Improving Web Application Security: Threats and - CGISecurity

Chapter 13: Building Secure Remoted Components 355AuthenticationIf your remote component exposes sensitive data or operations, it must authenticateits callers to support authorization. The .NET Framework remoting infrastructuredoes not define an authentication model. The host should handle authentication. Forexample, you can use ASP.NET to benefit from ASP.NET and IIS authenticationfeatures.If you use a custom Windows service host, develop a custom authentication solution.ASP.NET HostingThe following guidelines apply if you use the ASP.NET host with the HttpChannel:●●●●●●Turn off anonymous authentication in IIS.Configure ASP.NET for Windows authentication.Configure client credentials.Increase performance with authenticated connection sharing.Force clients to authenticate with each call.Control the use of authenticated connections.Turn off Anonymous Authentication in IISTo ensure that callers are authenticated by IIS, make sure that your application’svirtual directory does not support anonymous authentication. On WindowsServer 2003, you should also ensure that .NET Passport authentication is disabled.Since you have disabled IIS anonymous authentication, you can use any of thesupported IIS authentication mechanisms to authenticate callers over theHttpChannel, for example Basic, Digest, and Integrated Windows. To avoidcredentials being passed over the network and to take advantage of Windows 2000security account and password policies, use Integrated Windows authentication.Configure ASP.NET for Windows AuthenticationConfigure your application for Windows authentication with the following setting inWeb.config:You cannot use Passport or Forms authentication because these require redirection toa login page.Note When you use Windows authentication, you are recommended to enable File authorization.For more information, see “Authorization” later in this chapter.