for machine-level authentication and secure communication.The IPSec policy should only permit traffic from the nominated Web server(s) to themiddle-tier remote component host. This trusted server scenario is shown inFigure 13.3.