Improving Web Application Security: Threats and - CGISecurity

358 Part III: Building Secure Web ApplicationsControl the Use of Authenticated ConnectionsIf you set unsafeAuthenticationConnectionSharing to true, you shouldprovide a name to group together authenticated connections by settingthe connectionGroupName property. If you use default credentials, theconnectionGroupName is based on the user account used to run the thread.Custom Process HostingIf you use a Windows service host and the TcpChannel, either use this approachonly in a trusted server scenario, or provide a custom authentication scheme. Thefollowing guidelines apply if you use a custom host with the TcpChannel:●●Do not pass plaintext credentials over the network.Do not trust IPrincipal objects passed from the client.Do Not Pass Plaintext Credentials over the NetworkIf your server requires the client’s plaintext credentials, encrypt them before you sendthem over the network. If your server needs to validate the client credentials, use achallenge/response scheme to validate the credentials on the server. This couldinclude sending a hash, keyed hash, a nonce encrypted with the hash, or a using adigital signature.However, even in these scenarios, you should use an encrypted communicationchannel to prevent replay attacks.Do Not Trust IPrincipal Objects Passed From the ClientUse caution if you pass IPrincipal objects from the client to the server. Untrustedcode can create an IPrincipal object, initialize it with roles, and then send it to theserver. If the server accepts the IPrincipal without validating it, the client can elevatethe privileges of the caller on the server. For example, a malicious caller could createan IPrincipal object that contains common, highly privileged role names such asAdministrators, Managers, ExpenseReportApprovers, and Supervisors. When theobject is received on the server and placed in the Thread.CurrentPrincipal property,code that calls IsInRole on this object can be deceived into executing privileged code.