Improving Web Application Security: Threats and - CGISecurity

Chapter 13: Building Secure Remoted Components 353PerimeterFirewallOptionalFirewallWeb ServerApplication ServerHTTPASP. NETTcpChannelCustom HostObjectTrust BoundaryIPSecFigure 13.3Remoting in a trusted server scenarioFor more information about IPSec, see “How To: Use IPSec” in the “How To” sectionof this guide.TcpChannel ConsiderationsIf you use a custom executable host and the TcpChannel, and you cannot rely on anupstream Web application to perform client authentication and authorization, youhave to develop your own authentication and authorization solutions.As part of a custom solution you might decide to pass principal objects as methodparameters or in the call context. You should only do so in a trusted environment toprevent malicious client-side code from creating an IPrincipal object with elevatedroles and then sending it to your server. Your server implementation must be able totrust IPrincipal objects before using them for role-based authorization.An alternative approach is to use the underlying services of the Security SupportProvider Interface (SSPI). For more information about this approach, see MSDNarticle, “.NET Remoting Security Solution, Part 1: Microsoft.Samples.Security.SSPIAssembly,” at http://msdn.microsoft.com/library/en-us/dndotnet/html/remsspi.asp.To provide secure communication when you use the TcpChannel, use IPSec or acustom encryption channel sink to encrypt the request data.